Launch week: every idea card is free.Get Pro

SaaS ideas, mined from what people actually complain about.

Every idea comes from real Reddit posts, was researched against today's competitors, and survived an independent skeptic before it made the list.

Ineffective Phishing Training

Security awareness and phishing simulation programs fail to change employee behavior, lack realistic and adaptive content, and provide poor measurement and follow-up.

In their words

the training content feels stale and our click rates aren't budging

r/cybersecurity on Reddit

Is there cheaper and or services out there for phish simulations and training or is this about as cheap as you can get?

r/sysadmin on Reddit

I've been tasked with standing up a phishing awareness program and I'm trying to narrow down vendors.

r/AskNetsec on Reddit

split between Microsoft 365 and Google Workspace, so not a clean single-tenant thing

r/sysadmin on Reddit

we had a close call recently with a fake invoice login page and almost lost money

r/FraudPrevention on Reddit

I'm trying to figure out if the awareness/sim side is changing user behavior or only producing nice quarterly charts

r/cybersecurity on Reddit

What do you do immediately after someone clicks a link and enters their email address and password?

r/k12sysadmin on Reddit

People finish the annual course, pass the quiz, and a few hours later it's like none of it ever happened.

r/AskNetsec on Reddit

if you just delete the email instead of reporting it, they still make you take a quiz or pd about phishing

r/Teachers on Reddit

at least twice a week we have seen users falling for captchas that tell them to hit windows + r and paste and run

r/ShittySysadmin on Reddit

I don't want to spend the entire month just sending awareness emails.

r/grc on Reddit

Our reported phishing mailbox has turned into a part time job

r/DefenderATP on Reddit

So now there's no real way to tell what could be a legitimate email from illegitimate.

Hacker News

cybersecurity has taken over my life as a IT Manager... now it's all I work on and it's exhausting

Hacker News

Security awareness teams

Where they talk

  • r/cybersecurity
  • r/sysadmin
  • r/AskNetsec
  • r/iiiiiiitttttttttttt
  • r/k12sysadmin
  • r/FraudPrevention
  • r/ShittySysadmin
  • r/MicrosoftTeams

Tools they use today

  • KnowBe4
  • Defender
  • Outlook
  • GoPhish
  • Hoxhunt
  • Microsoft 365
  • Proofpoint
  • Google Workspace

Why those fall short

  • attacks still reach endpoints and require SOC containment calls
  • Simulations must be whitelisted, so they bypass the filters that would catch real phish.
  • KnowBe4 not approved; GoPhish lacks training modules and takes 50 hours to stand up
  • Users ignore training; security tools get removed when executives complain
  • no enforcement or consequences for executives