Phishing Ends Here.
Phishing Reports Waste Time, Until You Have the Right Tool
Phishing emails are one of the most reported threats—but still one of the hardest to investigate efficiently.
Analysts lose hours digging through headers, decoding links, and jumping between tools that weren’t built for the job. PhishTool changes that. It turns raw emails into structured, forensic investigations—fast. Every header, link, and attachment is parsed and presented for action, so your team can triage faster, respond smarter, and close cases with confidence.
How Does PhishTool Work?
PhishTool slots into your existing workflow—no disruption, no complex setup. Reported phishing emails land in the PhishTool console, where they’re automatically parsed, enriched, and presented for structured investigation. From inbox to insight in seconds.
Email Ingestion
Pull reported emails from anywhere - clients, reporter mailboxes, SIEMs, or API integrations
Forensic Console
Gives analysts a structured view to investigate each report in full context
Automated Parsing
Decodes headers, links, attachments, and metadata—no manual work
Outcome Reporting
Close cases cleanly with automated structured feedback and/or downstream integrations
Pricing
Community
A free forensic analysis tool for individual analysts to investigate reported phishing emails.
Free forever
£0/ month
No credit card required
- Number of users1
- Number of analysesLimited
What's included:
- Upload and analyse phishing emails
- Full header and body parsing
- Link and attachment inspection
- Detection and analyst notes
Enterprise
A collaborative investigation platform for security teams to manage, triage, and resolve phishing reports at scale.
Flexible pricing
For teams of all sizes
Customised to your needs
- Number of userscustom
- Number of analysesUnlimited
Everything in Professional, plus:
- Multi-user team access
- Team collaboration and visibility
- API and mailbox integrations
- Outlook add-in (report to PhishTool)
- Automated reporter feedback
- Custom alerting & webhooks
- Single sign-on/SAML 2.0
Professional
A powerful single-user version for security professionals who need full investigative capabilities without team features.
Coming soon
- Number of users1
- Number of analyses300 / month
Everything in Community, plus:
- Increased number of analyses
- Submit emails via PhishTool API
- Create alerts
- In-tray system (open → closed queue)
Frequently Asked Questions
PhishTool is a forensic phishing email analysis platform. It helps analysts investigate reported emails by parsing, decoding, and presenting every component—headers, links, attachments, and metadata—in a structured console designed for real-world casework.
PhishTool is used by SOC teams, MSSPs, threat analysts, and anyone responsible for handling reported phishing emails. We support both individual analysts and enterprise-scale teams.
Yes. PhishTool Enterprise can be used by Managed Security Service Providers (MSSPs). PhishTool Enterprise has whitelabel features specifically for MSSPs to deliver phishing protection services for multiple clients. PhishTool Enterprise for MSSPs provides a secure, multi-tenant environment with separate client in-trays, mailbox integrations, and API access - making it easy to manage phishing reports at scale. PhishTool gives MSSPs a unified workspace to analyse, document, and report on phishing incidents across multiple clients.
PhishTool isn’t for detection—it’s for investigation. We don’t replace your SEG or filtering—PhishTool picks up where they leave off: after a user reports something suspicious. It’s a purpose-built workspace for security teams to triage, investigate, and close phishing cases.
Yes. PhishTool Community is free to use for individual analysts. Teams and organisations can upgrade to PhishTool Enterprise for mailbox ingestion, API access, and collaborative investigation features.
Enterprise users can connect monitored mailboxes, use the PhishTool Report Button (PRB) for Outlook or send reported emails to PhishTool via API. Once ingested, each email is automatically parsed and presented for investigation in the console.
All data is processed and stored in secure cloud infrastructure based in the EU, subject to GDPR considertions. PhishTool Limited is located in the United Kingdom and registered with the Information Commissioner's Office.
Yes. PhishTool Enterprise includes multi-factor authentication, audit trails, structured resolution tracking, and role based user management—making it suitable for teams operating under NIST, ISO 27001, SOC 2, and similar standards.
Yes. Enterprise users can connect to PhishTool via the PhishTool API or leverage webhooks for outbound connections originating from events within your PhishTool Console, to feed downstream systems. Additional integrations are in development and can be requested by customers.
Cookies on PhishTool
We use necessary cookies to make PhishTool work. We'd also like to set analytics cookies that help us make improvements by measuring how you use PhishTool.
Used by Serious Security Teams Around the World
PhishTool is actively used by analysts across defence and government, cybersecurity vendors and MSSPs, global enterprises, financial services, consultancies and higher-education institutions.
Across PhishTool Enterprise and Community, our usage data includes users from dozens of major enterprises, more than 30 cybersecurity firms, over 25 government and defence organisations, 50+ universities, and more than 40 Fortune 500 companies.
40+
Organisations representing some of the world’s largest employers and most recognised global brands.
30+
Including internationally recognised MSSPs, MDR providers and cyber consultancies, alongside some of the world’s largest IT-service companies.
35+
Featuring more than 20 globally recognised security brands across email, endpoint, cloud, network and threat intelligence.
4/4
All Big Four firms represented, alongside many of the world’s largest consulting and technology-services organisations.
25+
Including US, UK and Australian government, military and law-enforcement organisations.
8Of the world's largest technology companies
Spanning global leaders in cloud, enterprise software, hardware and internet technology.
20+
Representing major global pharmaceutical and biotechnology companies and healthcare providers.
15+
Spanning global leaders in aerospace, defence, satellite communications and advanced engineering.
10+
Major international law firms advising governments, global enterprises and financial institutions.
30+
Including major operators and service providers across energy, utilities, telecommunications, transport and aviation.
40+
Representing major global banks, insurers, payments providers, investment firms and financial-infrastructure organisations.
20+
Covering major US regulated utilities and America’s largest municipally owned electric and natural-gas provider.
20+
Representing leading international network operators and some of the world’s largest telecommunications-technology providers.
50+
Including US and UK government, Australian public-sector, policing and transport organisations.
50+
Featuring an Ivy League university and five Russell Group institutions among leading universities worldwide.