Mika Aalto is the co-founder and chief executive of Hoxhunt, a company in Helsinki, Finland, that trains employees to spot phishing by sending them realistic fake attacks and giving them points when they report one. A software engineer by background, he spent about 15 years at the Finnish company Haahtela and started a behavior analytics company before founding Hoxhunt in 2016 with Pyry Åvist, Karri Kurunmäki and Pasi Salo. He is known for arguing that companies should reward staff who catch attacks, and he blames old compliance training for treating employees as the problem.
Fifteen Years at Haahtela
He worked as a software engineer and IT manager, according to Hoxhunt's biography. At Haahtela he helped build software for managing temporary workers that handled more than $100 million a year in salary and invoice payments. The Finnish engineering magazine Tekniikka&Talous reported that by the time he graduated from Aalto University with a master's degree in engineering in 2015, he already had a 15-year career behind him at Haahtela, a family-owned company. His degree combined software business, software engineering and technology law.
He also started Wayward Systems, a startup that worked on behavior analytics and on confirming a user's identity automatically from how they behave. Hoxhunt describes him as an expert in big data and machine learning. The company has used machine learning from its start to decide which training each employee gets. On Hoxhunt's blog he put it this way: AI can be used for good or for evil. Since our founding in 2016, we have used AI and machine learning for good by leveraging its capabilities for automation and personalization.
Founding Hoxhunt in Helsinki
Tekniikka&Talous reported that his business idea was first dismissed before it became Hoxhunt. The four founders were frustrated with security training that treated phishing as a yearly compliance exercise, according to the investor Dawn Capital. Employees sat through slides once a year and forgot them. Hoxhunt won its first customers in the spring of 2016, according to the Finnish Wikipedia article on the company, which draws on Helsingin Sanomat. About six months in, a public grant from Business Finland let the founders pay themselves for the first time. In January 2017 the company raised seed money from Icebreaker.vc and from First Fellow Partners, the fund of Risto Siilasmaa, then chairman of Nokia.
He credits Finland for making the jump less risky. In 2018 he told Expat Republic that Slush, the startup conference in Helsinki, changed how Finns saw founders: Slush made the change that 'start-ups are sexy' here in Finland.
He also pointed to public healthcare: So the risk you are taking when you start a new company is very minimal, compared to other places where if you don't have a job, you don't have healthcare.
Turning Phishing Training Into a Game
Hoxhunt sends each employee realistic phishing simulations and rewards them for reporting, with points and leaderboards. He explained the thinking in an article for Cybersecurity Ventures: When we developed Hoxhunt, we thought that there should be a secret sauce as to why people would truly want to participate in security training. We knew that people love to compete with each other, so why not gamify our approach?
He argues for encouragement over blame: Like in many other fields in life, you see better results using a positive approach instead of punishment.
When Dawn Capital led Hoxhunt's next round in 2018, he told Tech.eu: By making security fun and engaging, employees become the force that defeats cyberattacks
.
By 2023 Hoxhunt had about 125 staff in Helsinki, London, England, and Minneapolis, Minnesota. When it raised more money in 2022 he described the problem he wanted to solve: Email is the biggest threat to enterprise security; that's why human nature is the most important cybersecurity challenge to solve, instead of building incrementally better mousetraps at the technical perimeter
.
Phishing in the Age of AI
He rejects the usual framing of breaches as employee mistakes. He told BetaNews: The term 'human error' is technically accurate but it misplaces the blame for data breaches on people
. He wants security teams to treat every report from staff as useful: A threat report is a terrible thing to waste.
At the RSA Conference in San Francisco, California, in 2025 he told Tech Edge that attackers target us people
, while older training made employees' lives very miserable
.
He sees AI making phishing harder to catch. He told Expert Insights in 2024: Modern threat actors are leveraging AI to craft sophisticated spear phishing campaigns at scale, bypassing traditional email filters and security mechanisms.
An AI agent can research any employee cheaply and write a lure that fits, such as an invitation coming from your previous professor in your university inviting you to alumni party
. He called AI a playground gold mine and also pretty scary at the moment
, since Hoxhunt uses the same methods to tailor its training. He blames companies that buy cheap training to satisfy auditors: Threat actors are making billions from our slow adoption rates.
Sources
- Tekniikka&Talous: How Hoxhunt, which gamifies security, was born (Finnish)
- Hoxhunt: Mika Aalto biography
- Hoxhunt, Finnish Wikipedia (Finnish)
- Dawn Capital: Hoxhunt
- Expat Republic: A tale of two startup cities, Amsterdam and Helsinki (2018)
- Tech.eu: Finnish startup HoxHunt raises funding for its cybersecurity gamification platform (2018)
- Cybersecurity Ventures: How does employee security engagement training transform your defense strategy? by Mika Aalto
- Hoxhunt press release via Cision: Hoxhunt raises $40M to solve the hardest part of cybersecurity, people (2022)
- BetaNews: Combating phishing and social engineering threats, Q&A with Mika Aalto
- Expert Insights: Q&A with Hoxhunt CEO Mika Aalto (2024)
- Hoxhunt: AI and the future of phishing training, insights from Hoxhunt CEO Mika Aalto
- Tech Edge: Hoxhunt co-founder and CEO Mika Aalto, live at RSAC 2025 (video)
Sources retrieved October 21, 2026.
