Pistachio bundles tools. Moxso runs intelligence.

Why we win

One intelligence engine
Multi-IdP via SCIM 2.0
Individual risk vs. cohort dashboard

Open closing

Walk away when

Microsoft-Entra-first SMB without board pressure
Self-service procurement deal
Insider-threat-only evaluation

Open walk-away

Three buyers

The Security LeaderAn individual risk profile showing who the high-risk people are and why — not 'o...
The Security BuilderMulti-IdP signal architecture — not an Entra-native bundle with Mail.ReadWrite p...
The Head of ITA platform that runs without admin attention — not just one that sets up in 10 m...

Open three buyers

Three places we differ

SignalDoes Practice's data and Presence's data produce one risk profile per person, or two separ...
ProvisioningWhich IdPs do you support today, and what happens to the deployment if we move off Microso...
PersonaWho are your five highest-risk individuals today, and what makes each of them high-risk?

Open three differences

Objections / 4 ranked

01Already on Pistachio
02Simpler setup
03Two-product bundle
04Privacy philosophy

Open objections

Why they buy

Oslo-founded, Microsoft-Entra-native. Two products in one bundle: Practice (SAT) plus Presence (insider threat detection, launched October 2025). Ten-minute Entra setup. $3.67/user/month. Modern Nordic UI.

Open one-line

Landmines to lay / one per call, don't stack

01Does Practice's data and Presence's data produce one risk profile per person, or two separate data streams?
02When a new attack pattern emerges outside your walls, how does the platform know which employees' risk just changed?
03Which IdPs do you support today, and what happens if we move off Microsoft Entra in the future?
04Who are your five highest-risk individuals today, and what makes each of them high-risk?
05How does the platform prove effectiveness under NIS2 Article 21 – that risk reduced, not just that training happened?
06Does an insider-threat alert on an employee change how they get trained in Practice?

Open landmines