Fallax
Runs phishing-simulation training inside your own Microsoft 365 or Google Workspace
Fallax sends phishing simulations built from lures modeled on apps your tenant actually uses (Microsoft, DocuSign, Okta, Slack, etc.), trains whoever clicks at the moment they click, and schedules each person's next test by their last result — every 2, 5, or 8 weeks. It runs inside your own M365/Google tenant rather than needing DNS changes or allowlisting, logs every send, click, and report as a timestamped record, and exports one CSV formatted for Vanta, Drata, Secureframe, or Sprinto. First 10 seats are free, it's GDPR-compliant and EU-hosted, and the vendor states the brand lures it forges aren't affiliated with those companies.
What holds up
- +Runs inside your own M365/Google tenant — no DNS changes or allowlisting needed
- +Per-person send schedule tuned by their last result, from every 2 to every 8 weeks
- +One export feeds Vanta, Drata, Secureframe, or Sprinto directly for audits
- +First 10 seats free, GDPR-compliant and EU-hosted
Mind the limits
- −Forges brand lures like Microsoft and DocuSign, unaffiliated with those companies
- −Built for Microsoft 365 / Google Workspace tenants — no other email platform mentioned
Featured here? Take the badge
Put it on your site — it links back to this review. Free for every listed product, always.
<a href="https://stillworks.dev/products/p/fallax/"><img src="https://stillworks.dev/badge/fallax.svg" alt="Picked by StillWorks" width="250" height="54"></a>