Insights from Pistachio
Research, guidance and news on phishing, security awareness and insider threats.
This is where Pistachio shares what we learn from running phishing simulations, training and insider threat detection across hundreds of organisations. Expect research, practical guidance for IT teams and MSPs, and news from the team.
New articles, reports and product updates published regularly.

New report - A Year of Phishing Behaviour in SMB and Mid-Market Organisations
12-month journey analysis for over 120,000 users across 600+ organisations
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.



Technical Expertise Does Not Make a Team Phishing-Proof
Explore what our simulation data reveals about phishing behaviour and why ongoing security awareness training matters.

How to Tell If Your Security Training Is Working
Learn how to measure security training effectiveness and why click rates don't tell the whole story.

What’s New in Presence: More Context Behind Every Alert
Discover what’s new in Pistachio Presence, with richer alert context, Custom AI Context, enhanced low-risk event details and improved canary visibility.

How Exposed Is Your Business to Phishing?
Discover how exposed your business is to phishing and why continuous training is essential to building lasting resilience against evolving threats.

Click Rate Isn't Enough to Measure Phishing Resilience
Why click rate alone can mislead, and how leak and report rates reveal true phishing resilience.

New report - A Year of Phishing Behaviour in SMB and Mid-Market Organisations
What 12 months of phishing simulation data reveals about click rates, reporting behaviour, and real phishing resilience.

Insider Threat Detection: The Missing Part of Your Human Risk Strategy
Why security awareness alone can't cover every human risk, and how insider threat detection closes the visibility gap.

Getting Your Security Awareness Training Approved by Finance
How to build a stronger business case for security awareness training using industry risk, compliance requirements, internal data and measurable results.

How Phishing Attacks Exploit the Trust Built into Microsoft 365
How attackers exploit trusted Microsoft 365 workflows to steal credentials.