Hoxhunt bets on gamification and adaptive AI to engage employees at large organizations — a model designed for companies with 1,000+ employees, a CISO, and a formalized security budget. NovaShield targets the opposite: an autonomous solution, deployable in minutes, for French SMEs without a dedicated security team. The difference isn't about quality — it's about target audience.
Hoxhunt is a Finnish cybersecurity awareness platform built around gamification and artificial intelligence. NovaShield is a French phishing simulation solution designed for SMEs with 50 to 500 employees.
Phishing remains the number-one attack vector for 60% of French organizations according to the CESIN 2024 Barometer. The solutions exist. The question is which one fits your operational reality.
Transparency note: this article is written by Kaci, founder of NovaShield. All cited data comes from publicly verifiable sources. We explicitly identify cases where Hoxhunt is a better fit than NovaShield.
Key Takeaways
- Hoxhunt does not publish pricing — an enterprise sales cycle is required before receiving a quote
- Gamification is a genuine advantage for organizations with 1,000+ employees, and unnecessary complexity for teams under 100
- Data is hosted in the EU, not in France — a meaningful distinction for organizations with digital sovereignty requirements
- Scenarios are designed for the Nordic market: less effective against typically French attacks (IBAN fraud, Ameli, Chronopost, DGFiP)
- NovaShield: 15-minute deployment, free up to 50 employees, €59/month beyond that, hosted in France
- Hoxhunt remains the better choice for organizations with 1,000+ employees, a dedicated CISO, and a formalized awareness budget
Hoxhunt at a Glance
Hoxhunt is a Finnish company founded in 2016 in Helsinki, built around one idea: phishing awareness works better when it feels like a game than when it feels like an obligation.
According to Hoxhunt's website, the platform uses artificial intelligence to adapt simulation difficulty to each employee's level. An employee who consistently detects attempts receives more sophisticated scenarios. One who regularly clicks gets simpler simulations with targeted training.
The gamification system is Hoxhunt's signature. Employees earn stars when they correctly report a simulated email, climb individual and team leaderboards, and receive rewards. The goal: turn a compliance exercise into an engaging activity. Hoxhunt claims engagement rates above 90%.
Hoxhunt has been recognized by Gartner and has clients in banking, industrial, and technology sectors, primarily in Northern Europe and North America. The typical customer is a 1,000+ employee organization with a structured security team.
The commercial model relies on demos, needs assessment, custom quotes, and an accompanied onboarding including technical integration (SSO, SCIM, SIEM connectors) — a sales cycle consistent with the enterprise segment.
In summary: Hoxhunt is a recognized international player with mature gamification and AI technology, positioned for large enterprises and mid-market companies.
What Sets Hoxhunt Apart from NovaShield?
The difference between Hoxhunt and NovaShield isn't about quality. It's about target audience and philosophy.
Hoxhunt bet on gamification as a behavioral change lever: if employees find the exercise engaging, they participate more and report more. The platform applies this logic with sophisticated game mechanics: stars, leaderboards, rewards, visible progression.
NovaShield makes a different choice. Rather than gamification, the platform targets simplicity of deployment, pricing transparency, and local relevance. Scenarios are built around attacks observed in France. Training kicks in at the moment of error. The goal for an SME's IT manager: launch the first campaign in 15 minutes, without calling anyone.
Hoxhunt targets organizations with the time and resources to deploy an ambitious 12-to-24-month awareness program, with granular reporting exploited by a security team. NovaShield targets SMEs that need fast results, with a tool that runs autonomously once configured.
What Hoxhunt Does Well
An honest comparison starts by acknowledging the competitor's strengths. Hoxhunt has real assets built over ten years in the field.
Gamification in Service of Engagement
This is Hoxhunt's trademark and a genuine market differentiator. Team leaderboards, stars earned for each correct report, rewards, and visible progression transform phishing simulation into a participatory activity. In large organizations where fatigue toward mandatory training is a real problem, this approach produces measurable engagement results.
When an employee reports a simulated phishing email not because they were asked, but because they want to earn points, the reflex is built differently. For organizations of 1,000+ where maintaining attention is a permanent challenge, Hoxhunt's gamification has concrete value.
Adaptive AI for Personalization
Hoxhunt automatically adjusts the difficulty and type of scenario based on each employee's behavior. An accountant who catches three simulations in a row receives a more sophisticated spear phishing scenario. A salesperson who regularly clicks gets simpler simulations with more visible hints.
This automatic personalization has value in large organizations where manual campaign management would be unrealistic.
Reporting and Analytics
Hoxhunt offers detailed reporting with resilience metrics, department-level scores, time trends, and sector benchmarks. For a CISO who needs to justify the awareness budget to a board, this data provides concrete arguments.
Analyst Recognition
Hoxhunt has been recognized by Gartner and appears in market evaluations for security awareness. For large companies that rely on analyst recommendations in their purchase processes, this recognition smooths the internal decision.
What Are Hoxhunt's Limits for French SMEs?
Hoxhunt is a high-performing solution for the segment it targets. But evaluated from the desk of a French SME leader with 80 or 150 employees, several limits emerge.
Unpublished Pricing and an Enterprise Sales Cycle
Hoxhunt doesn't publish its prices. Getting a quote requires a demo, a needs assessment, and a structured commercial process — a standard model for vendors selling to 1,000+ employee companies.
For an SME leader comparing three solutions between client meetings, this pricing opacity is a barrier. Without a reference price, budgeting before the first commercial contact is impossible. And a multi-week sales cycle doesn't match the urgency of an SME that just experienced a spear phishing attempt targeting its finance director.
French Content, But Not French by Birth
Hoxhunt offers simulation scenarios in French. But the platform was designed in Helsinki for a market that was first Nordic, then Anglo-Saxon, then international. French localization is translation and adaptation, not native design.
The difference shows in the scenarios. Phishing attacks targeting French SMEs have local specificities: fraudulent IBAN changes, fake Chronopost delivery notices, fake Ameli reimbursements, CEO fraud, fake DGFiP letters. A solution born in France integrates these contexts natively. An internationalized solution adds them progressively to a catalog designed for other markets.
European but Not French Hosting
According to publicly available information (April 2026), Hoxhunt hosts data within the European Union, satisfying GDPR requirements. But for French companies with digital sovereignty constraints (local authorities, defense subcontractors, healthcare players), the distinction between EU hosting and French hosting matters. Hosting in Finland or Ireland remains subject to different jurisdictions and can raise questions during an ANSSI audit or sector compliance evaluation.
Gamification: Enterprise Advantage, Excess for Small Teams
In a 2,000-person company, cross-team leaderboards and reward systems create collective dynamics. In a 60-person SME where everyone knows each other, leaderboards can produce the opposite effect: awkwardness, misplaced competition between close colleagues, or simple indifference toward a system perceived as oversized.
An SME's IT manager isn't looking to create a gamification program. They want their employees to stop clicking fraudulent links. Hoxhunt's sophisticated game mechanics represent complexity they don't need and a cost they fund without getting the expected benefit.
No Real-Time Email Verification for Employees
Hoxhunt offers a reporting button integrated into Outlook and Gmail. The employee reports a suspicious email, and the report goes up to the security team for analysis.
This model works when there's a SOC team to handle reports. In an SME without a security team, the report lands in the IT manager's inbox who already has 50 other topics. The employee receives no response, loses trust in the process, and eventually stops reporting.
What NovaShield Aims to Do Differently
NovaShield and Hoxhunt don't play on the same field. The differences reflect design choices dictated by different target clients.
French as a Native Language, Not a Translation
NovaShield is built in French, for French companies. The stated goal is to reproduce attacks actually circulating in France: fake Chronopost, fake Ameli, IBAN fraud, fake ANTAI fines, smishing impersonating a telecom operator, QR code quishing on a fake parking ticket. An employee who falls for a simulation scenario then recognizes the same attack in their real inbox. This local relevance is what makes the pedagogical difference.
15 Minutes from Decision to First Campaign
Create an account, import employees by CSV or directory sync, choose a scenario, launch the campaign — without a commercial meeting, without weeks of configuration, without a consultant: that's NovaShield's stated goal.
Displayed Pricing, Without Negotiation
NovaShield publishes its pricing: free up to 50 employees, then from €59/month (51-150 employees) to €349/month (501-1,000 employees), all features included in each plan. Monthly billing with no commitment, annual option at -17%.
AI Email Verification: From Doubt to Certainty
When an employee receives a suspicious email in real conditions, they forward it to NovaShield and get a rapid verdict: legitimate or suspicious, with analysis of headers, SPF/DKIM/DMARC authentication, links, and sender.
This isn't a reporting button that raises a ticket to a security team. It's a decision assistant in the employee's hands, at the moment they need it. Phishing simulation trains the reflex of doubt; AI verification turns that doubt into verifiable action.
Contextualized Micro-Learning
When an employee clicks a simulated phishing link, they're redirected to a 3-to-5-minute training module adapted to the type of trap. An employee fooled by a fake delivery email doesn't receive the same training as one who fell for an IBAN fraud. The path is progressive: repeat offenders receive more in-depth content.
Automated NIS2 Compliance
The NIS2 directive requires documenting awareness programs and producing proof of continuous improvement. NovaShield automatically generates these reports: campaign history, participation rates, training results, risk score evolution, with a one-click PDF export.
How to Migrate from Hoxhunt to NovaShield
If you use Hoxhunt and are considering switching to NovaShield, the transition is designed to be straightforward.
- Create your NovaShield account. Start your free 14-day trial. Test with your real employees, in real conditions.
- Import your employees. CSV export from your directory or HR file, with automatic group and department creation.
- Launch a baseline campaign. The first campaign establishes your reference click rate. Hoxhunt campaign data isn't transferable (different formats and metrics), but a new baseline gives a clean, objective reference.
- Activate email verification. Share the forwarding address with your employees. This is the feature that completes the simulation-training-action loop that you didn't have with Hoxhunt.
- Run both in parallel if needed. During the trial period, you can compare results from both platforms. When the numbers convince you, you switch.
Verdict
Hoxhunt and NovaShield solve the same problem — reducing phishing risk through simulation and training — but for different company profiles.
Hoxhunt is a good choice if you're a large enterprise or mid-market company with 1,000+ employees, a CISO, a formalized awareness budget, and the desire to build an ambitious gamification program over time. Gartner recognition, adaptive AI, and game mechanics make Hoxhunt a strong platform for this segment.
NovaShield is a good choice if you're a French SME with 50 to 500 employees that wants to act quickly, with transparent pricing, fast deployment, and scenarios designed for the French context. AI email verification, post-failure micro-learning, and automated NIS2 compliance complement the simulation without additional complexity.
The right tool is the one that matches your size, budget, and operational capacity. Not the one with the most features on paper, but the one your team will actually use.
Launch your first campaign in 15 minutes, no commitment required.
Frequently Asked Questions
What is Hoxhunt's price?
Hoxhunt doesn't publish a pricing grid. Prices are communicated after a demo and needs assessment. The pricing model is designed for 1,000+ employee companies with annual commitments. NovaShield, by contrast, displays its prices publicly: free up to 50 employees, then from €59/month.
Is Hoxhunt suitable for SMEs?
Hoxhunt targets large enterprises and mid-market companies. The platform is optimized for organizations of 1,000+ employees, with gamification and reporting features designed for structured security teams. For an SME with 50 to 300 employees and no CISO, Hoxhunt's sales cycle, accompanied deployment, and cost can be a barrier.
Hoxhunt or KnowBe4: which to choose?
Hoxhunt differentiates from KnowBe4 through its gamified approach and adaptive AI. KnowBe4 bets on content volume. Both target large enterprises. For a French SME, neither is appropriately sized: long sales cycles, unpublished pricing, content designed for the English-speaking market.
Is Hoxhunt available in French?
Hoxhunt offers an interface and content in multiple languages, including French. However, the platform was designed for the Nordic then international market. Simulation scenarios aren't natively designed for the French context (IBAN fraud, fake Chronopost, fake Ameli).
Can you migrate from Hoxhunt to NovaShield?
Yes. User import is done by CSV. Historical Hoxhunt campaign data isn't transferable, but a new baseline is established with the first campaign, allowing both solutions to run in parallel during a transition period.
Does Hoxhunt host data in France?
According to publicly available information (April 2026), Hoxhunt hosts data within the European Union, but not specifically in France. For companies subject to digital sovereignty constraints or French regulatory requirements, this distinction matters.
Sources
- Hoxhunt.com for product information, positioning, and features.
- CESIN 2024 Barometer and ANSSI, Panorama de la cybermenace 2024, for French phishing statistics.
- Information on Hoxhunt based on publicly available data as of April 2026.
This comparison does not constitute a contractual commitment and the features mentioned may have evolved since the writing date.
About the Author
Kaci is the founder of NovaShield, holding a Master's in Cybersecurity & Cloud from IPSSI. NovaShield is a listed provider on the Cybermalveillance.gouv.fr platform.