Phriendly Phishing Due Diligence

Run due diligence on Phriendly Phishing: check compliance and get alerts when suppliers or ownership change.

Australia · owned by Independent (Australia) · www.phriendlyphishing.com · 17 vendors

Phriendly Phishing is an Australian-based cybersecurity awareness training company that helps organisations manage human cyber risk through phishing simulations, automated learning paths, and real-time risk reporting. Their platform takes a 'train not trick' approach, delivering localised, engaging training content designed for Australian and New Zealand audiences to build lasting security habits. The company also offers human risk scoring, cyber resilience programs, and partner/reseller solutions, with infrastructure hosted locally to meet data sovereignty requirements.

Resilience scores

Disruption prediction

The category benchmark for Phriendly Phishing is a 5% probability of disruption in the next three months.

11 of Phriendly Phishing's 17 vendors have incident tracking.

Technology vendors

Insights

Last updated 2026-10-19 · revision 3

17 direct vendors, 227 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Phriendly Phishing exhibits high migration readiness. Their 'Human Risk Management Platform' is a core SaaS solution built on Australian-hosted cloud infrastructure, indicating a modern, likely cloud-native architecture that is inherently more portable and adaptable for migration. The ability to offer data residency in multiple countries (Australia, UK, US, Canada) is a strong indicator of an architecture designed for flexibility and ease of movement across different environments or cloud providers. Their robust regulatory compliance (GDPR, ISO 27001, SOC 2) means that data governance and security practices are mature, simplifying the compliance aspects of any migration. The assessment of NIS2 applicability is a future consideration but does not currently impede readiness. Financially, their history of global expansion and growth suggests the capacity to fund significant migration initiatives. Crucially, Phriendly Phishing benefits from a low vendor lock-in risk, with a diverse base of 17 vendors across 3 countries. This vendor diversity significantly reduces the complexity and potential friction associated with migrating services or platforms, as they are not heavily reliant on a few critical suppliers. The use of WordPress for their public-facing website is also a common and easily migratable component.

Compliance

6 in-scope frameworks identified; showing 3.

Australian Privacy Act — Evidence found

Phriendly Phishing is an Australian company (Phriendly Phishing Pty Ltd ACN 666 287 047) and is therefore subject to the Australian Privacy Act 1988.

Evidence: https://phriendlyphishing.com/privacy-policy/, https://phriendlyphishing.com/solutions/security-awareness-training/, https://phriendlyphishing.com/solutions/phishing-awareness-training/, https://help.phriendlyphishing.com/hc/en-gb/articles/17552815314963-Phriendly-Phishing-s-IP-Addresses-Domains, https://prospeo.io/c/phriendly-phishing, https://geekify.com.au/what-is-phriendly-phishing-and-why-does-it-matter/

ISAE 3000 (source) — No public evidence

Similar to SOC 2, an ISAE 3000 report would provide assurance to customers and stakeholders about the company's non-financial controls, which is relevant for a cybersecurity training provider.

GDPR (source) — No public evidence

Applicability is likely as their privacy policy mentions data transfers to the United Kingdom and other countries, and they have a UK-specific learner hub domain, suggesting they process data of individuals in the UK and potentially the EU.

Financials

Financial Resilience Score: 4/10

Phriendly Phishing is a small Australian cybersecurity SaaS company with no publicly available audited financial statements for any of the last three fiscal years. The company has undergone two major ownership changes - rolled into CyberCX in 2019 under BGH Capital, then carved out and sold to an independent private equity firm following Accenture's acquisition of CyberCX in February 2026. Third-party database estimates place revenue in the single-digit millions to low tens of millions range, suggesting a small but established niche player. The business benefits from a recurring SaaS revenue model, established brand presence in the ANZ security awareness training market since 2012, and fresh PE backing providing growth capital. Government contracts (NSW Government supplier, NZ tertiary education sector) provide some revenue stability. However, significant risks exist including carve-out transition disruption, a potential revenue cliff in March 2027 when NZ CSTS funding ends, declining headcount (from peak of 50 in July 2024 to 41 in September 2026, -6.8% YoY), and intense competition from much larger global players like KnowBe4, Proofpoint, Cofense, and Hoxhunt. The small scale limits bargaining power with enterprise customers and makes international expansion capital-intensive. Overall resilience is moderate - the company has a defensible niche and recurring revenue but faces meaningful transition and competitive risks.

Key strengths: Recurring SaaS revenue model with subscription-based phishing simulation and training, Established brand in ANZ security awareness training market since 2012, Fresh private equity backing following 2026 carve-out, Government sector traction (NSW Government supplier, NZ tertiary education), Award recognition including 2025 LearnX Awards

Risk factors: Ownership transition risk from CyberCX/Accenture carve-out causing operational disruption, NZ CSTS funded licence programme ends 17 March 2027 - potential revenue cliff, Headcount decline from 50 (July 2024) to 41 (September 2026), -6.8% YoY, Web traffic fell 8% quarter over quarter, Intense competition from larger global players (KnowBe4, Proofpoint, Cofense, Hoxhunt), Small scale limits enterprise bargaining power and international expansion capacity, No audited standalone financial statements publicly available

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report