Phishing training used to mean an annual video and a quarterly fake email with an obvious typo. That program no longer matches the threat. Attackers now use generative AI to write clean, personalized lures, clone a manager’s voice from a short clip and join video calls with a synthetic face. The employee who has to make the call on a suspicious request is dealing with far better forgeries than the ones most training libraries were built around.
Security awareness training companies have responded in different ways. Some have added voice, SMS and Microsoft Teams simulations. Some build deepfake exercises that use a real executive’s likeness, with consent. Others have moved toward human risk management, pulling signals from email, identity and endpoint tools to decide who needs training and when. The right fit depends on your size, your compliance needs and how much time your team can give the program.
The ten companies below run phishing simulation and training platforms that we verified on their own sites, with deepfake awareness noted where it is offered. Every entry is ranked on merit, and no company paid for placement.
Security Awareness Training Companies At A Glance
Company
Headquarters
Best For
Core Services
KnowBe4
Clearwater, USA
Organizations of any size wanting a large content library
Phishing and vishing simulation, AI agents, deepfake training, real-time coaching
Hoxhunt
Helsinki, Finland
Enterprises wanting adaptive, gamified training
Adaptive phishing training, deepfake video simulations, reported email triage
Adaptive Security
New York, USA
Teams focused on AI-driven and deepfake threats
Multi-channel simulations, deepfake and voice clone training, phish triage
Proofpoint ZenGuide
Sunnyvale, USA
Proofpoint email customers
Risk-based training, simulations built from real attacks, user risk scoring
Mimecast Engage
London, UK
Teams wanting human risk scores tied to security tools
Human risk command center, AI-generated simulations, adaptive nudges
Living Security
Austin, USA
Security teams building a human risk program
Risk-targeted phishing, vishing and SMS simulation, escape-room training
Cofense
Arlington, USA
Organizations pairing training with phishing remediation
PhishMe training, phishing detection and response, managed phishing defense
End-user training tracks, phishing platform, role-based training
Keepnet
London, UK
Teams wanting simulations across many channels
Email, SMS, voice, QR and callback phishing simulation, deepfake simulation
NINJIO
Westlake Village, USA
Companies that struggle with training engagement
Episodic video training, phishing simulation, personalized coaching
Best Security Awareness Training Companies For 2027
1. KnowBe4 — AI Defense Agents Plus Custom Deepfake Training Of Your Own Leaders
KnowBe4, headquartered in Clearwater, Florida, and taken private by Vista Equity Partners, is the platform many buyers measure others against. Its security awareness training combines AI-generated, personalized phishing simulations with vishing simulations, a role and risk-based content library localized into more than 47 languages, and a SmartRisk Engine that scores risk at the user, group and organization level. AI Defense Agents, branded AIDA, automate the routine work of assigning training, running simulations and coaching.
What stands out for 2027 is its deepfake training. Administrators can create and approve a custom training experience, including one featuring one of the organization’s own leaders, that teaches staff to spot fraudulent video conferences and the narrative red flags in manipulated media. KnowBe4 also offers real-time SecurityTips inside Slack, Google Chat and Microsoft Teams when risky behavior happens. It is best for organizations of almost any size that want a broad library, strong automation and a vendor most auditors and insurers already recognize.
2. Hoxhunt — Adaptive Phishing Training With Executive Deepfake Video Calls
Hoxhunt, founded in Helsinki in 2016 with a US office in Minneapolis, built its platform around frequent, personalized simulations followed by short micro-trainings. Simulations can arrive by email, SMS, phone call or Microsoft Teams and are tailored by factors such as department and location. The platform also automates triage of user-reported emails and includes a behavior risk console that surfaces risky actions beyond email.
Its deepfake feature is one of the most concrete in the market. Hoxhunt creates a deepfake of one of your executives’ likeness and voice, then plays the scenario out in a fake video meeting styled after Microsoft Teams, Google Meet or Zoom. You choose which employees receive it, typically finance staff and executive assistants, and a dashboard tracks how readiness changes over time. The gamified approach tends to keep participation high without heavy admin work. It is best for mid-sized and large enterprises that want training to adapt to each employee and want realistic exercises for the roles most likely to be targeted.
3. Adaptive Security — Multi-Channel Simulations Using Cloned Voices And Synthetic Video
Adaptive Security, headquartered at 120 Broadway in New York, is a newer company built specifically for AI-driven social engineering. Its training library of more than 1,000 resources covers AI threats, phishing, voice cloning, deepfake security and compliance. Simulations run across email, voice calls and SMS, with AI-driven spear phishing that draws on public information about the target.
The company describes its most advanced simulations as live, adaptive exercises that generate cloned voices and synthetic video of real executives, delivered across email, voice, SMS and video. That makes it a strong match for organizations that have already seen voice or video impersonation attempts against finance or help desk staff. Adaptive has also added agentic email security that re-checks inbound mail after native filtering, phish triage for reported messages, and AI governance monitoring for risky prompts sent to AI tools. It is best for security teams that want their awareness program to focus squarely on the AI-enabled attacks employees are now most likely to face.
4. Proofpoint ZenGuide — Simulations Built From Real Attacks Caught In Your Mail Flow
Proofpoint, headquartered in Sunnyvale, California, sells security awareness training under the ZenGuide name. Training adjusts to each user’s behavior, performance and risk, and users are automatically enrolled in learning paths that match their risk level. The program includes micro-learning, just-in-time coaching, gamified dashboards, multi-language content, accessibility settings and benchmarking against industry peers.
The feature that sets ZenGuide apart is AI ThreatFlip, which turns phishing messages Proofpoint has actually detected into safe simulation templates by stripping out harmful elements and sensitive data. That means employees practice on the lures criminals are sending your company right now, not on generic templates. A Report Suspicious button for email and mobile feeds those reports back to the security team. Risk scores factor in role, behavior and threat exposure, so the people attackers target most get the most attention. It is best for organizations already using Proofpoint email protection, where training and detection share the same threat data.
5. Mimecast Engage — Human Risk Scores Drawn From Email, Endpoint And Identity Signals
Mimecast, headquartered in London, positions Engage as human risk management rather than training alone. Its Human Risk Command Center combines behavior signals from across the security stack into risk scores covering email, endpoint, data and identity, with integrations into tools such as CrowdStrike, Okta and Netskope. A Watchlist Manager builds dynamic groups from those scores and can sync them with adaptive security controls.
On the training side, Engage includes a library of more than 200 modules in 27 languages, covering AI threats, phishing and malware, delivered as short monthly sessions. The Engage AI Generator creates phishing templates by attack type, industry and difficulty. Context-aware nudges reach users by email, Slack or Teams, and each employee gets a scorecard showing risk level, completed training and areas to improve. It is best for organizations that want awareness training to feed into, and respond to, the rest of their security controls, especially existing Mimecast email customers.
6. Living Security — Risk-Targeted Simulations Plus Escape-Room Style Team Training
Living Security, headquartered in Austin, Texas, sells an AI-native human risk management platform. It reads signals from tools a customer already runs, such as email security, the identity provider, MFA and HR systems, to find where human and AI agent risk is concentrated. Its intelligence engine, Livvy, then proposes responses that run only after the customer’s team approves them.
The training toolkit is broad. Phishing simulations are targeted using that risk data, and AI-driven vishing calls and two-way SMS simulations cover the channels where many social engineering attacks now start. A content library is delivered through playbooks, and Content Studio lets teams build their own material. Living Security is also known for CyberEscape Online, an escape-room style team exercise, and VTX tabletop exercises that get departments working through scenarios together. It is best for security teams that want to measure human risk across the organization and target training where data shows it is needed.
7. Cofense — PhishMe Training Linked To Campaign-Level Phishing Removal
Cofense, formerly known as PhishMe and based in Arlington, Virginia, has long connected awareness training with what happens after an employee reports a message. Its PhishMe Security Awareness Training platform runs the simulations, while its phishing detection and response platform identifies and removes entire phishing campaigns from inboxes, not just single emails.
That link between training and response is the main reason to choose Cofense. When a trained employee reports a real phish, the security team can find every related message and pull it, which turns awareness training into a practical detection source. Cofense also maintains a Phishing Threat Database of real threats that evaded secure email gateways, offers a managed phishing defense service that extends your team, and brings detection, remediation and training together in its Command Center. A Secure Behavior Management offering measures behavior change across the workforce. It is best for organizations with a security operations function that wants reported phish to drive real remediation.
SANS Security Awareness is the training arm of the SANS Institute, headquartered in Rockville, Maryland, and best known for technical cybersecurity training. Its end-user program includes more than 50 modules across six tracks, curated by SANS subject matter experts and translated into more than 34 languages. Role-based training under its Workforce Security and Risk Training line tailors content for end users, IT administrators and executives.
The SANS phishing platform runs preconfigured or custom simulated campaigns, with just-in-time training and automated remedial courses for users who click. What sets SANS apart is credibility: the content is written by practitioners who also teach professional security courses, which carries weight with boards, auditors and regulated industries. SANS also lists voice cloning among the evolving threats its content addresses. It is best for organizations in regulated sectors, government and critical infrastructure that want authoritative, role-specific content over gamification.
9. Keepnet — Callback, QR And MFA Phishing Simulations Across Every Channel
Keepnet was founded by Ozan Ucar and began operations in London in 2017, with an office in Seattle as well. It offers one of the widest ranges of simulation types we reviewed: email phishing, SMS smishing, voice vishing, QR code quishing, MFA phishing and callback phishing, where a lure persuades the victim to phone a fake support line. Adaptive training paths are tailored to individual risk levels and roles.
Keepnet also offers a free deepfake phishing simulation tool and a Vishing as a Service offering for teams that want voice attacks run for them. Its phishing incident response module uses AI-driven analysis and automated responses for reported messages. The breadth of channels is the main draw, since attackers increasingly move a victim from email to phone or text partway through an attack, and training only on email leaves that gap open. It is best for organizations that want to test employees on every channel attackers use, including the help desk and callback scenarios that email-only programs miss.
10. NINJIO — Monthly Animated Episodes With Emotional Susceptibility Coaching
NINJIO, headquartered in Westlake Village, California, takes an entertainment-first approach to training. Its NINJIO AWARE program releases a new short microlearning episode each month, using Hollywood-style storytelling based on real attacks to keep employees watching. NINJIO PHISH3D runs simulated phishing campaigns that test users against different attack vectors, emotional manipulation tactics and difficulty levels.
The standout is NINJIO SENSE, a personalized coaching program built on each user’s Emotional Susceptibility Profile. Instead of only tracking who clicks, it looks at which pressure tactics, such as urgency, authority or curiosity, a person tends to respond to, and coaches them to recognize those manipulation attempts. That psychology-first angle fits well with AI-era social engineering, where lures are polished and the emotional hook is often the only tell. It is best for organizations where training fatigue is the main obstacle and engagement needs to improve before anything else will work.
How To Choose A Security Awareness Training Company
Most platforms send fake phishing emails and track clicks. The differences are in the channels they cover, how they decide who gets trained and how much work they create for your team.
Does It Cover Voice, SMS And Deepfake Attacks?
Email is still the main entry point, but help desk resets and payment fraud increasingly start with a phone call or video meeting. If your finance team, executive assistants or IT help desk are likely targets, look for vendors with vishing and deepfake exercises, such as Hoxhunt, Adaptive Security, KnowBe4 or Keepnet. Make sure any executive likeness is used only with that person’s consent.
How Does It Decide Who Needs More Training?
Annual training for everyone wastes time for low-risk staff and under-trains high-risk ones. Ask whether the platform scores risk per user, which signals it uses, and whether it can pull data from your email, identity and endpoint tools. Human risk platforms such as Mimecast Engage and Living Security go furthest here.
What Happens When Employees Report A Real Phish?
A successful program increases reports, and someone has to review them. Check whether the vendor automates triage of reported messages and can remove related emails across the organization. Without that, better training can simply move the workload onto your security team.
Will It Satisfy Our Auditors And Insurers?
Frameworks such as HIPAA, PCI DSS, SOC 2 and CMMC expect documented security awareness training. Confirm that reports show completion, simulation results and trends in a format your auditors accept. If you are working with a GRC consulting firm, ask them which evidence they need before you choose.
Should We Also Run A Live Social Engineering Test?
Platform simulations measure trends, but they follow a template. A social engineering penetration testing company will run a targeted, human-led campaign by phone, email and sometimes in person, which shows whether your training holds up against a determined attacker.
Conclusion
Security awareness training is now a defense against AI-powered threats, not a compliance checkbox. The strongest security awareness training companies simulate the channels attackers actually use, target training by risk and connect reports to real remediation. Pick two or three platforms from this list that match your size and threat profile, run a pilot with your highest-risk teams, and judge them on reporting rates and repeat failures rather than completion numbers alone.
