Security awareness training that creates vigilance, without demanding your time
Personalised training and phishing simulations that adapts to every employee and runs without your input.
Trusted by 1200+ customers & MSPs
68% of cyber breaches involve people, not technology. Traditional training won't fix that.
Generic training isn't relevant. One-size-fits-all content doesn't prepare people for the attacks aimed at their role, making it ineffective.
Manual programmes don't scale. Building campaigns, chasing completions and refreshing content isn't viable for most IT teams.
Compliance is tightening. Cyber insurers and NIS2 increasingly mandate phishing training, with NIS2 in force by 2027.
68% of cyber breaches involve people, not technology. Traditional training won't fix that.
...But Practice can.
Pistachio keeps reducing your human risk in the background, without adding to your teams workload.
“Traditional phishing training feels like box-ticking, but Pistachio builds real skills over time. Users enjoy the tests and get instant feedback.”
Two training methods, working together
Low effort for your team, with high impact on your human risk
Pistachio keeps reducing your human risk in the background, without adding to your teams workload.
Live in 10 minutes
Connect Microsoft Entra and sync your environment. No lengthy onboarding or months to configure your users.
No ongoing admin
Training and detection keep working in the background, so your protection doesn't lapse when your team is busy.
Always up to date
Training and threat coverage adapt automatically, so you're protecting against this year's attacks.
Personalised, adaptive
A custom training journey for every employee, that builds resilience and awareness to modern cyber threats.
Audit-ready, without the admin.
One-click reports for ISO 27001, NIS2 and Cyber Essentials, plus built-in policy management. Evidence ready when auditors ask, with no separate LMS or manual tracking.
Trusted by lean teams across Europe
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
The Phishing Behaviour Report 2026
12-month journey analysis for over 120,000 users across 600+ organisations.
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
Have a question?
Practice is fully automated security awareness training built around each employee's needs and behaviours. You turn it on and employees start receiving tailored simulations and scenario-based training automatically. You don't pick which training to send, group users, or chase people to complete it: Pistachio handles all of that.
Practice builds an individual profile for each user from two inputs: their Entra ID data (role, department, location, language) and their past interactions with the platform. Content is targeted to each person's context (a finance user sees invoice-fraud scenarios, a sales user sees credential-harvesting scenarios), and difficulty and frequency adjust automatically based on how they've responded. Users who consistently spot threats get more challenging content; those who struggle get more frequent, targeted training. No manual setup is required.
Pistachio uses the Microsoft Graph API to inject simulations directly into mailboxes, bypassing the normal mail flow. This mimics how a real attacker operates and means that in most cases no whitelisting is required, because email security tools don't intercept content that never travels through normal mail flow. New attack vectors, domains, and content can be added continuously without updating allow-lists.
They're taken straight to a short feedback page showing the clues they missed. It takes roughly 30 seconds to a minute, with no long videos or courses. Falling for a simulation is treated as a positive learning moment, not something to worry about.
Practice currently supports 12 languages: English, Norwegian, Swedish, Danish, Finnish, French, German, Portuguese, Spanish, Polish, Dutch, and Italian. All translation is done by professional native translators, not AI, because AI-translated simulations are often instantly recognisable as fake. The platform detects each user's language from their Entra ID settings and delivers content accordingly.
Practice includes two downloadable PDF reports generated on demand: a management report (an organisation-wide overview for leadership or IT) and a compliance report (the full training history, suitable for year-end audit and regulatory or insurance purposes). A CSV export of the raw data is also available, and all activity is captured from day one so historical data is always exportable. During a trial you get the same full dashboard access, including click rates, leak rates, interactions, and simulation difficulty levels.