Hoxhunt trains behavior. Praxis Navigator measures it — independently.

Hoxhunt and Praxis Navigator both talk about behavior change, so the distinction matters. Hoxhunt changes behavior inside its own delivery channel and measures its own signal. Praxis Navigator measures behavior independently, in the environment where the work happens, regardless of who ran the intervention. This page shows how they fit together.

What Hoxhunt does well

Hoxhunt is a strong, well-regarded human risk management platform. It combines behavioral science with an adaptive learning model to build personalised training journeys: simulated phishing arrives on an ongoing cadence calibrated to each person and gets harder as their skill improves, with gamification and in-the-moment feedback that rewards reporting real and simulated threats alike. For turning phishing recognition and reporting into a reflex, it is genuinely effective, and users rate it highly.

Source: Hoxhunt product documentation · Verified July 2026

What Hoxhunt's behavior data covers, and what it doesn't

Hoxhunt's measurement is real — this is not a case of a platform measuring nothing. It measures how people respond to Hoxhunt: report rates, simulation performance, progression through its learning paths. That is a legitimate and useful signal.

It is also bounded by Hoxhunt's delivery surface. It shows engagement and response improving inside the platform; it does not show how the same people handle real email, files, collaboration and identity in their daily work outside the training channel. And because the score is produced by the platform running the intervention, it is not independent of the thing being assessed.

Peer-reviewed field research

29–55%

of the variation in phishing susceptibility is attributable to organizational-level factors, not individual ones.

Measured across 83,269 employees in 510 organizations, using their real responses to phishing campaigns.

Petrič, G., & Roer, K. (2022). The impact of formal and informal organizational norms on susceptibility to phishing. Telematics and Informatics, 67, 101766. Licensed under CC BY 4.0.

Peer-reviewed field research

When employees believed their colleagues were already handling security well, they became more susceptible to phishing, not less — a boomerang effect. A clear, salient security policy could likewise increase casual link-clicking.

From the same field study of 83,269 employees across 510 organizations.

Petrič, G., & Roer, K. (2022). The impact of formal and informal organizational norms on susceptibility to phishing. Telematics and Informatics, 67, 101766. Licensed under CC BY 4.0.

Why the measurement should be independent

When the vendor running the program also supplies the score for the program, the evidence is circular — and an assessor asking whether your measures work is asking a question circular evidence cannot answer. Here is the full case for independent measurement.

Improving inside the platform is not the same as improving at work

Hoxhunt can show real gains inside its own program. The effectiveness regimes ask a wider question: does behavior improve in daily work, measured independently of the program itself?

Improving inside the platform is not the same as improving at work
What your reports show What the regulation asks for What closes the gap
Rising report rates and falling simulation-click rates inside HoxhuntNIS2 CIR Annex §8.1.3 — awareness and training programs assessed for effectivenessBehavioral evidence in daily work, independent of the training channel
A risk score calculated from Hoxhunt's own signalsNIS2 CIR Annex §7 — the effectiveness of risk-management measures is evaluatedA measure not produced by the vendor whose program is under assessment
Engagement and progression within the platformGDPR Art 32(1)(d) — a process for regularly testing, assessing and evaluating effectivenessAn independent behavioral baseline and trend from Microsoft 365

Hoxhunt's measurement is real; it is simply bounded to Hoxhunt's delivery surface and comes from the vendor running the program. Independent measurement answers the question circular evidence cannot.

See what NIS2 asks you to evidence

How Praxis Navigator measures it instead

Praxis Navigator reads security behavior from your own Microsoft 365 tenant, not from Hoxhunt. It builds rolling baselines and before-and-after comparisons across email, file sharing, collaboration and identity — so you can tag a Hoxhunt cycle as an intervention and see whether behavior changed in daily work, measured by something other than Hoxhunt.

The two together

1

Baseline — connect Microsoft 365 and see current behavior, with months of history immediately.

2

Intervene — run a Hoxhunt cycle as you normally would.

3

Tag — mark the Hoxhunt cycle as an intervention in Praxis Navigator.

4

Compare — see before-and-after behavior in daily work, independent of Hoxhunt.

5

Prove — evidence the change to auditors and the board, from a source that is not the trainer.

Feature comparison

How Hoxhunt and Praxis Navigator divide the work
Capability Hoxhunt Praxis Navigator Together
Adaptive phishing trainingYesHoxhunt trains and drills recognition
Gamified, personalised learning journeysYesHoxhunt drives engagement
Email threat reporting workflowYesHoxhunt turns reporting into a reflex
Measures response to its own simulationsYesHoxhunt measures its own channel
Behavior in daily work outside the training channelYesPraxis measures the rest of the time
Microsoft 365 behavior monitoringYesPraxis reads real daily behavior
Published pricing, self-serve signupYesPraxis is buyable without a sales call
Dedicated environment per customerYes — dedicated AzureNo pooled tenant data
Evidence independent of the training platformNoYesMeasurement that survives a vendor change

Pricing you can see

Our prices are published. Use the calculator, see your number, start a trial — no sales call, no qualification, no quote request. Most platforms in this category will not tell you the price without a meeting first.

See the price

Questions security leaders ask

Does Praxis Navigator replace Hoxhunt?
No. Hoxhunt delivers adaptive phishing training and drives behavior change inside its own channel. Praxis Navigator does not deliver training; it measures how people behave across Microsoft 365, independent of any program. Organizations run them together — Hoxhunt to intervene, Praxis to measure whether behavior changed in daily work.
Doesn’t Hoxhunt already measure behavior change?
It measures behavior inside its own delivery surface — how users respond to its simulations, nudges and reporting workflow — and it does that well. What it cannot see is behavior in daily work outside the training channel, and its measurement is produced by the same platform running the intervention. Praxis Navigator measures independently, in the environment where the work actually happens.
Can Hoxhunt’s risk score satisfy NIS2 or GDPR effectiveness requirements?
Partly, and rarely on its own. Its score is calculated from Hoxhunt’s own signals, which evidences engagement with the program rather than independent effectiveness, and it comes from the vendor whose program is under assessment. NIS2 CIR Annex §8.1.3 and GDPR Art 32(1)(d) ask for a change in behavior, measured over time and independently of the intervention.
How does Praxis Navigator get behavioral data?
Praxis Navigator connects to Microsoft 365 via the Graph API with read-only access. It monitors security-relevant behaviors across Exchange Online, SharePoint, OneDrive, Teams and Entra ID, using a zero-storage architecture and a dedicated Azure environment per customer.
How quickly can I see results?
Within 15 minutes of connecting your Microsoft 365 tenant. Because Microsoft retains historic activity data, you get a behavioral baseline from day one rather than waiting months to build one.

Measure the behavior, independently

Connect Microsoft 365 in 15 minutes and see whether behavior is changing in daily work — not just inside the training channel.

Start your free 30-day trial

No credit card. No commitment. Results in 15 minutes, or don't continue.

See the price — published, no sales call required.

Read what NIS2 requires — training effectiveness assessed, not just delivered.