What is the best security awareness platform?

There are many awareness platforms on the market and that, far from making the decision easier, complicates it. When the options multiply, the comparison ends up being made on feature lists that do not tell one tool from another.

This post proposes a different order: first the objective, then the questions that separate one platform from another, and at the end what almost nobody puts on the list. Each section closes with what is worth reviewing, which applies to any vendor. How we solve it goes separately, so you can use the guide without going through it.

It was published in August 2024 and reviewed in September 2026.

There is no best platform, there is the best one for your organisation

The ideal platform for one organisation can be the worst decision for another. There is no “best platform” in general; there is the best one for yours.

To find it, first define what you want an awareness platform for. The three most common objectives are:

• Managing social engineering risk
• Creating and sustaining a security culture
• Demonstrating compliance with internal and external regulations

Let us look at what each one needs.

Start with the objective, not with the feature table

Managing social engineering risk

Managing social engineering risk means knowing the current level of risk and then bringing it down to an acceptable one.

To know the level of risk you have to simulate different kinds of attack and measure how each person behaves in the face of each one. Phishing, ransomware, smishing, qrishing and USB drop do not measure the same thing, because they do not arrive through the same channel and do not ask for the same action.

But measuring is useless if the data is contaminated. When a simulation email enters your organisation, the mail filter, the antivirus or the sandbox open it and follow its links before the person does, and many messaging apps do the same with the links in an SMS. Each of those actions is recorded as if someone had taken it. If the platform does not separate them, some of the clicks you are about to count were made by nobody, and any decision you take on that data will be flawed.

To bring risk down to an acceptable level you need awareness actions, and it helps if they live in the same platform as the simulation: management gets simpler and you can cross what you teach with what changes in behaviour. Some of those actions have to arrive at the right moment. A person does the training in March and receives the suspicious email in August, in a hurry and among twenty other tasks: the knowledge was there, the reminder was not. A short message, tied to something the person has just done and in the channel where they already work, arrives while behaviour can still change.

Finally, look at how the platform connects to what you already have running. Every missing connection is manual work someone will do every month, and it is better to count it before signing.

What to review

• Which simulation channels it offers beyond email.
• How it tells a person’s interaction from a piece of software’s, whether you can load your organisation’s security tools, and whether the cleanup also applies to campaigns that have already finished.
• Whether the simulation can be delivered straight to the inbox, to measure the person and not the mail filter.
• Whether simulation and awareness live in the same product, with reports that cross them.
• Whether it can send short messages triggered by a behaviour, by email or through your organisation’s chat tool.
• Single sign-on, synchronisation with your directory, data out over the API, LMS integration and, if you are a group of companies, one instance per company managed from the parent.

At SMARTFENSE

• Simulation: phishing, ransomware, qrishing and USB drop from one platform, with direct inbox delivery for Google Workspace and Microsoft 365.
• False positives: the detection combines a decoy link only software follows, User-Agent lists and IP ranges the organisation configures, and a tolerance window around each detection. The configuration can be applied again to campaigns that have already finished.
• Awareness at the right moment: nudges are triggered by a specific event, arrive by email, Slack or Teams in each person’s language and come ready to activate. Simulation and awareness live in the same platform, with correlation reports.
• Integrations: the full list is in integrations, and groups of companies are managed from a multitenant instance.

Creating and sustaining a security culture

A security culture is not built with a campaign. It needs a continuous process, and that process depends on having content suited to your audience and varied ways of reaching it.

It also depends on the platform sustaining more than one format, because training does not do a single job. There is training everyone has to complete, on the same dates and with evidence that it happened: the regulation, the induction, the campaign after an incident. A programme with fixed dates is what that calls for, and it has no replacement. There is training where the order matters, because the second thing makes sense thanks to the first, and that is where a path the person unlocks step by step fits. And there is a third job, which is sustaining each person’s continuity through the rest of the year without planning a path for every one of them. A good platform solves all three and lets you combine them.

Identity also counts for engagement. It is practically mandatory that messages arrive from an email address of your organisation. One step beyond the sender address sits the domain: it is what the person sees when they click, and it is the difference between a programme that looks like your own and one that looks outsourced.

What to review

• A quality catalogue, regionalised and fully customisable, including creating content from scratch.
• A variety of tools to reach your whole audience.
• Whether it sustains the three jobs: programme with dates, ordered path and per-person continuity.
• Whether messages go out from an email address of your organisation.
• Whether the whole platform can run under your domain rather than a vendor subdomain.

At SMARTFENSE

• Content: a regionalised and fully customisable catalogue, with several awareness tools for your whole audience. No content carries the vendor’s brand.
• Formats: fixed programmes for what everyone has to complete, courses for ordered paths and Smart Path for each person’s continuity. The three coexist.
• Identity: your own corporate sender address and a custom domain, which the organisation sets up from the interface, with a certificate that is issued and renewed automatically.

Demonstrating compliance with internal and external regulations

Meeting a regulation can be very simple or extremely complicated. What makes the difference is whether the evidence is already there when they ask for it or has to be rebuilt.

The basis is the audit records and the regulations turned into clauses, with the content that answers each one. But two points separate a report that survives an audit from one that does not.

What counts as met. Asking what percentage of a regulation you meet looks like a closed question, and it is not. Does it count that the content is planned for the person? That it was sent to them? That they finished it? And if they finished it three years ago? Each answer gives a different number over the same data. If every report uses a different criterion, two screens of the same regulation contradict each other and the auditor has no figure to cite. The same happens with time: evidence that never expires inflates the number year after year.

Which policy each person accepted or signed electronically. Almost every organisation has distributed its policies at some point. Very few can answer, on the day it matters, four questions about one specific person: did it reach them? did they read it? did they accept or sign it? which version exactly? A PDF in a shared folder does not say.

One clarification that applies to any vendor: what an awareness platform can demonstrate is compliance with the training and awareness clauses. The technical, documentary and governance controls of a standard are not solved with training. If somebody promises you the whole standard, be suspicious.

What to review

• Audit records ready to hand over, with user and administrator logs protected.
• Regulations turned into clauses, with content tied to each one, and the ability to load your own.
• A single definition of “met” that governs every report.
• That the evidence has a validity period, and that what expires is reassigned before it does.
• Evidence of which version of each policy every person accepted or signed electronically.
• The compliance report exactly as you would hand it to an auditor.

At SMARTFENSE

• Compliance Center: in the Compliance Center the organisation chooses once how much proof a “met” requires, and that definition governs every report. The predefined regulations arrive with their clauses already mapped to content, among them the GDPR, the NIS 2 directive, DORA, ISO/IEC 27002 and Latin American regulation. The organisation adds its own, marks the clauses that do not apply to it and sets the validity of the evidence per regulation.
• Compliance plan: it assigns each person what they are missing and reassigns it before their evidence expires. The result is delivered as a certificate and an evidence pack.
• Consent Vault: it records which file each person read, when and from where, and whether they accepted or signed it electronically, in a record that is neither edited nor deleted.
• Auditing: records ready to hand over on a protected append-only log, where a correction enters as a new entry and never overwrites the previous one. Every report exports to CSV and Excel.

Seven questions a demo answers and a brochure does not

With the objective clear, the comparison becomes manageable. These seven questions discriminate more than any feature list, because each one is verified in a real test and none is answered with a generic yes.

1. Does the programme measure accredited training, per-person risk, or both? It reveals whether the number that closes the quarter tells you who is at risk today.
2. What happens after someone falls for it? It reveals whether the platform only assigns training or acts as well.
3. Who runs the programme when nobody is dedicated to it? It reveals whether the programme survives a busy person or a holiday.
4. Can the content be written in the organisation’s own voice? It reveals whether you can react to a case of your own this week or depend on the vendor’s catalogue.
5. Do real incidents live in the same product? It reveals whether the email a person reports ends up in the programme’s inbox or in a shared mailbox.
6. What behaviour does each channel measure, and who filters the measurement? It reveals whether the results reflect people or security software.
7. What evidence is left for an audit? It reveals whether you will rebuild it by hand or the record is already there.

Four of these questions deserve a comment, because they are the ones answered badly most often. What to ask for in the demo for all seven, and how SMARTFENSE answers each one, is in compare security awareness platforms.

Accredited training or per-person risk

They are two different indicators, and both are needed. The completed training percentage is the evidence that the content arrived and was finished, and it is what an audit asks for. What it does not say is who is at risk today, or whether the organisation is better than six months ago. That calls for a per-person indicator that crosses what each one does in the face of a simulation with the impact their mistake would have. A platform that offers only one of the two leaves you blind in half the work. We develop it in why the compliance percentage lies and in what human risk management actually means.

What to review

• One specific person’s profile and the organisation indicator, in the same session.
• Whether the risk indicator exists per person, per area and for the whole organisation.
• Whether you can compare it against itself six months later and take it to your corporate dashboard.

At SMARTFENSE

• Risk Scoring: it crosses how likely a person is to engage in unsafe behaviour with the impact it would have, at person, grouping and organisation level. It is shown as a heat map and is available over the API.

What happens after someone falls for it

If the platform only assigns training, the response is left to whoever reviews the report, whenever they can. What helps is the action firing on its own in the face of risky behaviour and reaching whoever has to act. And it helps if it can also be triggered by what your security stack detects, not only by what happens inside the platform.

There is a detail that slips through in almost every demo: if the automation does not tell a person’s click from the antivirus’s, your team will end up responding to incidents that never happened.

What to review

• That they fire an automatic action in front of you, in response to risky behaviour.
• Who it notifies and through which channel, and whether it can send the data to another system, such as the SIEM or the ticketing tool.
• Whether it can react to events from your security stack.
• What happens when the click was made by software.

At SMARTFENSE

• Playbooks: Playbooks react to programme events and to Microsoft 365 Defender events, such as a click on a malicious URL or the creation of a mail forwarding rule. They notify whoever has to act by email, Slack or Teams, or send the data by webhook to another system.
• No false alarms: before running they wait for the false positive detection, so a click made by software fires nothing.
• Nudge and playbook: the nudge speaks to the person; the playbook, to whoever has to respond.

Who runs the programme

It is the most common constraint and the one that shuts most programmes down around month six. The question is how much of the year holds without intervention: whether the annual plan builds itself, whether audiences update when someone joins the organisation or their risk level changes, whether the response runs without anyone firing it, and what happens when there is simply no internal team.

What to review

• That they generate an annual plan from a configuration, and that they show it to you and download it for you before activating it.
• Whether campaign audiences recalculate themselves.
• Whether there is an option to delegate the operation to the vendor or its partner.

At SMARTFENSE

• Automation: the automated programme builds the year from predefined programmes, Smart Groups recalculate who receives each campaign, Smart Path decides what each person gets every day and Playbooks run the response.
• Delegated operation: when there is no internal team, the programme can be run by SMARTFENSE or its partner.

Where incidents live

When a person reports a genuinely suspicious email, someone has to classify it, keep it and leave a record. If that happens outside the platform, the habit that takes so much effort to instil fades for lack of a response.

There is a second problem, which shows up exactly when reporting works: every new report is work for the security team. Improving the reporting rate without solving classification only grows the pile. You can see the full circuit in the journey of a reported email and in how a report is triaged.

What to review

• Reporting a real email and following it through to its classification.
• Whether the report button works in the mail clients your people use.
• Whether what is reported gets classified on its own, whether each verdict explains why and whether a person can correct it.
• Whether there is an indicator of unclassified reports.

At SMARTFENSE

• Report button: it works in Outlook, Gmail and Thunderbird, and it can integrate with the button Microsoft already ships in Outlook. What is reported reaches the platform, where it is classified and kept.
• Smart Triage: it analyses every reported email and returns it as phishing or a false alarm, with the list of what it found in the sender, the links and the attachments. The last word belongs to a person, and if someone corrects it, their decision stands.

Four considerations almost nobody puts on the list

The vendor behind the product

Something not always taken into account is how close the vendor is. Having someone who answers in your language and in your time zone completely changes how long you take to resolve any problem.

It is also worth looking at the vendor itself. You are going to entrust it with information from your whole organisation, and the answer on certifications and data processing should be ready before your legal team asks for it.

What to review

• Who answers when something breaks, in which language and in which time zone, and whether that person resolves or escalates.
• If support in your language matters to you, that it goes in the contract and not only in the expectation.
• Which certifications the vendor holds, where your data is hosted and how your people’s personal data is processed.

At SMARTFENSE

• Support: in the customer’s language across Spanish-speaking and Italian-speaking markets, with administration and implementation manuals in Spanish, English and Italian.
• Certifications: CCN qualification in the CPSTIC catalogue and ENS conformity at the High category, detailed in trust seals.

Artificial intelligence

Today almost every platform says it uses artificial intelligence. The useful question is what they use it for and with what guarantees. A language model is good for interpreting open content, such as a reported email. Assigning training or calculating a risk indicator usually works better with deterministic rules, because the result has to be explainable to an auditor.

Look for automation and assistance, but in the right measure. You are dealing with people, looking for safe habits, and you do it on behalf of your security area.

What to review

• Where there is a model and where there is a rule.
• What the system decides and what a person still decides. If nobody can answer that, the label is probably sitting on top of a feature that already existed.
• Whether it explains its decisions: why it assigned that content to that person, or why it classified that email as phishing.
• What data of yours leaves, towards which provider and where it is processed.

At SMARTFENSE

• Where there is a model: Smart Triage uses one to analyse the reported email. Every verdict comes with the list of findings, a person can correct it and it is recorded who decided.
• Where there are rules: Smart Path, Smart Groups and Risk Scoring work with deterministic rules, so every assignment can be explained.

Track record and first-party data

A product that has existed for two years and one that has spent a decade measuring behaviour can have the same feature list. The difference shows up in what each one can show you of its own past.

There are two proofs that are hard to improvise. The dated release notes tell you whether the product ships steadily and at what real pace whatever they are promising you for next year actually lands. And a report with a declared sample, a time window and filtering criteria is only held by whoever measured for years. Neither of the two guarantees the platform is the right one for you, but both tell you how much of what you are being told already happened and how much is still a plan.

What to review

• The dated release notes, which anyone can review without asking permission.
• The aggregated data the vendor publishes about its own base, with the methodology in plain sight.

At SMARTFENSE

• Public history: the first release shipped in 2017, and every delivery since then is in the release notes.
• Aggregated data: the Human Risk Report publishes what was measured over the customer base, with its methodology.

The cost of the full package

Two proposals at the same price can cover very different things. Whatever is not in the answer about price you will discover at renewal.

What to review

• The price of the package that covers your complete requirement, not the base plan.
• Which modules are charged separately.
• Whether there is a limit on campaigns or simulations, and how users are counted.
• What the minimum contract term is.

Final thoughts

The most important thing is meeting your objectives comfortably and effectively. Do not be guided so much by generic comparisons or reports: look for what is best for your organisation and verify it in a real test before signing.

If you want to order the evaluation step by step, in how to choose your awareness platform we develop the same path as a decision framework.

Frequently asked questions

What is the best security awareness platform?

There is no single best platform for every organisation. The ideal platform for one can be the worst decision for another, because what changes is the objective. Before comparing tools, define whether the goal is managing social engineering risk, sustaining a security culture or demonstrating regulatory compliance. Each of those objectives demands different features, and the right platform is the one that meets yours with the team and the budget you actually have.

What criteria should I use to choose a security awareness platform?

Seven criteria order the evaluation better than a feature table: what the programme manages, courses or people; what happens after someone falls for a simulation; who runs the programme when nobody is dedicated to it; whether content can be written in the organisation’s own voice; whether real incidents live inside the same product; which channels the simulation covers beyond email; and what evidence is left for an audit. All seven can be answered in a demo.

Why is a course completion rate not enough as an indicator?

Because it measures training activity, not risk. A high completion rate is a valid record that training was delivered, and it closes an audit box. It does not tell you who is at risk today or whether the organisation is better off than six months ago. That requires a per-person indicator combining what each person does when facing a simulation with the impact their mistake would have.

What happens if nobody is dedicated to running the programme?

This is the most common constraint and the one that shuts most programmes down around month six. Ask about the real degree of automation: whether the platform generates the annual plan from a configuration, whether audiences recalculate themselves when someone joins the organisation or crosses a risk threshold, and whether the operation can be delegated to the vendor or its partner. A programme that depends on someone pushing it every month stops when that person goes on holiday.