Run a real phishing assessment on your own team, see exactly who took the bait, and fix it — without an enterprise sales call or a security team.
Published pricing, self-serve. Most vendors hide the price behind a demo. We don’t.
Prove you own it with a one-time code sent to admin@ — no DNS, no IT ticket.
Pick a template, paste your roster, send. Every recipient is checked against a domain you own.
A real report — who clicked, who didn’t, repeat offenders to coach. No fabricated numbers.
One full phishing assessment, on us — see exactly who clicks before you spend a cent.
No credit card. Domain-verified. One assessment, then pick a plan.
Flat pricing by company size — never per seat, so a bigger team never means per-head math. Most companies land on Team.
The smallest standing plan — for the tiniest teams that want to keep testing.
Everything a whole small business needs — all assessment types, real click reporting, no per-seat math.
For multi-domain organizations that have outgrown a single team — more recipients, more domains, room to grow.
For large organizations with many domains, dedicated infrastructure, and an SLA.
The one rule every plan enforces: a campaign can only ever target people at a domain you’ve verified you own — checked on the server, on every send. We record who clicked, never what anyone typed.
Yes — when it’s your own people on a domain you’ve verified you control, which is exactly what phish.co enforces on every send. See our responsible use policy.
No. Every price is on this page, and you can start a free assessment yourself right now. Enterprise is the only plan that involves a conversation.
Yes. Plans are month to month with no contract. See refunds for the details.