Insider Threat Detection

An intelligent layer of protection for your cloud-based organization

The presence page from Pistachio's platform showing an unusual behavior alert for a flagged user. The left sidebar displays navigation with Presence highlighted. The main area shows user details, the reason for flagging, and a compilation date. Below is a Findings section with four expandable items, each with an icon: Unusual Workday Activity, High Download Volume, Sensitive File Downloads, and Suspicious Email Activity

Current Market

Most threat detection products are unreliable, confusing, overwhelming, invasive, unhelpful and expensive.

Insider threats aren’t just for big enterprises. A single compromised account or a departing employee with access to sensitive files can quietly turn routine work into a serious problem.

Most tools are built for massive security teams, making setup slow and complicated, while majority of organizations need safeguards that just work, ideally from day one.

Overly Complex

Traditional solutions demand months of setup, costly configurations, and dedicated teams to manage endless alerts, often becoming burdens that security teams can’t maintain.

Never-Ending Alerts

Rigid, rule-based systems can’t distinguish normal workplace behavior from real threats. Teams end up chasing endless false alarms while the risks that truly matter go unnoticed.

Pistachio Presence

The new evolution of insider threat detection.

Actions Analyzed

1

2

3

4

5

6

7

8

9

0

,

9

0

1

2

3

4

5

6

7

8

7

8

9

0

1

2

3

4

5

6

1

2

3

4

5

6

7

8

9

0

,

2

3

4

5

6

7

8

9

0

1

0

1

2

3

4

5

6

7

8

9

8

9

0

1

2

3

4

5

6

7

Everything looks normal

We’ll alert you if we find any suspicious behavior.

Core Product Features

Immediate setup

Getting setup takes minutes. Connect your Microsoft SSO, create groups in Entra ID, and sync your organization. Presence starts working immediately, using finely-tuned models to spot suspicious activity from day one.

Setup checklist showing three steps: Sync organization and Activate Presence marked as complete with checkmarks and Activate Practice as the remaining step.

Contextual analysis

Presence learns your organization’s unique rhythm so when it sees abnormal behavior, it takes note. However, it doesn’t jump to conclusions. It gathers context, weighs the evidence, and only alerts your team when it truly matters.

Four white cards stacked diagonally on a purple background, each showing different activity types with icons: Bulk Download with a document icon, Email Forwarding with an envelope icon, Failed Login Attempt with a login icon, and Downloaded 24 Files with a download icon.

Cloud-based workspaces

Today’s teams work flexibly across cloud apps and locations, creating unique patterns of activity. Presence observes M365 and connected third-party apps, capturing the full picture without interfering with daily work.

Two white cards displaying the Pistachio and Microsoft Entra ID logos with bidirectional arrows between them, indicating integration.

Intent

Protection that doesn’t spy on your people.

Woman with curly hair tied back, wearing a yellow shirt, sitting at a desk with a laptop and notebook. She has a visible tattoo on her arm and a watch, looking off to the side. A plant is visible in the background

Not a surveillance tool

Presence looks out for suspicious behavior. It doesn’t track productivity, peek at devices, or flag everyday work. Only potential threats are visible. Everything else stays private, even to admins.

Seeing people as people

Presence adapts to your team’s rhythm instead of forcing them into rigid rules. It learns each person’s normal routines, so unique work habits don’t raise alarms. That way we can treat people as people, not as problems.

How It Works

How Presence Thinks

Activity is complex. Every click, download, and login tells a story but on their own, they don’t always make sense. Presence pieces it all together, spotting unusual behavior, connecting patterns, and double-checking its findings so you only see what matters.

A junior sales rep accepts a job at a competitor. In their final week, they export Tier 1 client leads and sensitive sales files from Hubspot. They send these files to their personal Gmail account.

Feature Overview

Every alert comes with the full story.

Notification banner showing a new alert from Pistachio with the message "On August 15th, Presence flagged a user." Below is a card displaying flagged user information, the reason for flagging, and expandable findings sections including Unusual Workday Activity and Sensitive File Downloads.

Every alert matters

Presence doesn’t waste your time with noise. If something is surfaced, it’s because the behavior is unusual enough, and serious enough, to deserve attention. You’ll only see alerts that truly matter.

Clear reasoning

Alerts aren’t vague. Each one shows what happened, why it matters, and how it differs from your organization’s normal rhythm, giving you the full picture behind the alert.

Complete log access

Nothing is hidden from you. If a user is flagged, you can download the exact logs behind the alert, giving you full visibility and control. That way your investigations never rely on assumptions.

Let’s Talk

We're here to help you find the right annual pricing for your team.

With a commitment to a one-year contract, we offer tailored pricing that suits organizations of all sizes.

Additional features

No Configuration

From day one, Pistachio starts learning your organization and adjusting itself automatically. You’ll only need to step in if we detect suspicious behavior that requires further investigation.

White card showing Presence with a target icon on the left and a toggle switch set to Active on the right.

Simple pricing

Powerful insider threat detection doesn’t have to come with high costs or heavy resource demands. Presence gives you protection tailored like a large-scale solution, but with the simplicity of predictable pricing and ease of immediate setup.

Slider control ranging from 1 user to 2000 users, currently set at 400 by the user's cursor.

Integrations

Most organizations that run on Microsoft, rarely use Microsoft alone. Presence integrates with the third-party apps your team already uses, like HubSpot, GitHub, and more, so activity across your full workspace is included in the analysis.

Pistachio logo on the left connected by lines to three integration icons on the right: GitHub, Zapier, and HubSpot

More Pistachio Products

Practice helps users build safer security habits without interrupting their workday.

Two overlapping white cards on a purple background. The left card shows a Summary section with text about performance improvement. The right card displays a radar chart titled "Simulation Categories" showing different simulation categories arranged in a chart to show their volume.

Let
Pistachio
Pistachio manage your human
People
cybersecurity risk for you