Phriendly Phishing Review Australia 2026: Strong AU Phishing Training, Hidden Pricing

The verdict: Phriendly Phishing is a solid, Australian-made phishing-simulation and security-awareness platform built for local teams. The "Train, not Trick" approach, Melbourne and Sydney support, and built-in QR-code phishing tests are genuine strengths. Two things hold it back: there is no published pricing of any kind, and the "AI" billing is thin — this is rule-based automation, not a generative engine. Worth a demo if you run an ANZ team and want local content and support. Score: 17/25 — Very Good.

Phishing is still how most Australian businesses get breached. Someone clicks a dodgy link, hands over a password, and you spend the next fortnight cleaning up. Phriendly Phishing tackles that the proven way: it sends your staff fake phishing emails, then trains the ones who fall for them. It is built in Australia, for Australian and New Zealand organisations, and that local focus is the core of its pitch.

This is a team product, not something a sole trader signs up for on a Sunday night. It connects to your staff directory and runs campaigns automatically. Most organisations are live within a few hours.

What it does well

• It tests more than just email. You get standard email phishing, spear phishing "tailored to specific roles, departments, or risk profiles," SMS phishing (smishing), and QR-code phishing — "quishing." The vendor positions itself as "one of the few platforms offering built-in QR code phishing" simulations, noting that "most email security tools cannot scan or block" malicious QR codes. (Source) That matters, because fake QR codes on car-park signs and invoices are a real and growing trick.
• It trains instead of shaming. The "train not trick" methodology is about behaviour change, not catching people out. Staff who interact with a simulated phish get "automated enrolment into targeted micro-lessons," delivered as "short, scenario-based lessons" rather than a two-hour mandatory webinar. (Source)
• Phish Focus gives staff a report button. The vendor describes it as "an email triage solution that helps your team detect and remediate real phishing threats in minutes," using automated workflows and "smart prioritisation." (Source) Turning every employee into a sensor is one of the better ways to catch real attacks early.
• The reporting is audit-ready. The platform offers "real-time dashboards to report on risk scores, compliance, and progress." (Source) If your insurer asks for proof of staff training, this gives you something to export.
• Low IT overhead. Simulation campaigns "can be easily automated," and the vendor pitches a "managed service training solution which requires minimal ongoing effort from IT teams." (Source)

A managed-service option, Secure Care, "simplifies rollout, tracks impact and lets your team focus on what matters most" if you would rather not run it in-house. (Source)

Watch out for

• The "AI" label is thin. Be honest about this: AI is not genuinely core here. On its own pages the vendor describes "automated phishing simulations," "smart prioritisation" in Phish Focus, and "personalised learning journeys" — light automation and rule-based personalisation, not a generative engine. (Source) We found no vendor-stated generative-AI or machine-learning simulation engine. If you are shopping specifically for AI-driven attack simulation, look closely before assuming that is what you are buying.
• No pricing. None. There is no public pricing in any currency — no plan names, no tiers, no per-user rates. Every page leads only to "Request a demo." You cannot compare it on cost without booking a sales call. (Source)
• No visible free trial or self-serve sign-up. The only call-to-action across the site is a demo request; onboarding is sales-led. (Source)
• Not for individuals. It is built for organisations and teams and sold through a sales-led demo process.
• Ownership has moved offshore. Phriendly Phishing is Australian-made in heritage and content, but it is a CyberCX company, and Accenture agreed to acquire CyberCX in August 2025 — a deal that closed on 27 February 2026. (Source) At the parent level it is no longer Australian-owned.
• Hosting specifics aren't published. The vendor says it delivers "training from Australian-based infrastructure to meet data residency, compliance, and privacy requirements," but which cloud, which region, and which certifications (IRAP, ISO 27001, SOC 2) back that claim are not detailed on its public pages. (Source)

Pricing

There is genuinely nothing to convert here — the vendor publishes no pricing in AUD or USD. Because the company is Australian, quotes are presumably in AUD, but that is unverified, and GST treatment is unknown with no published figure to check. Budget for a sales conversation rather than a card payment.

Australian fit

This is where Phriendly Phishing earns its keep.

• AUD pricing: Unknown. No pricing is published in any currency. The vendor is Australian, so quotes are presumably AUD, but this is unverified.
• Data residency: The vendor states it delivers "training from Australian-based infrastructure to meet data residency, compliance, and privacy requirements." (Source) That is a vendor-stated claim — the specific cloud, region and certifications are not published, so the infrastructure detail is unverified.
• Australian-made: Yes, in heritage and content — though now Accenture-owned at the parent level (see above). (Source)
• Support: A Melbourne head office and a Sydney office, with a local support team operating Monday–Friday and AU phone support on 1300 407 682. (Source) It serves organisations "across Australia and New Zealand." (Source)
• GST: Not stated — no published pricing, so treatment is unknown.

For an Australian business that cares about local data residency and being able to ring a Melbourne or Sydney support line, this is a strong local fit. The one asterisk is that the data-residency claim rests on the vendor's word, not on a published certification.

Scoring

Total: 17/25 — ⭐⭐⭐⭐ Very Good

Frequently asked questions

Is Phriendly Phishing Australian? It is Australian-made in heritage and content, with offices in Melbourne and Sydney and a local phone line. At the corporate level it is no longer Australian-owned — it is a CyberCX company, and Accenture's acquisition of CyberCX (announced August 2025) closed on 27 February 2026. (Source)

How much does it cost in Australia? We don't know. The vendor publishes no pricing in any currency — every page leads only to a demo request. (Source) You have to book a sales call to get a number, and GST treatment is unstated.

Is my staff data kept in Australia? The vendor states it uses "Australian-based infrastructure" to meet Privacy Act 1988 data-residency requirements. It does not publish which cloud provider, region, or certifications back that claim, so verify the specifics directly during your demo.

Does it actually use AI? Not in any meaningful, verified way. It is a security-awareness and phishing-simulation platform with rule-based automation and "smart prioritisation." There is no verified generative-AI or machine-learning engine behind the simulations. Treat the "AI" framing with caution.

Is it suitable for a small business or sole trader? No. It is built for organisations and teams and sold through a sales-led demo process. A one-person business is not the target customer.

Sources

All claims above are anchored to the vendor's own pages (and the CyberCX/Accenture deal announcement) as at 30 June 2026. Wayback snapshots captured or located on the review date:

• Phriendly Phishing — home / data-residency, dashboards, managed service, automation: https://phriendlyphishing.com/ — Wayback: snapshot pending (Save Page Now rate-limited on review date)
• Phriendly Phishing — solutions / Phish Focus, Secure Care: https://phriendlyphishing.com/solutions/ — Wayback: snapshot pending (Save Page Now rate-limited on review date)
• Phriendly Phishing — phishing awareness training / QR-code, smishing, spear phishing, micro-lessons, demo-only CTA, no pricing: https://phriendlyphishing.com/solutions/phishing-awareness-training/ — Wayback: https://web.archive.org/web/20260519025945/https://phriendlyphishing.com/solutions/phishing-awareness-training/
• Phriendly Phishing — phishing awareness & simulation training / "one of the few platforms" QR-code claim: https://www.phriendlyphishing.com/phishing-awareness-and-simulation-training — Wayback: https://web.archive.org/web/20251116041728/https://www.phriendlyphishing.com/phishing-awareness-and-simulation-training
• CyberCX — Accenture to acquire CyberCX (announced Aug 2025; closed 27 Feb 2026): https://cybercx.com.au/news/accenture-to-acquire-cybercx/ — Wayback: https://web.archive.org/web/20260314142451/https://cybercx.com.au/news/accenture-to-acquire-cybercx/
• CyberCX — Phriendly Phishing ("across Australia and New Zealand", CyberCX company): https://cybercx.com.au/about-cybercx/phriendly-phishing/ — Wayback: https://web.archive.org/web/20251207171917/https://cybercx.com.au/about-cybercx/phriendly-phishing/