When companies set up security awareness training and phishing drills, they usually choose between four types: an international awareness platform such as KnowBe4, the attack simulation training built into Microsoft 365, a self-hosted open-source tool such as GoPhish, or a training platform built around local language and audit requirements.
None is best for everyone. Below is a comparison table, then who each type suits, and finally the questions to ask before you buy.
Comparison table
The table compares typical approaches by solution type. Vendor features and licensing change, so check the vendor's current documentation before signing.
| Criterion | KnowBe4 and similar | Microsoft 365 Attack Simulation | Open source (GoPhish) | LabLearn |
|---|---|---|---|---|
| Phishing simulation | Yes, many templates | Yes | Yes (drills only) | Yes, email and Slack |
| Training content | Large content library | Microsoft training modules | None, bring your own | AI-generated from your SOPs, published after human review |
| Language and local scenarios | Check language coverage | Check language coverage | Write your own | Traditional Chinese, English, Japanese |
| Remedial training after a click | Yes | Yes | No, integrate yourself | Assigned automatically, record updated on completion |
| Audit evidence | Platform reports | Platform reports | Compile yourself | Training, tests, attendance and drills in one ISO audit report |
| In-person attendance | Not a core feature | No | No | Yes: QR check-in, e-signature, check-out duration |
| Licensing | Per-user subscription | Requires Defender for Office 365 Plan 2 (included in Microsoft 365 E5) | Free; needs your own server and staff | By headcount, priced per training cycle |
| Run for you | Depends on plan | Self-service | Self-service | We can design scenarios and run sending |
Who are KnowBe4-type platforms for?
Their strength is volume and maturity: many training videos, interactive courses and phishing templates. They suit organisations with staff in many countries, a need for lots of ready-made courses, and in-house security staff to run the platform.
Ready-made content covers generic scenarios. If your auditor wants evidence that staff understand your own SOPs, you will usually need to add your own content and tests.
Who is Microsoft 365 Attack Simulation for?
If you already have Microsoft 365 E5 or Defender for Office 365 Plan 2, the built-in attack simulation training needs no new system, which is the easiest path for IT.
Its scope is mainly email phishing drills and the related training modules. SOP training, in-person attendance and training records across other topics such as health and safety or privacy need to be handled elsewhere.
Who is self-hosted open source for?
Open-source tools like GoPhish are free and flexible, suiting companies with a security team that wants full control of sending and data.
They only handle the drill. Training content, remediation, reporting and audit evidence are yours to build, as are server maintenance, sending reputation and data protection.
Who is LabLearn for, and when is it not a fit?
LabLearn suits companies preparing for ISO 27001, ISO 9001, ISO 45001 or privacy-law audits that need to train staff on their own SOPs and hand over training, test and drill evidence in one go. If you have no one to run a training platform, we can run it for you.
If you need hundreds of ready-made video courses, staff across a dozen countries, or integration with an existing learning system via SCORM or single sign-on (SSO), an international platform is a better fit.
Six questions to ask vendors
- Can training content be generated from our SOPs and policies, not just generic courses?
- Is the content and its scenarios relevant to scams common in our market and to staff roles?
- Do phishing drills use a dedicated sending domain, isolated from our corporate mail reputation? Does the fake login page store nothing staff type?
- Are staff who click automatically assigned remedial training, and does the result flow back into training records?
- Can we export one report for the auditor covering who was trained, test scores, attendance and drill results?
- If we lack the staff, can someone design scenarios and run the drill for us?
The full flow
Evaluate a security awareness training platform in five steps:
-
1
Confirm what auditors will ask for
List this year's audits (ISO 27001, customer security questionnaires, privacy law) and the training evidence each requires.
-
2
Check existing licences
See whether you already have Microsoft 365 E5 or Defender for Office 365 Plan 2 to avoid paying twice.
-
3
Decide on the content source
Are generic courses enough, or do you need training and tests built from your own SOPs?
-
4
Decide who will run it
Is there someone in-house to design scenarios, handle sending setup and follow up on remediation? If not, choose a solution that can run it for you.
-
5
Pilot small, then expand
Run one round of training and a drill in a single department, check the report is genuinely audit-ready, then roll out company-wide.
Try a round with LabLearn
LabLearn turns the SOPs you upload into training questions, publishes them to staff after human review, and combines phishing drills, remedial training and in-person attendance into one ISO audit report. Book a demo and pilot it with one department before deciding.
FAQ
Are there alternatives to KnowBe4?+
Yes. Common alternatives include Microsoft 365's built-in attack simulation training, the open-source tool GoPhish, and localized training platforms such as LabLearn. Compare whether content fits your company, whether results work as audit evidence, and whether anyone can run it for you.
Do I need Microsoft 365 E5 to run phishing simulations?+
The built-in attack simulation training requires Defender for Office 365 Plan 2, which is included in Microsoft 365 E5 and can also be purchased separately. Check Microsoft's current documentation for exact licensing.
Are phishing drills alone enough for ISO 27001?+
Usually not. ISO 27001 requires evidence of staff awareness and competence. Drills measure behaviour; you also need training content, test results and traceable training records.
How does GoPhish differ from commercial platforms?+
GoPhish only sends drills and records results. It is free but self-maintained; training content, remediation and audit reports must be prepared separately.
How is LabLearn priced?+
By headcount tier, priced per training cycle rather than a locked annual subscription. Pricing is discussed when you book a demo.