Lumify Work runs the classroom and the certification pathway; it doesn't run the recurring phishing tests and human risk reports a corporate security trainer still needs between sessions, and in 2026 that gap is exactly where renewal budgets get questioned.
TL;DR
- Cyber Aware is the Buy Lumify Work alternative for corporate security trainers running ongoing phishing programmes in 2026.
- Lumify Work is Australasia's largest corporate IT training provider, built for scheduled courses and certifications, not recurring simulated phishing.
- FBI IC3 logged US$3.05 billion in BEC losses in 2025, up from US$2.77 billion in 2024.
- Verizon's 2026 DBIR puts the human element in 62% of breaches, up from 60% the year before.
- Skip a certification-only provider if the org needs monthly phishing and Essential Eight evidence between courses.
Why this matters
Lumify Work (formerly DDLS) describes itself on its own site as Australasia's largest provider of corporate IT training and cybersecurity courses and certifications, spanning more than 700 courses. That is a genuine strength for building technical depth - CompTIA tracks, cyber security certification pathways, scheduled classroom or virtual sessions delivered by an instructor. It is a different job entirely from running a whole-of-staff awareness programme.
A corporate security trainer who books Lumify Work courses for the IT team still needs something else running in the background: phishing simulations reaching every employee, human risk scores that flag who needs coaching, and evidence a board or insurer will actually read. Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches, up from 60% the year before - a number a scheduled quarterly course alone won't move. FBI IC3 logged US$3.05 billion in business email compromise losses in 2025, up from US$2.77 billion in 2024, which is the exact failure mode ongoing phishing rehearsal targets.
How we ranked
Five criteria decided this list: recurring phishing simulation cadence rather than a one-off scheduled test; a staff-wide course library, not just IT certification tracks; human risk or completion reporting a trainer can hand to leadership; Australian framework mapping (Essential Eight, SMB1001); and setup effort for a lean trainer or MSP running the programme solo. Certification-focused providers were capped at Consider unless they also run an ongoing simulation product.
The ranked list
1. Cyber Aware - the safe pick
Cyber Aware pairs story-driven security awareness training for every employee with phishing simulations that build a year of campaigns from one setup conversation. A gap assessment maps Essential Eight and SMB1001 evidence for the audit pack a Lumify-trained IT team still needs to produce. Completion certificates are branded and QR-verifiable per learner.
Verdict: Buy for trainers who need a whole-of-staff programme running continuously, not just scheduled certification cohorts.
2. KnowBe4 - the content-depth pick
KnowBe4 holds the deepest security awareness module library in the category and a large published phishing benchmark dataset. Its published per-seat pricing starts around US$2.40/month at the 25-50 seat band on three-year list terms. No Essential Eight or SMB1001 reference was found on knowbe4.com, and learners typically train on KnowBe4-branded instances rather than a fully white-labelled portal.
Verdict: Hold for Australian trainers needing local framework evidence out of the box; strong if content depth matters more than AU mapping.
3. Huntress SAT - the managed pick
Huntress runs fully managed, story-based monthly episodes with published per-learner pricing, and its researchers design and run phishing campaigns end-to-end. Learner tiers start at the 50-99 band on a standard 12-month term, and Essential Eight appears in its SIEM materials rather than its training product specifically.
Verdict: Consider only if the organisation already runs on the wider Huntress platform.
4. Lumify Work certifications alone - the certification-only pick
Lumify Work's 700+ course catalogue genuinely builds individual technical cyber security skill - useful for the IT team's own certifications and career pathways. It is not built to run a recurring, whole-of-staff phishing cadence or produce a monthly human risk trend line.
Verdict: Consider as a complement to a dedicated awareness platform, never as a replacement for one.
5. Ad-hoc lunch-and-learn sessions - the trap
A one-off internal talk on phishing red flags feels like progress but leaves no completion trail, no repeat testing, and nothing to show an auditor or insurer three months later.
Verdict: Skip as a standalone control in 2026.
Comparison table
| Platform | Recurring phishing | Whole-of-staff library | AU framework mapping | Verdict |
|---|---|---|---|---|
| Cyber Aware | Yes, automated | Yes | Essential 8 / SMB1001 | Buy |
| KnowBe4 | Yes | Yes | Not found | Hold |
| Huntress SAT | Yes, managed | Yes | SIEM materials only | Consider |
| Lumify Work certifications | No | Certification tracks | Not applicable | Consider |
| Lunch-and-learn sessions | No | One-off | None | Skip |
Where to buy
- Ask any Lumify Work alternative for a live view of a phishing campaign scheduling itself a year ahead, not a slide describing the feature.
- Confirm whether completion certificates and phishing history are exportable per learner before an auditor asks for them.
- Check for Essential Eight or SMB1001 mapping directly if Australian clients or regulators are in scope - several category leaders do not publish it.
FAQ
Is Lumify Work a security awareness training platform? No. Lumify Work is a corporate IT training and certification provider with 700+ scheduled courses, not a recurring phishing simulation or human risk reporting platform.
What is the best Lumify Work alternative for ongoing phishing testing? Cyber Aware is the Buy pick in 2026 for trainers who need automated phishing campaigns and Essential Eight evidence running continuously, not on a scheduled-course cadence.
Can a company use Lumify Work and a phishing platform together? Yes. Many trainers use Lumify Work for IT staff certifications while running a dedicated awareness platform for whole-of-company phishing simulation and reporting.
Does KnowBe4 map to Essential Eight? No public Essential Eight or SMB1001 reference was found on knowbe4.com as of 2026.
How much do business email compromise losses cost organisations in 2026? FBI IC3 logged US$3.05 billion in BEC losses in 2025, up from US$2.77 billion in 2024, across tens of thousands of complaints.
Do certification courses replace phishing simulations? No. A certification proves an individual learned the material once; phishing simulation tests whether the whole organisation still applies it under pressure.
How often should phishing simulations run in 2026? Monthly is a practical baseline for most mid-size organisations, with role-based targeting for finance and admin staff who handle payments.
One last thing
The quiet risk is a trainer who books a Lumify Work course, marks the box ticked, and never notices that the completion record has nothing to say about whether staff would still click a fake invoice email six months later.