The CyberHoot alternative built for Australian MSPs.

CyberHoot's own MSP page invites partners to "Personalize SAT for your clients, adding custom logos, colors and messaging, without any extra costs," and its products page promises to "Brand CyberHoot as your own with customizable logos, colors and a unique identity." A separate blog post on the value CyberHoot adds to MSP relationships specifically confirms "brandable certificates of completion that contain continuing education credits."

What we couldn't confirm from public materials is whether that branding extends to the training portal's own domain, or to the notification and phishing-simulation emails end users receive. Release notes for CyberHoot's Power Platform reference a branding option to "mark logo as company name" and reseller/tenant logos appearing on phishing result pages - real customisation, but narrower than a confirmed domain-level rebrand of the portal or a custom sender identity on outbound email.

Cyber Aware carries the MSP's own logo and domain across every touchpoint by default - portal, notification emails, phishing simulations, completion certificates and reports - with no Cyber Aware branding visible to end clients.

CyberHoot's own pricing page doesn't publish a rate. It routes every visitor to a "Get access to CyberHoot's pricing" form gated behind an email address, while confirming - without numbers - that the company offers "volume-based discounts for organizations with large numbers of users or clients," sector-specific pricing for education and non-profits, and discounted annual billing versus monthly.

Third-party listings fill part of the gap, but don't agree with each other. Capterra's pricing widget lists a "$25.00 Flat Rate, Per Month" Basic plan. SourceForge lists a $199/month flat-rate Autopilot tier covering up to 2,500 users. Neither figure appears on CyberHoot's own site, and we found no published MSP-specific tier structure or seat/client minimums anywhere.

Cyber Aware publishes one per-seat rate with no seat minimums and no email form standing between an MSP and the number.

CyberHoot runs two distinct phishing products. AttackPhish is the traditional-style simulation - CyberHoot's own release notes describe adding annual and semi-annual scheduling options and restricting simulation emails to 9am-5pm in the customer's timezone. HootPhish is a different bet entirely: rather than testing what employees don't know, it teaches in real time, and CyberHoot is direct about the philosophy behind it - "HootPhish leverages positive reinforcement training, completely eliminating the negative reinforcement training deeply embedded in attack-based phishing." The company cites "university-backed research" that "traditional phish testing alone doesn't reduce risk," and a Capterra reviewer independently echoed the same view: "Education based phishing and training are more beneficial than standard attack based phishing."

That's a genuinely different pedagogical position from most vendors in this category, including Cyber Aware's own Auto Phish, which runs attack-style simulations - worth weighing on its own merits rather than dismissing as marketing language.

Cyber Aware's Auto Phish generates a full year of varied phishing campaigns from a single setup conversation, so an MSP isn't hand-building a new campaign every month across every client.

CyberHoot's MSP materials are confident about scale: partners get "complete visibility and control over all unlimited clients and their security awareness progress from a single, simple dashboard," and "most MSPs can set up a new client in less than 5 minutes," per CyberHoot's own MSP page. Capterra reviewers corroborate quick onboarding, though one MSP reviewer put a new-tenant setup closer to "30 minutes or less" - still fast, just not quite the vendor's own headline number.

What we didn't find is a dedicated, compliance-framework-mapped gap assessment comparable to Essential 8 or SMB1001 evidence. CyberHoot's homepage references meeting "cyber insurance requirements," and its Power Platform generates "compliance reports," but neither claim ties to a named framework's specific controls in the materials we reviewed.

Cyber Aware's gap assessments map directly to Essential 8 and SMB1001 controls, branded to the MSP, so the evidence an Australian client hands an auditor is framework-specific from the first report.