gophish-ng is a Phishing Simulation product. It is deployed as cloud or on-premises (hybrid). Pricing is free.
gophish-ng is an actively maintained, security-hardened fork of Gophish, an open-source phishing toolkit for businesses and penetration testers. It is used to set up and run phishing simulations and security awareness training through a single web UI, covering landing pages, email templates, target groups, sending profiles, and per-recipient tracking. The fork modernizes the upstream project: - Go toolchain updated from 1.13 to 1.26+ - Migration from jinzhu/gorm (v1) to gorm.io/gorm (v2) - pressly/goose replaces the unmaintained goose library - Dependencies updated; govulncheck findings reduced from 47 reachable vulnerabilities to one with no upstream fix available - Frontend build replaced with a single esbuild script - CI with govulncheck, linting, and automated dependency updates Security fixes listed by the maintainers include a stored XSS in the campaign delete dialog, a process-crashing bug, an allowed_internal_hosts bug that blocked all external traffic, and an authorization bypass that let a locked-out user unlock their own account through a valid API key. Features not in upstream: - Teams that share campaigns and assets - A read-only auditor role - OAuth 2.0 for IMAP reporting - SMTP CC and per-profile send rates - Tags for templates, landing pages, sending profiles, groups, and campaigns - Anonymous campaigns that permanently scrub recipient data Deployment options are pre-built release binaries, building from source with Go 1.26+, or the Docker image published to ghcr.io. Docker configuration can be supplied through environment variables. The project is released under the MIT license.
Common questions about gophish-ng including features, pricing, alternatives, and user reviews.
gophish-ng is Hardened, maintained fork of the Gophish open-source phishing simulation toolkit. It is a Human Risk solution designed to help security teams with Open Source, Social Engineering, SMTP.
gophish-ng is deployed as a hybrid solution, suited to smb, mid-market, enterprise organizations looking to operationalize human risk. The free tier is well-suited to evaluation, small teams, and learning environments.
gophish-ng is built for security teams handling Open Source, Social Engineering, SMTP, Security Hardening. Teams typically adopt gophish-ng when they need to human risk capabilities integrated into their existing stack. Explore similar tools at https://cybersectools.com/alternatives/gophish-ng
gophish-ng is a free Human Risk tool. This makes it accessible for organizations of all sizes, from startups to enterprises. Visit https://github.com/raginx/gophish-ng for download and installation instructions.
Popular alternatives to gophish-ng include:
Compare all gophish-ng alternatives at https://cybersectools.com/alternatives/gophish-ng
gophish-ng is for security teams and organizations that need Open Source, Social Engineering, SMTP, Security Hardening, REST API. It's particularly suitable for small to medium-sized teams looking for cost-effective solutions. Other Human Risk tools can be found at https://cybersectools.com/categories/human-risk
Head-to-head feature, pricing, and rating breakdowns.
Phishing simulation & security awareness training platform for employees.
Phishing simulation and cybersecurity awareness training platform with localized content
