Compare platforms
The questions work for any vendor. Under each one you will find what to ask for in the demo and how SMARTFENSE answers, with what is already available in the platform.
Any brochure answers a question equally well. The difference shows up when you ask to see it.
A screenshot in a slide deck does not prove the feature exists today for your organisation. Ask them to open it live, with data, during the demo.
Whatever is on the roadmap you will not use this year. Ask to see what already works, and contrast what they promise with the vendor’s dated release notes.
Whatever cannot be exported never reaches the committee or the auditor. Ask for the file exactly as you would hand it to a third party.
Why each question matters, and what to review with any vendor, is in what is the best security awareness platform. This page is the other half: what to ask for in the demo and SMARTFENSE’s answer, question by question.
Every answer describes what is already available in the platform. The shipping history is public and can be checked in the release notes.
Question 1
What to ask for in the demo: one specific person’s profile and the organisation indicator in the same session, and next to them the completed training report. They are two different indicators and both are needed: one is the evidence an audit asks for, the other tells you who is at risk today.
SMARTFENSE’s answer
Risk Scoring crosses how likely a person is to engage in unsafe behaviour with the impact it would have, and shows it as a heat map at three levels: each person, each grouping and the organisation. That way attention goes to the intersection of the two, and not only to whoever fails most often. The indicator is available over the API and exports, so you can take it to the corporate dashboard. Completed training is read in each campaign’s reports and, regulation by regulation, in the Compliance Center.
Question 2
What to ask for in the demo: that they fire an automatic action in front of you in response to risky behaviour, and that they show you what happens when the click was made by the antivirus and not by a person.
SMARTFENSE’s answer
Playbooks run automatic actions when a risk event occurs, both from the platform components and from Microsoft 365 Defender, for example a click on a malicious URL or the creation of a mail forwarding rule. They notify whoever has to act by email, Slack or Teams, or send the data by webhook to another system, with basic authentication or OAuth 2.0. Before running they wait for the false positive detection, so a click made by software fires nothing. The platform ships ready-made Playbooks, and each organisation turns on the ones it wants. The person is spoken to by nudges: short messages triggered by what they have just done, in the channel where they already work.
Question 3
What to ask for in the demo: that they generate an annual plan from a configuration and download it for you before activating it, and that they show you how a campaign’s audience changes when someone joins the organisation or their risk level changes.
SMARTFENSE’s answer
Each piece takes care of a part of the year, and you use the ones your team needs. The automated programme builds the whole year from predefined programmes, grouped by regulatory compliance, by difficulty and by frequency, with the syllabus previewable and downloadable in Excel or CSV before you activate it. Smart Groups recalculate the audience by risk level and other combinable criteria, so whoever joins the group starts receiving content without you assigning anything. Smart Path decides every day what each person gets, without you planning a single path. Playbooks run the response. And if the organisation would rather operate none of that, SMARTFENSE or its partner runs the programme.
Question 4
What to ask for in the demo: editing one piece of content and creating a new one in the same session, and seeing which sender address and which domain it reaches the person from.
SMARTFENSE’s answer
Content customisation is a baseline feature of the platform. A piece of content is edited from the predefined one, from a template, from another piece of your own or from scratch, with a visual editor and access to the source code, your own images and videos, and variables that insert organisation and person data into the body and the subject line. Each translation takes its own images. No content carries the vendor’s brand, neither the predefined one nor the one you write. Messages go out from your own corporate sender address, the platform can run entirely under your organisation’s domain, and with Courses you can chain your content into a path the person unlocks step by step.
Question 5
What to ask for in the demo: reporting a real email and following it through to its classification, and seeing what happens to reports when nobody has time to review them one by one.
SMARTFENSE’s answer
The report button works in Outlook and Office 365, including Outlook for mobile, in Gmail and in Thunderbird, and it can integrate with the button Microsoft already ships in Outlook rather than adding a second one. What gets reported reaches the platform, where it is classified as phishing or a false alarm and the original message is kept for later analysis. Smart Triage does that classification automatically: it returns a verdict with the list of what it found in the sender, the links and the attachments. The last word belongs to a person, and if someone corrects it, their decision stands. The panel also shows the reports that are still unclassified.
Question 6
What to ask for in the demo: a simulation outside email, and the report of the same campaign with and without the interactions generated by security software.
SMARTFENSE’s answer
Each channel measures a different behaviour. Email simulation covers phishing and ransomware, with decoy files by attachment or by download link. QRishing generates a code per recipient, and its scan is recorded as the simulation’s click. The USB drive exercise measures file opening and macro activation. So that the result reflects people, the false positive detection combines a decoy link only software follows, User-Agent lists and IP ranges the organisation configures, and a tolerance window around each detection, and it can be applied again to campaigns that have already finished. When it helps to measure without the mail filter getting in the way, direct inbox delivery works with Google Workspace and Microsoft 365.
Question 7
What to ask for in the demo: the compliance report for one regulation exactly as you would hand it to an auditor, and the record of a policy accepted or signed electronically by one specific person.
SMARTFENSE’s answer
Auditing has its own views for campaigns, users, administration and system, and every interaction stores IP address, the full forwarding chain, browser identifier and a timestamp. It is a protected append-only log: a correction enters as a new entry and never overwrites the previous one, and anonymising a person overwrites their identifying data without deleting a single record. In the Compliance Center the organisation defines once what counts as met, evidence expires according to each regulation’s validity period, and the compliance plan reassigns what is missing before it expires. The Consent Vault records which version of each policy every person accepted or signed electronically. Every report exports to CSV and Excel honouring the filters applied.
A checklist where the vendor says yes to everything is no help in deciding. These three are ours, and they serve as an example of what you should ask of anyone.
The organisation downloads the decoy files from the platform and distributes the drives. Whoever finds the drive finds it, so the report gives the number of openings and not the name of the person.
When an exposed credentials service is integrated, the count is shown next to the risk score without altering it. The score measures behaviour, and a credential leaked in someone else’s breach is not that person’s behaviour.
SMARTFENSE supports customers in their own language across Spanish-speaking and Italian-speaking markets. The administration and implementation manuals are available in Spanish, English and Italian. If you operate outside that, put it in the contract rather than in the expectation.
They do not discriminate features. They tell you how much of what you are being told already happened, and what a machine decides about your people.
Artificial intelligence
What to ask for in the demo: that they show you where there is a language model and where there is a rule, why the system assigned that content to that person or classified that email as phishing, and what data of yours goes out towards which provider.
SMARTFENSE’s answer
We use a model where open content has to be interpreted: Smart Triage uses one to analyse the reported email, every verdict comes with the list of findings, a person can correct it and it is recorded who decided. Where the result has to be explainable to an auditor there are rules: Smart Path, Smart Groups and Risk Scoring work with deterministic rules.
Track record
What to ask for in the demo: the dated release notes, which tell you whether the product ships steadily; the aggregated data the vendor publishes about its own base, with the methodology in plain sight; and its certifications.
SMARTFENSE’s answer
SMARTFENSE was founded in 2016 and shipped its first release in April 2017. Every delivery since then has its dated release note, and the pace can be reviewed without asking permission. The aggregated data comes out in the Human Risk Report, which measures phishing, ransomware, smishing, training, newsletters and exams over several years. Its sample is smaller than the total number of organisations, because it takes in those with activity inside the report’s window that pass its filtering criteria, and the report states this in its methodology. The platform holds the CCN qualification in the CPSTIC catalogue and ENS conformity at the High category.
The notes are in release notes, the aggregated data in the Human Risk Report and the certifications in trust seals.
The question of who runs the programme is almost always framed as two options: either the tool does it or an administrator with spare time does it. There is a third.
SMARTFENSE Consulting takes care of the programme design, of the management and the customisation of the content, and of the scheduling and the measurement of the campaigns, with levels of support depending on how mature the programme is. It covers what no automation resolves: what suits this organisation this year, with this budget and this calendar.
When you evaluate any vendor, ask as well who answers when something breaks, in which language, in which time zone, and whether that person decides or escalates. The answer orders the rest of the evaluation more than it seems.
The detail is on the security awareness service page.
Seven questions cover most of the decision: whether the programme measures accredited training, per-person risk or both; what happens automatically after someone falls for a simulation; who runs the programme when nobody is dedicated to it; whether the content can be written in the organisation’s own voice; whether real incidents live inside the same product; what behaviour each channel measures and who filters the measurement; and what evidence is left for an audit. Each one is verified by asking to see it inside the platform during the demo.
Completed training is the evidence that the content arrived and was finished, and it is what an audit asks for. Per-person risk crosses what each one does in the face of a simulation with the impact their mistake would have, and it tells you who needs attention today and whether the organisation improves over time. It is checked by asking to see one specific person’s profile and the organisation indicator in the same session. A solid programme measures both, because they answer different questions.
The ones that reproduce the organisation’s real surface: QR codes and USB drives, on top of phishing and ransomware over email. As important as the list is who filters the measurement: the mail filter, the antivirus and many messaging apps open the links before the person does. Ask how the platform separates those interactions and whether the simulation can be delivered straight into the recipient’s inbox, to measure the person’s behaviour and not the filter’s effectiveness.
It is worth asking how much of the year holds without intervention: whether the annual plan is generated from a configuration, whether audiences recalculate themselves when someone joins the organisation or their risk level changes, whether the response to risky behaviour runs without anyone firing it, and whether there is an option to delegate the operation to the vendor or its partner when there is no internal team. It is worth identifying which part your team needs before comparing prices, because two offers of the same value can be solving different things.
If you arrived looking for SMARTFENSE alternatives, the full walkthrough is in what is the best security awareness platform, and the shipping history release by release is in product evolution.
Leave us your details and we will show you each answer inside the platform, with what is already available.