Fable Security, Hoxhunt, Keepnet Labs and Living Security

About Hoxhunt

Hoxhunt sells an AI-powered platform that automates security awareness and phishing training with personalized training for employees.^[5][6][7]

Hoxhunt says its platform delivers phishing simulations across email, SMS, phone calls or Teams, personalized to each employee based on department, location and more. Instant micro-trainings follow the simulations. Hoxhunt provides a library of customizable training packages, and training can be generated with AI.^[5]

Hoxhunt creates an individual learning path for each employee. Simulated phishing campaigns are selected based on skill level, role, location and previous behavior. Employees receive gamified simulations and interactive training roughly every 10 days. Simulations span email, smishing, vishing and callback, Microsoft Teams, and deepfake. Hoxhunt simulates executive-impersonation and payment-approval scams with AI-generated or cloned voices. Hoxhunt can send simulated phishing messages inside Microsoft Teams and other collaboration tools.^[7]

Hoxhunt delivers security awareness training as short lessons in small, regular bursts. Hoxhunt includes 300+ ready training modules in video and text, plus regulatory tracks for PCI DSS, HIPAA, DORA, and GDPR. Content Studio lets customers create their own training by turning policies, procedures and existing materials into training in under 60 seconds. Nothing reaches employees until the customer publishes it. Training can be localized in 40+ languages. Hoxhunt says training can reach frontline staff, contractors, and the board with XSAT, with no account required.^[6]

On the response side, Hoxhunt investigates reported emails, groups them into a single incident, and removes the campaign across every inbox automatically. Hoxhunt pulls in threat intelligence from 5 million reporters worldwide. Hoxhunt says it classifies reported emails with 96% accuracy for malicious emails and more than 99% for safe emails. Hoxhunt suppresses safe, duplicate, and low-risk reports so the SOC can spend less time reviewing noise. Hoxhunt says the product can reduce phishing tickets by up to 99%.^[2]

For risk beyond email, Hoxhunt organizes events from Hoxhunt and third-party tools into behavioral patterns at the employee, team, and organizational level. Hoxhunt combines signals from Hoxhunt, Microsoft Defender, CrowdStrike, Zscaler, and other sources into a unified behavioral view. Customers can ingest events from internal systems and proprietary tools through a flexible API. Hoxhunt can trigger coaching, policy reminders, training, or escalation based on behavior.

Hoxhunt says hundreds of global organizations use it to train millions of employees. Hoxhunt reports millions of users across 129+ countries. Customers named on its pages include DocuSign, Airbus, AES, Schindler and Nokia. Hoxhunt says Avanade saves over 900 hours of SOC analysis per month with Hoxhunt. Hoxhunt says 60% of employees report at least 1 real attack within the first year of training.^[6][11]

Hoxhunt raised a Series B of $40 million with New York-based Level Equity Management. Hoxhunt raised a $3 million Series A with Dawn Capital, and Icebreaker took part. Hoxhunt operates on a SOC 2 Type II audited platform with GDPR and CCPA compliance, encryption in transit and at rest, and strict access controls. Hoxhunt has a dedicated Compliance and Security staff, and SOC2 and SOC3 reports are available for customers and prospects on request. Hoxhunt prices per employee, with the quote depending on employee count and the capabilities needed. Hoxhunt onboarding starts with connecting an identity provider, importing users and picking a launch date, and Hoxhunt says most teams are live in under two weeks.^{[2][4][5][6][7][12]}

About Keepnet Labs

Keepnet Labs sells security awareness training and multi-channel phishing simulations. Keepnet sells a plan that adds incident response for the emails, SMS and calls employees report, and before and after behaviour measurement. Signals from the security stack a customer already runs become named behaviours in Keepnet.^[4][7][9]

Keepnet sends a nudge in the moment, then training for the same behaviour. Keepnet nudges are short reminders by email, SMS and Teams, timed to each employee's behaviour. Keepnet security awareness training is matched to role, risk and behaviour, with nudges. Compliance 360 is role-based compliance training and readiness tracking. Secure Behaviour Dashboard shows before and after behaviour change, and risky behaviour from security tools drives nudges, training and simulations. Keepnet executive and advanced reports are ready-made reports with before and after behaviour data.^[7][9]

Phishing Simulator runs email phishing simulations, with templates across languages and difficulty levels. Keepnet voice phishing simulations use pre-recorded, text-to-speech or two-way AI calls. Keepnet runs voice phishing simulations from numbers it owns, not spoofed. Keepnet places the call and records what each employee does. Keepnet voice campaign setup starts when a customer adds phone numbers and then creates a voice campaign. Keepnet SMS phishing simulations use numbers that Keepnet provides. Keepnet callback phishing is an email that asks the employee to call a number. Keepnet email threat simulator tests how email defences handle realistic threats. Keepnet customers can run voice, SMS, email, QR code and callback simulations themselves from the Keepnet console.^{[2][7][9][14][15]}

Incident Responder provides analysis and response for reported emails, SMS and calls. Keepnet threat sharing lets customers share and receive phishing intelligence with peers. Keepnet says AI agents run the loop and, by default, nothing goes out until the customer approves it. Keepnet states that customer data is not used to train AI models.^[3][7][9]

Senior Keepnet social engineers hold the calls themselves, with no AI voices. Keepnet vishing assessments are requested most for the help desk, and any team that takes calls can be included. Password and MFA resets, account changes and callbacks to the number on file are the most common scopes of a Keepnet vishing assessment. Keepnet vishing assessment callers are UK, Europe and US callers, in English and Spanish. Card, health, government ID and other high-sensitivity data are never requested or recorded in a Keepnet vishing assessment. Keepnet vishing assessment findings point to the verification steps and policies to strengthen, not to individual employees. Keepnet vishing assessment recordings are encrypted and deleted within five business days of report acceptance, under EU and UK GDPR and the published DPA. In a Keepnet vishing simulation, a platform the customer's team controls runs AI-agent, text-to-speech or recorded calls.^[15]

Keepnet offers hosting in the region the customer chooses: the UK, EU, US, Canada, the UAE or Türkiye. Microsoft Azure hosts every Keepnet region except Türkiye, which AWS hosts. Keepnet lists certified security of ISO/IEC 27001, with data in the region the customer chooses. Keepnet states four current certifications, independently audited. Keepnet lists AES-256 at rest and TLS 1.2 or 1.3 in transit.^[9][15]

Keepnet prices its plans per employee per month, billed annually, on a 3-year agreement, excluding tax, and 1-year agreements are quoted. Customers buying through a Keepnet partner have the partner quote, bill and support them. Keepnet names Whitbread and Koton among the teams it describes with the numbers they moved.^{[5][6][7][8][9][10][11][14][15]}

About Living Security

Living Security sells a platform that reads signals from the security tools its customers already run to reveal human and agent risk, and guides the response. Living Security states that humans and AI agents now share access, data, and decisions. Living Security says human risk management was built on the assumption that the identity taking an action is a person, and that the assumption no longer holds. Living Security describes an AI agent as an identity that has credentials, does things that cannot be fully predicted, and can move risk as fast and as much as a person can. Living Security notes that AI agents have permissions, touch data and take action.^[5][7]

Living Security joins hundreds of human risk signals from the security and HR tools customers already use, per person, with Livvy guiding the response. Living Security weighs threat, access and behavior so that the riskiest few people rise first. In the Living Security model, signals from nine risk domains join into cohorts, cohorts feed sequences, and each sequence heads for a breach scenario. The Living Security map of how risk builds comes from the Human Risk Management Framework, which has 137 signals and is open to everyone under CC BY 4.0. In one Living Security example, four signals from email security and the identity provider reach an accounts payable lead in Finance, and that person's priority rises to High.^[5]

Livvy proposes the next move, and the customer's team approves it. Livvy recommends an action for each person, a playbook runs the action, and every result flows back into the Human Risk Index. Living Security guides or runs approved responses, and approvals stay with the customer's team. Livvy can recommend step-up MFA and a credential reset for a person, then a 90-second coaching nudge, and waits for the team's approval. Living Security says that when an employee's score moves, the response moves with it, and the response can be coaching, tightening the person's authentication or changing what the person can access.^[3][5][7]

Living Security offers phishing simulation aimed by the customer's risk data, not its calendar. For a Living Security phishing simulation, who is being targeted by real attacks, what assets those users can access and how they have behaved in the past go into shaping the test before it goes out. Living Security is launching support for phishing simulations via email and Teams. Living Security places SMS, voice, and video simulations on its near-term roadmap. In a playbook Living Security demonstrated, everyone who clicked gets training and the whole team gets a nudge. Access tightens on its own for the people who clicked in a playbook Living Security demonstrated.^[5][7]

Living Security offers AI calls and two-way texts that talk back, then coach. Living Security offers a library aimed by risk and delivered by playbooks. Living Security takes content from threat to training that is on brand and approved by the customer. Living Security offers team escape rooms and a tabletop for practicing the breach. Living Security offers a way to see the shadow AI and to hold every agent to an accountable owner.^[5]

Microsoft Entra ID can contribute normalized identity, sign-in, risk, device, and attack-simulation activity to Living Security. With a Microsoft Entra ID permission for group membership actions, a Living Security playbook can add a person to, or remove them from, a Microsoft Entra ID group. For group membership actions on the Microsoft Entra ID connection, an administrator chooses an explicit allowlist of groups on the connection. A Living Security customer can invite a system admin into the platform with scoped permissions, so that the admin enters integration credentials directly.

SailPoint Identity Security Cloud and IdentityIQ manage Living Security accounts through the SailPoint SCIM 2.0 connector. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). When a source sends a custom extension attribute for the first time, Living Security adds that extension. Living Security holds some changes that succeed in SailPoint, for example a change that would remove the customer's last owner.^[3][5][8]