Ghosteye
Verified Oct 15, 2026 ActiveRuns authorized phishing, vishing, and deepfake attacks on employees to test whether detection tools actually catch them.
Listed on EffectHub ·
Pricing
- Pricing model
- Contact sales
Quote only: an annual platform fee plus a tier based on headcount, scoped after a request form or walkthrough; no list price on the pricing page.
Use tool ↗About Ghosteye
GhostEye is a security-testing platform that launches authorized social-engineering attacks — phishing emails, scam calls, texts, and deepfake attempts — against an organization's own employees, then follows what happens after someone clicks or responds. It checks whether the company's existing detection stack and EDR tooling actually flag the resulting activity, rather than just measuring who fell for the message. The company is a New York-based startup founded in 2025 and backed by Y Combinator. Pricing isn't published: GhostEye sells an annual platform fee plus a per-headcount tier, quoted after a call.
- Platforms
- Web
- API
- Not confirmed
- Last verified
- Oct 15, 2026
Verified sources
- Pricing is an annual platform fee plus a headcount-based tier, custom quote via request form, no list price, on the pricing page (15 October 2026)ghosteye.ai ↗
- Authorized social-engineering attacks across voice, email, SMS and chat, with a product called Beacon shown with a launch countdown, on the home page (15 October 2026)ghosteye.ai ↗
Is Ghosteye legit?
We don’t label tools safe or unsafe. Below are the records we checked ourselves, each with the date we read it.
- Domain registered
- Mar 13, 2025 (1 year ago)Registry record (RDAP), registrar Cloudflare, Inc, looked up Sep 17, 2026
- TLS certificate
- Issued by Google Trust Services, valid until Jan 9, 2027Seen in our own connection to the site on Oct 15, 2026
- Last checked
- Oct 15, 2026The site answered
- On the market since
- 2025The vendor's own material, read by us
- Operated by
- GhostEye, United StatesOur research, card verified Oct 15, 2026
Pros & cons of Ghosteye
GhostEye goes past the usual click-rate phishing test by tracing what happens after an employee falls for a simulated attack, checking whether the security team's own detection tools would have caught it. That follow-through is the differentiator, but it's an enterprise sale with no public price and no self-serve option.
Pros
- Tests multiple attack channels: voice, email, SMS, chat, deepfakes
- Follows the attack past the click to check detection and EDR response
- Y Combinator-backed, suggesting some funding runway
- Positioned specifically around validating existing security tooling, not just training staff
Cons
- No public pricing — sales-quote-only model
- Very new company (2025) with limited independent track record
- Requires a booked walkthrough just to see cost
Best for
- Security teams validating EDR and detection coverage, not just employee awareness
- Organizations that already run phishing simulations and want deeper follow-through testing
Not for
- Small teams wanting a self-serve, low-cost phishing test
- Anyone needing published pricing up front
Watch out: As an authorized-attack tool it needs sign-off and coordination with IT/security leadership before running — it is not something to point at employees without internal buy-in.