Pistachio Security Awareness Platform

Provides team-level risk dashboards visible to people managers and HR, enabling business-side accountability for security behavior separate from the security team dashboard.

Syncs user rosters, role changes, and offboarding events from HRIS and identity providers, keeping the platform enrollment current without manual administration.

Includes training content mapped to specific compliance control requirements (HIPAA workforce training, GDPR data handling, PCI DSS cardholder data procedures).

Calculates individual security risk scores from observed actions (phishing simulation results, policy violations, risky application usage), rather than training completion status alone.

Sends simulated phishing emails at configurable frequency and difficulty, tracking click, credential submission, and report rates per user and department.

Assigns training modules based on each user's observed risk behaviors, role, and previous training results rather than delivering the same content to all users.

Combines multiple weak behavioral signals into a single risk score per user or entity, ranking which accounts warrant investigation so analysts focus on the highest-risk anomalies.

Builds behavioral baselines per user account, device, and application, capturing access timing, resource usage patterns, and activity volumes specific to each entity rather than aggregate thresholds.

Models attacker-in-residence scenarios (pre-resignation data staging, after-hours privileged access, bulk download exceeding peer norms), with risk scores decaying appropriately for resolved anomalies.