Run Phishing Simulations for $37/Month Instead of $30,000/Year

Source: Dev.to | Jan 15, 2026 (UTC)

Most enterprise phishing simulation tools charge $3-5 per user per year. For a 10,000 person company, that’s $30,000-50,000 annually.

We run unlimited simulations on a $37/month Azure VM.

The Tool: GoPhish

GoPhish is an open-source phishing simulation framework. It’s been around for 10+ years, has 10,000+ installations, and is MIT licensed.

I’ve supported it for the last 8 years or so, since early 2018, maintaining the core repo and answering issues as they’ve popped up.

You can:

• Create realistic phishing campaigns
• Track who opens, clicks, and submits credentials
• Measure improvement over time
• Import thousands of targets via CSV

The problem? Vanilla GoPhish lacks enterprise basics: no MFA, no encryption at rest, no audit logging.

What We Added

We forked GoPhish and added what production environments actually need:

Feature

Why It Matters

MFA/TOTP

Your admin panel shouldn’t be a security hole

SSO (Google/Microsoft)

One-click login for your team

AES-256 encryption

Stored credentials aren’t plaintext anymore

Audit logging

SIEM export for compliance

White-label branding

Your logo, not ours

One-click deployment

Azure/AWS in ~5 minutes