PhishFirewall
PhishFirewall is an AI-native SaaS platform that automates phishing simulation, security awareness training, and email threat remediation for healthcare, financial, government, and SLED organizations via its autonomous AI agent Lora.
- Company typePrivate
- Founded2019
- HeadquartersHuntsville, United States
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What PhishFirewall does
PhishFirewall is a private SaaS company that sells an AI-driven security awareness training and phishing simulation platform to mid-market and enterprise customers, primarily in the United States. The platform is anchored by Lora, an autonomous AI agent that runs the full security awareness lifecycle, including user profiling, simulation scheduling, training assignment, and remediation, without requiring administrative overhead. Supporting proprietary components include PhishEQ (API-native email security inside Microsoft 365 and Google Workspace), PhishML (reported-email triage), PhishRIP (automated inbox clawback), PhishFlip (real-threat-to-simulation conversion), and Behavioral Fingerprinting for personalized risk modeling. Additional offerings span AI-powered penetration testing, LLM/ML red-teaming, compliance automation (HIPAA, PCI DSS, SOC 2, ISO 27001, GDPR, CMMC), and verticalized solutions for healthcare, financial services, logistics, and SLED.
The company monetizes primarily through per-seat subscription licensing sold via direct enterprise field sales and a three-tiered MSP Partner Program (Referral, Authorized Reseller, Strategic) offering 30-50% channel margins, supplemented by a $495/month AI penetration testing service. Named customers include LexisNexis, LA Times, LCMC Health, the State of Washington, the State of Alabama, the City of Huntsville, and the City of Madison, alongside SMB logos and a claimed cumulative reach of over 2 million trained users. Founded by Joshua Crumbaugh (former Fortune 50 red team leader) and operating with a reported 1-10 person team, PhishFirewall has raised a single $2.5M round in February 2022 from Warehouse Services and added Mark P. Petroff as Chairman, indicating a lean, founder-led capital structure.
The company competes against legacy security awareness vendors by positioning around AI-native autonomy, behavioral-science-driven personalization (BJ Fogg Behavior Model), and sub-1% click-rate guarantees, supported by G2 Leader and G2 AI badges. Distribution is hybrid: direct enterprise sales for larger deals, channel partners for SMB and mid-market reach, and a free-tools hub (phishing IQ test, dark web scanner, ransomware simulator) as a top-of-funnel entry point.
PhishFirewall firmographics
Firmographics- Name
- PhishFirewall
- Legal name
- PhishFirewall
- Website
- https://phishfirewall.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- PhishFirewall is an AI-native SaaS platform that automates phishing simulation, security awareness training, and email threat remediation for healthcare, financial, government, and SLED organizations via its autonomous AI agent Lora.
- Ownership category
- akta.pro rank
PhishFirewall industry classification
Industry- Product category
- Security Awareness Training Software
- NAICS
- Software Publishers (5132), Other Computer Related Services (541519)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Security Awareness & Phishing Simulation (Email/Collab-focused) (HDADAKAJ)
- akta.pro secondary industry
- Email Phishing & BEC Protection (HDADAKAB)
Keywords
Where PhishFirewall is headquartered
LocationHeadquarters
- HQ city
- Huntsville
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
PhishFirewall business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Subscription Licensing: Recurring subscription revenue based on per-user pricing model. Customers pay ongoing fees for access to the AI-powered training platform, phishing simulations, and behavioral analytics. Pricing is all-inclusive with no hidden fees.
- Professional Services: Penetration testing services including AI-powered security scanning at $495/month. These services complement the core training platform and provide additional revenue streams.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Per seat | Monthly | All-inclusive per-user pricing with no hidden fees |
| Unit Pricing | Monthly | AI-powered penetration testing |
| Other | Monthly | Partner margins for MSPs and resellers |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels8 records
PhishFirewall product offering
Product offeringCore offering
PhishFirewall sells an AI-driven, autonomous SaaS platform that replaces manual security awareness training programs. The platform delivers AI-generated personalized phishing simulations (including deepfake voice/video vishing and BEC), bite-sized micro-learning content, predictive human risk analytics, and an Integrated Cloud Email Security module (PhishEQ) that detects and auto-retracts phishing emails in Microsoft 365 and Google Workspace. It is sold on a recurring per-user subscription basis with optional professional services such as AI and human penetration testing.
Product overview
PhishFirewall is an AI-native autonomous human risk management platform that unifies phishing simulation, security awareness training, email security, and risk analytics into a single continuous system. The platform centers on Lora, an autonomous AI agent that handles the entire security awareness lifecycle without human intervention. Core products include Security Awareness Training (behavioral science-driven micro-learning), Phishing Simulations (AI-generated hyper-personalized campaigns with deepfake capabilities), and PhishEQ (API-based email security with psychological firewall AI). Additional modules cover Penetration Testing, AI Penetration Testing, Risk Analytics, Compliance Automation, and a Free Tools Hub. The platform serves healthcare, finance, logistics, and SLED sectors with industry-specific solutions, and offers an MSP Partner Platform with multi-tenant white-label capabilities. The architecture emphasizes continuous automation, gamified positive reinforcement, and sub-1% click rate guarantees.
Differentiator
Problem solved
Functional benefit
Brands
- Lora: AI agent that serves as the autonomous security coach, handling phishing simulations, training assignments, user profiling, and remediation for the PhishFirewall platform.
- PhishEQ
- PhishML
- PhishRIP
- PhishFlip
Products and services
- PhishFirewall Platform The core autonomous human risk management platform powered by AI agent Lora, unifying phishing simulation, security awareness training, risk analytics, and automated remediation into a single continuous system for enterprise, government, healthcare, financial, and MSP customers. Eliminates manual administration through agentic AI workflow.
- PhishEQ API-based Integrated Cloud Email Security solution that uses emotional intelligence AI to detect and automatically retract phishing threats (including internal-to-internal attacks) inside Microsoft 365 and Google Workspace with sub-1-second global clawback remediation.
- Penetration Testing Full-spectrum offensive security service including AI-powered continuous scanning, human red teaming, web application testing (OWASP Top 10), physical security assessments, social engineering, and comprehensive red team operations. AI-powered scanning component priced at $495/month.
- AI Penetration Testing AI red teaming service that secures LLMs and ML pipelines against adversarial attacks including prompt injection, jailbreaks, data poisoning, and model inversion. Aligned with NIST AI RMF, EU AI Act, and OWASP LLM Top 10 frameworks.
- MSP Partner Platform Multi-tenant management platform for MSPs and MSSPs featuring 100% white-label customization, custom domain configuration, centralized templating, and aggregate portfolio dashboards for managing multiple client organizations across the partner program.
- Compliance Automation Automated compliance training management for HIPAA, PCI-DSS, SOC 2, CMMC, ISO 27001, and GDPR with auto-enrollment, automated chasing, instant certification reports, and micro-evidence collection for audit readiness.
- Healthcare Security Training Role-based security training for healthcare organizations covering clinical workflows, ER and nursing staff, IT help desk vishing, and administrative teams, with HIPAA compliance modules and patient data protection focus.
- Financial Services Security Financial fraud defense platform including deepfake CFO detection, BEC simulations, wire fraud prevention, and executive whaling training, addressing GLBA and SOX compliance requirements for financial institutions.
- Logistics Security Training Fleet-specific security training covering dispatchers (fake rate confirmations), drivers (ELD/GPS SMS phishing), and back office (fraudulent OS&D claims), with role-based intelligence and mobile-optimized simulations.
- SLED Cybersecurity Solutions AI-powered cybersecurity solutions for State, Local, and Education (SLED) sectors addressing ransomware protection, student data security, state compliance mandates, and K-12 specific threats.
- PCI DSS Compliance Training Specialized PCI DSS 4.0 compliance training addressing Requirement 12.6 for continuous security awareness, including threat-specific content, role-based modules for payment staff, and automated audit evidence dashboards.
- Free Tools Hub Suite of free security assessment tools including a Phishing IQ Test, Weak Password Test, Email Exposure Check (dark web scanner), and Ransomware Simulator, used for evaluation and lead generation.
- PhishDiscovery Free 2-minute AI-based phishing IQ test assessing individual risk scores against modern social engineering tactics, providing instant results and a secure/private assessment for lead generation.
Quantifiable outcome
- Click rates reduced to below 1% through AI-driven personalized training
- +1 more outcomes
Companies that use PhishFirewall
Customer profileNamed customers12 records
Segments5 records
Ideal customer profiles5 records
PhishFirewall technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration8 records
AI capability9 records
Feature7 records
PhishFirewall partnerships and signals
Strategic signalScale indicators2 records
Recent moves6 records
Expansion highlights5 records
PhishFirewall competitors and assessment
Company assessmentDirect peers
- Lucy Security: Phishing simulation and security awareness platform with strong MSP/MSSP channel focus. Closely comparable to PhishFirewall's MSP Partner Platform offering and three-tier channel strategy.
- Cofense: Phishing-specific defense platform combining simulations with a crowd-sourced phishing-reporting button and intelligence feed. Overlaps directly with PhishFirewall's PhishEQ email security, PhishFlip real-threat-to-simulation loop, and reporting-button workflow.
- KnowBe4: The market-leading security awareness training and phishing simulation platform, recently taken private by Vista Equity Partners. Directly competes with PhishFirewall in the same buyer use case (annual awareness training + simulated phishing) with a much larger content library, sales force, and brand.
- Terranova Security: Security awareness and phishing simulation vendor with strong content library and multilingual coverage. Competes for the same mid-market and enterprise awareness-training RFPs as PhishFirewall, with deeper partnership-channel presence.
- NINJIO: Episodic, video-based security awareness training platform targeted at enterprise and mid-market buyers. Overlaps with PhishFirewall's micro-learning content track and competes on engagement-style differentiation.
Broad incumbents
- Proofpoint Security Awareness: Proofpoint bundles its security awareness training (formerly Wombat Security) with its broader enterprise email security and DLP platform. Competes for the same enterprise security-awareness budget as PhishFirewall but as part of a much larger, multi-product portfolio.
- SANS Institute: Largest cybersecurity training and certification body, with Securing The Human as its awareness-training arm. Broad incumbent that competes for security-awareness budget at the high end of the market and lends credibility to behavioral-training methodologies.
- Sophos Phish Threat: Phishing simulation and awareness module bundled into the broader Sophos endpoint/network security platform. Competes indirectly via bundled pricing against PhishFirewall in mid-market deals where Sophos is already deployed.
Emerging players
- Hoxhunt: AI-driven, behaviorally personalized security awareness and phishing simulation vendor. Closest direct comparable to PhishFirewall's Lora-driven adaptive personalization approach, often cited as a leader in next-generation awareness training.
- AwareGO: Behavior-focused security awareness training vendor emphasizing short-form video and cultural change. Comparable in tone and methodology to PhishFirewall's <60-second micro-learning and gamified reinforcement approach.
Market position
Strengths4 records
Weaknesses5 records
Competitive moat4 records
Key risks6 records
Key highlights6 records
Customer concentration
PhishFirewall social profiles
Digital presencePhishFirewall compliance and trust
Trust signalCompliance11 records
PhishFirewall financial estimates
Financial estimateRevenue estimate
Valuation estimate
PhishFirewall leadership team
Management profileNumber of profiles
Profiles6 records
PhishFirewall funding detail
Funding detailFunding overview
Funding rounds1 record
Investors1 record
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
PhishFirewall M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about PhishFirewall
What does PhishFirewall do?
PhishFirewall sells an AI-driven, autonomous SaaS platform that replaces manual security awareness training programs. The platform delivers AI-generated personalized phishing simulations (including deepfake voice/video vishing and BEC), bite-sized micro-learning content, predictive human risk analytics, and an Integrated Cloud Email Security module (PhishEQ) that detects and auto-retracts phishing emails in Microsoft 365 and Google Workspace. It is sold on a recurring per-user subscription basis with optional professional services such as AI and human penetration testing.
Is PhishFirewall a public or private company?
PhishFirewall is a private company. It is classified as venture growth investor backed and is currently operating.
When was PhishFirewall founded?
PhishFirewall was founded in 2019. It employs 1 to 10 people.
Where is PhishFirewall based?
PhishFirewall is headquartered in Huntsville, United States, in the North America region.
How does PhishFirewall make money?
Two revenue lines are on record. Subscription Licensing is the primary driver. The others are professional Services.
Who are PhishFirewall's main competitors?
Direct peers on record are Lucy Security, Cofense, KnowBe4, Terranova Security and NINJIO. Broad incumbents are Proofpoint Security Awareness, SANS Institute and Sophos Phish Threat. Emerging players are Hoxhunt and AwareGO.
Does PhishFirewall have an API?
Yes. PhishFirewall provides API access for partners and enterprise customers. Strategic partners receive full read/write API access with webhooks for integrating client risk scores directly into SOC or SIEM systems and automating QBR reporting workflows. The platform connects via API to Microsoft 365 and Google Workspace for user synchronization and email security (PhishEQ). Partner tiers include: Referral (no API access), Reseller (read-only API), and Strategic (full read/write/webhooks).
What industry is PhishFirewall in?
PhishFirewall's product category is Security Awareness Training Software. Its primary akta.pro industry code is HDADAKAJ, Security Awareness & Phishing Simulation (Email/Collab-focused), with a secondary code of HDADAKAB, Email Phishing & BEC Protection. Its NAICS code is 5132 and its SIC code is 7372.