Insights from Pistachio
Research, guidance and news on phishing, security awareness and insider threats.
This is where Pistachio shares what we learn from running phishing simulations, training and insider threat detection across hundreds of organisations. Expect research, practical guidance for IT teams and MSPs, and news from the team.
New articles, reports and product updates published regularly.

New report - A Year of Phishing Behaviour in SMB and Mid-Market Organisations
12-month journey analysis for over 120,000 users across 600+ organisations
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.



12 Questions to Ask When Evaluating Security Awareness Training (2026)
What actually matters when evaluating security awareness training platforms

Why Cybersecurity Compliance Feels Impossible for Non-Enterprise IT Teams in 2026
How growing compliance demands are outpacing lean IT teams and making security harder to manage

How to Build a Security Awareness Program With a Lean IT Team
A practical guide to building a sustainable security awareness program for lean IT teams with limited resources.

Generic Security Training Teaches Employees to Spot Fake Threats, Not Real Ones
Why generic security awareness training fails to prepare employees for real phishing attacks

New Feature: Internal Policies
Internal Policies, without the spreadsheets or LMS

The Hidden Cost of Managing Manual Security Awareness Training Programs
How manual security awareness training drains IT resources, and why automation improves efficiency and outcomes

Why Annual Security Awareness Training Doesn't Work (And What Does)
How annual security awareness training fails, and what actually works to build lasting employee resilience

Why Non-Enterprise Companies Are Getting Hit Harder by Phishing
How phishing attacks are increasingly targeting SMBs, and why traditional security awareness training no longer works

Phishing Risk: The Cost of Inaction
Why phishing remains the biggest security risk and what inaction can cost your organization