Aikido Launches Noon for Microsoft 365 and Teams: Phishing, Deepfake and AI Governance

What Aikido announced​

Noon is described as a dedicated workforce security business that extends Aikido's protection beyond software to the people using it. The announcement was datelined Ghent on 20 October 2026. It appeared as a GlobeNewswire release carried by The Manila Times, and IT Europa ran a matching write-up. Aikido's pitch is that email protection, device protection, AI governance and phishing-simulation training should sit in one platform rather than in several disconnected tools.

Aikido's own framing is that attackers no longer need to break into software when they can trick the people using it. In the company's words, security has long treated software security and workforce security as separate worlds.

The four capabilities​

According to the announcement and IT Europa's account, Noon bundles four things:

• Email protection: It detects phishing and business email compromise messages that slip past native filters, and then removes them. This is framed as a layer on top of existing filtering, not a replacement for it.
• Simulations and training: It recreates attacks such as deepfake voice calls, SMS, QR codes and multi-step campaigns. Role-based lessons are delivered through Noon itself and inside Slack, Microsoft Teams and Google Chat.
• Device protection: IT Europa says it sets up through an organisation's existing MDM tools and monitors device activity, including the websites and apps employees use. The press-release wording is vaguer and mentions protection against malicious packages and AI instructions.
• AI visibility or governance: It shows a history of the AI tools, models and connections employees use across their devices, in line with organisational policies.

The two accounts word the device and AI items slightly differently. Neither says which MDM products are supported, which operating systems are covered, or how the AI-usage history is collected.

The Microsoft 365 and Teams angle​

Noon connects directly to Microsoft 365, Google Workspace, Slack and Microsoft Teams. Its results are built to feed into GRC platforms. Campaign and training data is designed to support audits under SOC 2, ISO 27001, NIS2, DORA, HIPAA and GDPR, and to help meet cyber-insurance requirements.

"Designed to support" is not certification. Noon does not make an organisation compliant. It generates evidence, and auditors decide whether that evidence is enough.

For admins who run Microsoft 365, the announcement leaves several practical questions open:

1. Which Microsoft 365 licences and tenant configurations does the integration need?
2. What permissions does the connection request, and what mailbox and chat data does Noon read?
3. Does Noon sit alongside Defender for Office 365 and Exchange Online Protection, or does it overlap with them? The email claim suggests an add-on layer.
4. Which MDM platforms can deploy the device component?
5. How are simulated deepfake and phishing exercises authorised and scoped? How is employee monitoring disclosed to staff?
6. What audit evidence can Noon export, and in what format?

The sources answer none of these. Ask the vendor before any pilot.

Where Noon came from​

Noon is built on two acquisitions that Aikido completed in September 2026:

• Cyberly is based in Poland and was founded in 2024. It brought AI-driven attack simulations and AI usage visibility. Before the deal it protected more than 300,000 employees across more than 200 organisations.
• Outkept is based in Belgium and was founded in 2020. It brought email security and phishing-awareness training. Before the deal it served more than 1,000 organisations and 250,000 users in more than 100 countries.

Those are pre-acquisition figures, not Noon's current customer count. Both founding teams continue at Noon. Cyberly's four co-founders (Alex Horlach, Evgeny Chamtonau, Pavel Hraznykh and Andrew Labadzinski) keep building the platform. Outkept's Simon Bauwens and Thibaut De Maerteleire lead global MSP partnerships and email security development. The MSP emphasis suggests Aikido wants to sell through channel partners as well as direct.

Aikido says it was founded in Ghent and describes itself as the fastest-ever European cybersecurity company to reach unicorn status. It also says more than 150,000 teams use it, including SoundCloud, Niantic, Runway, Handshake and Deel. These are all company claims. Until now its platform has covered application testing, code, cloud and runtime security.

Checking the threat statistics​

The release leans on Verizon's 2026 Data Breach Investigations Report, so I checked those figures against Verizon's own summary. The claims hold up, with some nuance:

• Verizon reports that mobile social engineering success is up 40%, and that employee use of unapproved "shadow AI" tripled to 45%.
• Verizon describes the mobile attacks as fake text messages and voice calls, with a success rate 40% higher than traditional email phishing.
• Help Net Security's summary of the report says the 40% figure refers to engagement rates in mobile phishing simulations versus email simulations. That is narrower than "attacks succeed 40% more often" and is worth keeping in mind.
• Help Net Security also reports that 67% of users accessing AI services on corporate devices were using non-corporate accounts.
• Security Magazine's summary notes that software vulnerabilities, at 31% of breaches, are now the top way attackers gain access. Vulnerability patching therefore still matters at least as much as human-risk tooling.

Aikido is selling into a real trend, but a vendor will naturally pick the statistics that favour its product. The same report puts vulnerability exploitation ahead of stolen credentials as the leading entry point. It also says 62% of breaches involved the human element. Both findings point to an argument for patching and for training, not a case for one over the other.

Analysis: consolidation versus best of breed​

The consolidation pitch is plausible. Security-awareness training, email filtering, endpoint visibility and AI-usage inventory are often owned by different teams and sold by different vendors. A single console could cut some of that overhead. The trade-offs are the usual ones:

• Newness: The platform is being assembled from two recently acquired products. Integration maturity is unproven.
• Overlap: Microsoft-centric organisations already pay for native email and endpoint protection. They should test whether Noon catches messages those controls miss, and whether it adds alert noise.
• Privacy and governance: Monitoring which websites, apps and AI tools employees use raises works-council, GDPR and employee-communication questions, especially in the EU markets Aikido is targeting.
• Evidence: There is no independent data yet on detection rates, false positives or how well training changes behaviour.

Bottom line​

Noon is a credible-sounding attempt to bundle human-risk tooling with AI-usage visibility, and it has Microsoft 365 and Teams hooks. At this stage it is an announcement, not a proven product. Treat the compliance and effectiveness language as marketing intent. If you run Microsoft 365, ask the vendor the questions above and run a scoped pilot before replacing any existing controls.