Starter
$12/mo
The smallest standing plan — for the tiniest teams that want to keep testing.
- Up to 50 recipients across your org
- Email assessments + monthly scheduling
- One verified company domain
Security awareness testing wasn’t built for you. We started over.
Phishing assessments any company can actually run — no security team, no sales call, no enterprise contract.
Free forever, up to 15 employees. Verify your work domain to get started.
Email
assessments today — SMS & voice on the roadmap
15 free
employees, forever
No sales call
self-serve, same day
09:02sentInvoice-access pretext delivered to 48 people.
09:11clicked6 opened the link and were shown the tell.
09:15reported11 flagged it to security instead.
every send authorized
48 targets at acme.example — checked against the verified domain before one message left.
No vanity metrics here. Just what the product is, in plain numbers — the same facts the server enforces on every account.
0
credentials ever stored — we record who clicked, never what they typed
15
employees free forever, no card required
$0
to start — published pricing, no sales call
100%
of sends checked against a domain you verified — server-side
Real assessments were priced for companies that already have a security team.
Most phishing-simulation tools assume you already have a security engineer, a procurement process, and a budget line for it. If you don’t have all three, the options tend to be a free tool that expects you to run your own sending infrastructure and write your own templates, or a sales conversation that ends in an annual contract. Most companies — the ones without a dedicated security hire — end up doing neither, and find out the hard way instead.
We built phish.co after years doing this work the old way, watching the category stop moving. An assessment should be something any company can run, not a line item only some companies can afford.
What you get, and the one rule behind all of it.
Start free. No sales call required.
Sign up, verify your work domain, and run your first phishing assessment the same day — free, for up to 15 employees, forever. When you outgrow that, pricing scales in plain, published tiers by company size. No quote to request, no call to book first.
Every channel attackers use — starting with email.
Real attacks don’t stop at email, and neither will we. Email phishing assessments are live today; smishing (SMS) and vishing (voice) are on the roadmap — all from one account, scoped to your own verified employees, so you’ll test what your people actually face, not just the part that’s easiest to simulate.
Verified-domain only. Always.
Every account proves it owns a real company domain before it can send a single test. Every campaign is locked to that domain’s own employees — never anyone else’s, never a stranger’s inbox. That’s not a policy we ask you to trust; it’s how the product works.
Pricing that doesn’t punish being small.
Flat monthly pricing by company size — never per seat. Most companies land on Pro Angler.
Most Popular
Team
$99/mo
Everything a whole small business needs — all assessment types, real click reporting, no per-seat math.
- Up to 250 recipients across your org
- All assessment types + scheduling
- Real click reporting, CSV export & repeat-offender list
- Verify up to 5 company domains
Business
$249/mo
For multi-domain organizations that have outgrown a single team — more recipients, more domains, room to grow.
- Up to 1000 recipients across your org
- Everything in Team, at multi-domain scale
- Verify up to 15 company domains
Free forever up to 15 employees · Enterprise available · no contracts.
See full pricing
Verify your domain. Start your first assessment today.
No card required for the free tier. No hooks, no sales call.