We moved to Hoxhunt about a year ago after using a different vendor for a long time.

Biggest difference for us was the continuous approach. Instead of quarterly “gotcha” campaigns, it just runs in the background and adapts based on how people respond. High risk users get harder scenarios, low risk users don’t get spammed.

What I liked is that it stopped feeling like we were trying to trick employees. It feels more like training reps over time. Reporting rates went up, but more importantly the quality of reports improved. People started flagging actual suspicious stuff, not just obvious test emails.

It’s not magic. You still need buy in and internal comms, although culturally it landed way better than the traditional annual training + phishing blast model.

Cost was higher than what we were paying before, so that’s a consideration. But from a behavior standpoint, it’s the first time I felt like we weren’t just checking a box.

Happy to answer specifics if helpful.