VoltPhish
Run your whole phishing-awareness program from one Docker container.
Send realistic lures. Let staff report them in one click. Train the people who fall for them at the moment they fall. Then measure whether human risk is actually going down — not just whether you ran a campaign.
Every breach we investigate starts with a person, not a firewall
XDepthSense does penetration testing and incident response. In the incident work the pattern barely changes: nothing was hacked in the way people imagine. No exploit, no zero-day, no domain takeover. Someone received a message that looked exactly like the one they were expecting, and did what it asked — approved the payment, entered the password, scanned the code.
The controls pass
In modern invoice-fraud and thread-hijacking cases the attacker often sends from a legitimate free mail provider using a look-alike identity. SPF, DKIM and DMARC all pass, because nothing was spoofed. Your gateway has no reason to block it.
So the person is the control
When the technology cannot tell the difference, the only remaining detection layer is an employee who pauses and reports. That layer can be trained and measured like any other — but almost nobody does it properly.
And a click rate is not a measurement
Most tools stop at “18% clicked”. That number tells you nothing about whether anyone reported it, how fast, or whether the same finance team will fall for the same lure next quarter. VoltPhish measures the behaviour that actually reduces loss.
Attack → Report → Train → Measure
Most open-source tools give you the first step. Most enterprise platforms sell you all four and charge per employee, per year. VoltPhish gives you all four in a container you own.
Attack
Email, QR codes, calendar invites and landing pages — including ClickFix and browser-in-browser designs that mirror what attackers actually use today.
Report
A one-click report button in Outlook and Gmail. Staff who spot a simulation get automatic credit; real suspicious mail gets routed to your team via IMAP monitoring.
Train
A teaching page at the exact moment someone fails, plus an LMS with modules, quizzes and leaderboards. Repeat clickers are auto-enrolled without anyone chasing them.
Measure
Behaviour-based human risk scores per user and per department, geo-mapped activity, industry benchmarks and a board-ready PDF at the end of it.
What is in the box
Everything below ships in the free, self-hosted build. There is no locked tier and no feature that expires.
Multi-vector lures
- Email with a WYSIWYG template editor and per-recipient personalisation
- QR-code “quishing” with individual tracking per recipient
- Calendar (.ics) invite lures
- Landing pages including ClickFix and browser-in-browser patterns
- AI-assisted content generation (Claude, GPT, Gemini)
Employee reporting
- Native Outlook add-in and Gmail Apps Script
- IMAP monitoring so real suspicious mail lands in the same queue
- Automatic credit and leaderboards for staff who report
- A champions programme that rewards the behaviour you want
Training & adaptive enrollment
- Just-in-time teaching page at the moment of failure
- Built-in LMS with modules and quizzes
- Auto-enrollment driven by behaviour and risk level
- No separate LMS licence to buy
Analytics that mean something
- Customisable behaviour-based human risk scoring
- Geo-IP click and submission mapping
- Department-level risk tracking
- Industry benchmark comparison
- Board-ready PDF reports
Enterprise plumbing
- LDAP / Active Directory audience import
- OIDC SSO — Okta, Entra ID, Google, Keycloak
- Admin 2FA (TOTP) and granular role-based access control
- REST API and signed webhooks
Safe to rehearse
- Dry-run mode writes .eml files instead of sending
- Rehearse an entire campaign before a single real mail leaves
- Append-only audit log of every campaign action
- Unguessable per-recipient tracking tokens
One command, then open a browser
VoltPhish ships as a single Docker image with a SQLite volume. No database server to provision, no cluster, no cloud account.
# Run VoltPhish on port 9990 docker run -d --name voltphish -p 9990:9999 \ -e VOLTPHISH_SECRET_KEY="$(openssl rand -base64 48)" \ -v voltphish-data:/data \ baymaxarmed/voltphish:latest
Then open http://localhost:9990, sign in with the default credentials, change them immediately, and point it at an SMTP profile you are authorised to send from. Prefer to rehearse first? Set VOLTPHISH_MAIL_BACKEND=console and the whole flow runs to .eml files without sending a single message.
Built like something you would let near your staff list
A phishing platform holds every employee name and address in your organisation. That is a target. It is built accordingly.
| Layer | Choice |
|---|---|
| Backend | FastAPI, SQLAlchemy 2.0, Pydantic v2 |
| Frontend | React 18 + TypeScript, Vite |
| Passwords | Argon2id hashing |
| Secrets at rest | AES-256-GCM encryption |
| Access | TOTP 2FA, OIDC SSO, role-based access control |
| Hardening | CSRF and SSRF protection, signed webhooks, append-only audit log |
| Deployment | Docker with SQLite volume persistence |
| Licence | GNU AGPL-3.0-or-later (commercial dual-licensing available) |
Passwords are not collected by default
VoltPhish records that a submission happened, not what was typed into the box. Full capture exists as an explicit opt-in flag for authorised red-team work, and it logs a warning every time it is on.
Your data never leaves your infrastructure
There is no VoltPhish cloud, no account to create and no telemetry reporting back to us. Employee lists, results and risk scores stay on the machine you run it on.
The threat model is written down
SECURITY.md in the repository sets out what the platform defends against and what it does not. If you find something we missed, the disclosure route is on the acceptable-use page.
Between “tracks clicks” and “quote on request”
Open-source phishing tools generally stop at click tracking. Enterprise awareness platforms do the whole cycle, then price it per seat per year. VoltPhish was built for the gap in the middle.
| Classic OSS tools | VoltPhish | Enterprise platforms | |
|---|---|---|---|
| Email simulation | Yes | Yes | Yes |
| QR & calendar lures | Rarely | Yes | Yes |
| Employee report button | No | Yes | Yes |
| Integrated training LMS | No | Yes | Yes |
| Human risk scoring | No | Yes | Yes |
| Self-hosted, your data | Yes | Yes | Usually not |
| Per-seat licensing | None | None | Per user, per year |
| Actively maintained | Often stalled | Yes | Yes |
Comparison reflects the common feature sets of these categories rather than any single named product; capabilities change, so check current documentation before making a purchasing decision.
Authorised testing only
VoltPhish is for testing people who have agreed to be tested — your own organisation, a client engagement with signed scope and written authorisation, or a lab you own. Running a phishing simulation against people or organisations without that authorisation is not a grey area; in most jurisdictions, India included, it is a criminal offence.
The platform deliberately omits offensive capability: it is built to teach and measure, not to harvest. Read the acceptable use policy and disclosure terms before you run your first campaign.
Take the software, or take the outcome
The software is free and always will be. What organisations usually run short of is not the tool — it is someone to design the lure calendar, run the campaigns, handle the escalations and write the report the board will actually read.
Self-host it
- Every feature, no seat limits, no expiry
- Runs on your infrastructure, your data stays yours
- Community support via GitHub issues
- Fork it, modify it, build on it
Have XDepthSense run it
- We deploy and harden VoltPhish in your environment
- Quarterly lure calendar designed around your real threat profile
- Campaigns executed, escalations triaged, staff questions answered
- Human-risk report written for your board, not your SOC
- Delivered by consultants who investigate these incidents for a living
Common questions
Is VoltPhish really free?
Yes. VoltPhish is released under the GNU AGPL-3.0 licence. You can self-host it, modify it and run it for any number of employees with no per-seat licensing and no trial period. XDepthSense offers optional paid services around it — deployment, managed programme delivery and commercial dual-licensing — but the software itself is free.
How is it different from GoPhish?
GoPhish tracks whether a recipient opened a mail, clicked a link or submitted a form, and does that well. VoltPhish covers the rest of the cycle: multi-vector lures including QR and calendar invites, a one-click employee report button for Outlook and Gmail, an integrated training LMS with adaptive enrollment, and behaviour-based human risk scoring at user and department level.
Does it capture employee passwords?
Not by default. VoltPhish records that a form submission occurred, not the values typed into it. Full capture exists as an explicit opt-in environment flag for authorised red-team engagements, and it logs a warning when enabled. Secrets the platform does hold are encrypted at rest with AES-256-GCM.
Where is our data stored?
On your own infrastructure. VoltPhish ships as a Docker container with a SQLite volume, so employee names, addresses and campaign results never leave your environment. There is no VoltPhish cloud service and no telemetry back to XDepthSense.
Who is allowed to use it?
Only people testing recipients who have agreed to be tested — your own organisation, a client engagement with signed scope and written authorisation, or a lab you own. See the acceptable use policy.
Can XDepthSense run the programme for us?
Yes. We deploy VoltPhish in your environment, design the lure calendar, run the campaigns, handle employee escalations and deliver a quarterly human-risk report. The software stays free; the managed programme is the paid service. Details here.
What do we need to run it?
Docker, an SMTP relay or mail account you are authorised to send from, and a domain or subdomain for the landing pages. One container is enough for most organisations. Building from source needs Python 3.11+ and Node 18+.
Who builds and maintains it?
VoltPhish is built and maintained by XDepthSense, a cybersecurity consultancy in Mumbai, India. It grew out of our incident-response and penetration-testing work, where the same human-layer failures kept causing real financial loss.
Find out what your staff would actually do
Deploy it yourself this afternoon, or let the team who investigates these incidents run the programme for you and hand you the numbers.