Aikido Security lists nine phishing simulation tools for 2026, promoting its own Noon platform; Gophish flagged for CVE-2022-45003
This vendor blog from Aikido Security compares nine phishing simulation tools for 2026 and ranks its own early-access platform Noon first. The others are KnowBe4, Hoxhunt, Adaptive Security, Keepnet, Cofense, IRONSCALES, Microsoft Defender for Office 365 Attack Simulation Training and Gophish. It argues that email-only programs miss multichannel social engineering (email followed by voice, SMS or chat, plus deepfake impersonation). It also argues that raw click rates mislead without a difficulty measure such as NIST's Phish Scale. The one security-relevant finding is that Gophish 0.12.1, the latest release, is affected by CVE-2022-45003 according to GitHub's reviewed advisory, with no patched release named. This is product-comparison content with a commercial bias, not threat reporting.
Technical Details
- Gophish is an open-source, self-hosted phishing framework. The article says versions through 0.12.1 are affected by CVE-2022-45003 with no patched release named. The article does not describe the vulnerability itself.
- Microsoft Defender for Office 365 Attack Simulation Training requires Microsoft 365 E5 or Plan 2. It covers email and QR-code payloads only, not voice or chat.
- Several vendors offer vishing, smishing and deepfake simulations. Coverage depends on licence tier and package.
Remediation
- Resolve the CVE-2022-45003 exposure before deploying Gophish, and plan for maintenance and security upkeep of self-hosted infrastructure.
- Design simulations around real business decisions such as verifying bank-detail changes and account-recovery requests.
- Measure reporting rate, time to report and scenario difficulty, not clicks alone.
- Keep technical email, device and access controls in place alongside awareness training.
Linha do tempo
-
Aikido Security lists nine phishing simulation tools for 2026, promoting its own Noon platform; Gophish flagged for CVE-2022-45003
ler a análise desta fonte ocultar
This vendor blog from Aikido Security compares nine phishing simulation tools for 2026 and ranks its own early-access platform Noon first. The others are KnowBe4, Hoxhunt, Adaptive Security, Keepnet, Cofense, IRONSCALES, Microsoft Defender for Office 365 Attack Simulation Training and Gophish. It argues that email-only programs miss multichannel social engineering (email followed by voice, SMS or chat, plus deepfake impersonation). It also argues that raw click rates mislead without a difficulty measure such as NIST's Phish Scale. The one security-relevant finding is that Gophish 0.12.1, the latest release, is affected by CVE-2022-45003 according to GitHub's reviewed advisory, with no patched release named. This is product-comparison content with a commercial bias, not threat reporting.
Technical Details
- Gophish is an open-source, self-hosted phishing framework. The article says versions through 0.12.1 are affected by CVE-2022-45003 with no patched release named. The article does not describe the vulnerability itself.
- Microsoft Defender for Office 365 Attack Simulation Training requires Microsoft 365 E5 or Plan 2. It covers email and QR-code payloads only, not voice or chat.
- Several vendors offer vishing, smishing and deepfake simulations. Coverage depends on licence tier and package.
Remediation
- Resolve the CVE-2022-45003 exposure before deploying Gophish, and plan for maintenance and security upkeep of self-hosted infrastructure.
- Design simulations around real business decisions such as verifying bank-detail changes and account-recovery requests.
- Measure reporting rate, time to report and scenario difficulty, not clicks alone.
- Keep technical email, device and access controls in place alongside awareness training.