We have answers to your questions.

Setup takes around 10 minutes. You log in with your Microsoft global admin credentials via single sign-on, create the security groups you need in Microsoft Entra ID, sync your organisation, and activate the platform with a single toggle. The system pulls in metadata (department, role, location, language) and starts working automatically, with machine learning beginning the moment you activate.

‍

You create security groups that tell Pistachio who to license and who gets admin access. For Practice, users go in a group with "pistachio-sat" in the name. For Presence, users go in a group with "pistachio-itd" in the name. Anyone who needs admin access goes in a group containing "pistachio-admin". Admin users who also want to receive simulations themselves should be in both the admin group and the relevant licensing group. We recommend dynamic groups so onboarding and offboarding happen automatically. Groups can be hybrid-synced from on-premise Active Directory.

‍

Pistachio syncs with Entra ID automatically, so new employees are added and departing employees removed without manual work. New users typically take between 30 minutes to an hour to be added, with removals taking up to 24 hours.

For Practice phishing simulations, we recommend not announcing them, so you see genuine reactions and can identify who reports versus who clicks. For scenario-based training, you can tell users they'll receive short training modules. For Presence, we recommend informing employees that it is in use, both for transparency in line with data privacy law and for the preventive effect. Our legal team can help with the wording at no extra cost.

In most cases, no. Pistachio uses the Microsoft Graph API to inject simulations directly into mailboxes, so no SMTP whitelisting is required. The one exception is if you run link scanners that scan inboxes after delivery, in which case you may need to whitelist a small pool of Pistachio domains.

The button itself is optional and quick to set up, but Microsoft handles the actual rollout to users, which uses up part of a 14-day trial. Many customers skip it during a trial and deploy it after signing.

Yes. Pistachio supports multi-tenant setups. Through the partner portal, MSPs can manage multiple customer accounts. Organisations with multiple offices can set up reporting by location or department, provided that structure exists in Entra ID.

For the partner portal, each end customer must explicitly grant permission for the MSP to view their data, in line with GDPR. No customer data is visible to a partner without that consent.

Standard contracts are typically annual.

Yes. Microsoft SSO is in fact the only way to log into Pistachio.

Currently Pistachio works only with Microsoft Entra ID.

Pistachio is designed to run automatically with no configuration on your side, and the permissions exist to make that possible. Pistachio requires four permissions from your Microsoft Entra tenant, granted via the OAuth 2.0 client credentials flow: User.Read lets users log in with their Microsoft accounts and gives access to basic profile information such as name. User.Read.All lets Pistachio read profile data (name, job title, department, location, email, language, photo) for licensed users only, to personalise simulations and surface relevant information to admins. Directory.Read.All lets Pistachio read group data and basic organisational information, such as your organisation's name and preferred language. Mail.ReadWrite is required to inject phishing simulations into mailboxes. Microsoft groups read and write permissions together under this single permission; the more precise permission for what we do would be Mail.Write, and we are actively lobbying Microsoft to split them. The specific endpoint we use ("Create mail in mail folder") only writes emails, it does not read them. Pistachio does not read your emails and has no code that would allow it to. Full detail is published at pistachioapp.com/permissions.

All global administrators in your Microsoft Entra tenant have admin permissions in Pistachio. In addition, anyone added to an Entra group containing "pistachio-admin" (not case sensitive) will have admin permissions. Reporting access is restricted to designated admin groups, and individual employee performance data is never visible to the wider organisation.

Pistachio offers two products that work independently or together on one platform. Practice is fully automated security awareness training: tailored simulations and scenario-based training built around each employee. Presence is AI-driven insider threat detection that alerts on genuinely risky behaviour in your environment. Practice lowers the chance of an incident by building safe habits; Presence catches problems if they happen. Together they manage human cyber risk from both sides.

Yes. Practice and Presence can be used independently or together on one shared platform. Bundling both is typically better value, and you can start with one and add the other later.

Practice integrates with Slack, Teams, and Outlook, so training and phishing reporting sit where your team already works. Presence connects to Microsoft 365 and offers optional integrations with HubSpot, Gong, and GitHub for additional audit logs, with more added over time. All integrations are included in the plan.

Very little, and that is the point. Once activated, Pistachio runs on its own. Practice selects, personalises, and sends training automatically, and chases non-completions for you. Presence only alerts when something genuinely matters, filtering out the false positives that create noise. There are no rules to build, no campaigns to schedule, and no maintenance, so a small team gets enterprise-grade coverage without the workload.

Each client tenant takes around 10 minutes to set up: create the security groups in their Entra ID, sync, and activate. From the partner portal you manage all your client tenants in one place, using your own license pool.

Yes. Pistachio requires a Microsoft Entra tenant to manage user identities. Presence then monitors beyond Microsoft through optional integrations, and Practice delivers through Slack, Teams, and Outlook.

Practice is fully automated security awareness training built around each employee's needs and behaviours. You turn it on and employees start receiving tailored simulations and scenario-based training automatically. You don't pick which training to send, group users, or chase people to complete it: Pistachio handles all of that.

‍

Practice builds an individual profile for each user from two inputs: their Entra ID data (role, department, location, language) and their past interactions with the platform. Content is targeted to each person's context (a finance user sees invoice-fraud scenarios, a sales user sees credential-harvesting scenarios), and difficulty and frequency adjust automatically based on how they've responded. Users who consistently spot threats get more challenging content; those who struggle get more frequent, targeted training. No manual setup is required.

No, and this is a deliberate difference from traditional platforms. Pistachio is fully automated and uses AI to select content based on each user's profile, so there are no manual campaign or template options. You can, however, use the Internal Policies feature to upload your own documents (such as an AI policy or company-specific guidance) that users must read and acknowledge.

Pistachio uses the Microsoft Graph API to inject simulations directly into mailboxes, bypassing the normal mail flow. This mimics how a real attacker operates and means that in most cases no whitelisting is required, because email security tools don't intercept content that never travels through normal mail flow. New attack vectors, domains, and content can be added continuously without updating allow-lists.

Frequency adjusts automatically to performance, typically one to two per month. Users who perform well hear from us less often, since they have a job to do; those who struggle receive more frequent training.

They're taken straight to a short feedback page showing the clues they missed. It takes roughly 30 seconds to a minute, with no long videos or courses. Falling for a simulation is treated as a positive learning moment, not something to worry about.

Admins can verify any email in the Pistachio dashboard by searching for the user and viewing their simulation log. Alternatively, the report phishing button routes Pistachio simulations separately from genuine threats, so your normal security process is never triggered by a test.

Employees are notified by email when a policy is assigned or updated and acknowledge it directly in the platform using Microsoft SSO. Policies can go to the whole organisation or to specific departments (pulled from your Entra tenant). Pistachio tracks acknowledgements and highlights anyone who hasn't responded, and you can update a policy at any time, with employees automatically notified of the new version.

Practice currently supports 12 languages: English, Norwegian, Swedish, Danish, Finnish, French, German, Portuguese, Spanish, Polish, Dutch, and Italian. All translation is done by professional native translators, not AI, because AI-translated simulations are often instantly recognisable as fake. The platform detects each user's language from their Entra ID settings and delivers content accordingly.

Training covers a broad set of topics across the year, including GDPR, email security, physical security, password management, QR codes, and smishing, aligned to requirements such as ISO, NIS2, and Cyber Essentials.

The button overlays the Microsoft report button. If a user reports a Pistachio simulation they get immediate feedback and the email moves to junk. If they report a real phishing email it follows your normal security process through Microsoft Defender.

Practice integrates with Slack, Teams, and Outlook so training reaches your team where they already work and they can flag suspicious emails on the spot. Delivering through Teams often increases engagement, and the integration takes about a minute to set up.

‍

The simulation library isn't publicly available, but you can view simulations in the platform once they've been sent, and a trial is the best way to see the range of content.

No. Pistachio does not currently run SMS phishing as a technique, due to GDPR concerns around texting personal phones. Smishing is covered in the awareness training content.

Practice includes two downloadable PDF reports generated on demand: a management report (an organisation-wide overview for leadership or IT) and a compliance report (the full training history, suitable for year-end audit and regulatory or insurance purposes). A CSV export of the raw data is also available, and all activity is captured from day one so historical data is always exportable. During a trial you get the same full dashboard access, including click rates, leak rates, interactions, and simulation difficulty levels.

Loop is a personalised overview of each user's cybersecurity journey. Every six months users receive an email with their new Loop, a visual recap of how their instincts are improving, from reporting suspicious emails to answering scenarios correctly. It reinforces the idea that security is a habit built over time rather than a one-off.

Presence is an AI-driven insider threat detection tool. It connects to your cloud environment in minutes and uses AI to form a total assessment of a person's behaviour before deciding whether they're a threat, rather than firing on simple rules. That means less time spent on false positives and configuration, and fewer real threats missed because they fell outside a rule.

Presence works from Microsoft 365 audit logs, including email activity, file downloads, SharePoint and OneDrive access, login events, and unusual working hours. It reads metadata only (document names and locations, email subject lines and attachment names, login events, activity patterns) and never email or document content. For example, if someone in marketing suddenly accesses finance documents, that can trigger an alert without Presence ever opening the files.

No. Presence is entirely cloud-based and works from audit logs. You grant permissions and turn it on.

Presence works with standard Microsoft 365 licences, including Business Standard, Business Premium, E3, and E5. You do not need premium licences. The only requirements are Microsoft Entra ID and cloud-based mailboxes in Microsoft 365. If you already use Microsoft Purview for data loss prevention, your existing P1 licences are sufficient, with no upgrade to P2 needed.

Unlike Purview, Presence needs no manual rule setup or ongoing maintenance. It uses AI to build an individual baseline for each user and gives context-driven alerts rather than a flood of false positives, and setup takes minutes rather than months.

Presence starts with a general baseline immediately and takes roughly 10 days to build an accurate behavioural baseline for each user.

You need a Microsoft Entra tenant managing your users' identities, but Presence monitors more than Microsoft. It offers optional integrations with other SaaS tools, currently HubSpot (login activity and export actions), Gong (login activity, downloads, and pages viwed), and GitHub (clone actions), with more being added. These can be connected after initial setup.

‍

Canaries are honeypot emails injected into admin users' sent boxes, with sensitive-looking subject lines such as "financial statements." If someone interacts with one, it can indicate the account has been compromised.

An alert appears in the Pistachio platform, and because genuine alerts are rare, an email also goes to a designated admin for every new alert so nothing is missed. Each alert includes the flagged user's details, clear reasoning for why the behaviour is unusual, a breakdown of specific findings (for example unusual working hours, high download volume, sensitive file downloads, or suspicious email activity), and the option to download the exact underlying audit logs as a CSV. Presence takes no automated action: a person on your side reviews the alert and decides how to proceed.

Very little. Presence works with your existing team, only alerts you when something genuinely matters, and is designed to make investigations fast and straightforward.

Pistachio charges a fixed price per user. If you sign up online, you are billed monthly for the number of users synced in the platform, and you can set a maximum number of licenses to avoid adding more than you intend. For a one-year contract, we offer tailored pricing to suit organisations of any size. Contact us for a custom estimate.

Everything. Phishing simulations, training scenarios, the internal policies feature, all reporting, integrations, onboarding, and customer success support are all included. There are no tiered levels or hidden add-ons.

Yes. Every customer gets a dedicated support team and a Customer Success Manager for onboarding and ongoing use, at no extra cost.

Yes. Pistachio is ISO/IEC 27001 certified, and our compliance is subject to full external audit by an independent auditor every year. During evaluation we can provide our ISO/IEC 27001 certificate, Statement of Applicability, latest audit reports, Data Processing Agreement, and IT security assessment documentation.

All customer data is hosted in Europe on Google Cloud infrastructure in the Netherlands, and no data is transferred outside the EEA. Data is encrypted at rest, and internal access is limited to a small group of authorised individuals. For Presence, the AI models run inside Google Cloud's Vertex AI and data never leaves Google's European data centres. For UK customers, transfers from the UK to the Netherlands are lawful under the UK's adequacy regulations, covered by the standard DPA (which includes Standard Contractual Clauses).

‍

No. Pistachio does not read email content or document content, and has no capability to do so. For Practice, we only write simulations into mailboxes. For Presence, we analyse the same audit logs your IT admin could review manually (file names and locations, email subject lines and attachment names, login events, activity patterns), never the content itself.

For Practice, data is kept for as long as you use the product and for 12 months afterwards, so you can download historical reports (for example for year-end audit) before it is securely disposed of. For Presence, audit log data is retained for 60 days; if an alert is raised about an employee, the relevant data is stored and made available to you as a CSV for as long as you use the service.

Presence is built to be the least invasive option available. It does not track productivity, geographic location, or device activity, and no individual's logs are ever reviewed by a human unless the AI has first assessed and flagged potential malicious behaviour. That is more privacy-friendly than the usual alternative, manual log review, where staff can browse colleagues' logs with no prior suspicion. Presence makes no automated decisions with legal consequences: a person on your side always confirms and decides how to proceed. It has been assessed under the EU AI Act and is not a high-risk AI system.

Yes. The trial runs for 14 days and gives you the full product, identical to the paid version. It begins as soon as you connect your Microsoft Entra ID, and the setup takes the same 10 minutes as a full deployment. The trial cannot be paused, and extensions beyond two weks are typically not offered, though you can discuss specific needs with your account executive. For Presence, add your whole organisation (end users won't know they're in a trial). For Practice, start with a pilot group and let them know they're taking part, since they'll receive training content, then expand later.

‍

We recommend a minimum of 50 users, ideally 50 to 100, for meaningful data. Because content is personalised and sent gradually at ranom times, not every user receives something immediately: expect around 70% of users to receive one to two pieces of content across the 14 days. With only 10 to 20 users you are unlikely to see significant data.

‍

If you already have a contract and an access code from our team, log in, go to Settings, and enter the code to activate your licenses. If you're new, sign up with your Microsoft SSO, go to Settings, and enter your payment details. Once payment is confirmed your subscription shows as activated. For billing queries, contact finance@pistachioapp.com.

If you're satisfied, you sign the contract and the service continues seamlessly with no additional setup. If you decide not to proceed, the trial simply ends after 14 days. If you'd like your organisation's data deleted afterwards, contact privacy@pistachioapp.com.

After the trial, if you'd like your organisation's data deleted, contact privacy@pistachioapp.com and we'll comply with your request.