Pistachio buys Hugin IP to expand compliance tools

Pistachio has acquired the intellectual property of Hugin.io, expanding into cybersecurity compliance management.

The Oslo-based cybersecurity company is adding Hugin's technology to a platform previously focused on human risk, including social engineering and insider threats. It now serves more than 1,000 customers, mainly in Europe.

The transaction brings together two Norwegian companies focused on small and medium-sized businesses and mid-market organisations. Hugin has developed software that helps businesses assess, manage and demonstrate their cybersecurity posture and regulatory compliance.

A new product built on the acquired technology will cover security posture management, along with tools for managing devices and applications. Pistachio plans to support organisations working toward standards and regulations including ISO 27001, NIS2, SOC 2 and DORA.

The move reflects a wider shift in the cybersecurity market as software vendors respond to stricter regulatory demands. Smaller organisations in particular face pressure to show they can meet security expectations from regulators, customers, insurers and commercial partners.

Research from the European Union Agency for Cybersecurity found that 23% of organisations cited regulatory complexity across jurisdictions as a main barrier to NIS2 compliance, while 20% pointed to skills shortages. That has created an opening for tools that reduce the manual work involved in preparing for audits and maintaining compliance records.

Recent policy changes have added to that burden. In the UK, the Cyber Security and Resilience Bill has progressed through the House of Lords, while in the EU the Cyber Resilience Act is introducing major reporting requirements.

Broader scope

Founded in 2023, Pistachio is headquartered in Oslo and has offices in London and Valencia. Its existing platform automates security awareness training and insider threat detection, with software that adapts to employee roles and behaviour.

The Hugin acquisition marks the next step in broadening the product beyond employee-focused cyber risks. Pistachio sees compliance management as a natural extension for customers that need to identify gaps, measure controls and document remediation work.

A formal launch of the compliance product is planned for 2027. The offering is intended to help organisations stay audit-ready without relying as heavily on manual certification processes.

Joe Jones outlined Pistachio's rationale for the acquisition.

"Organisations are being asked to meet increasingly complex security requirements, but few have the resources to manage them. We built Pistachio around the idea that effective cybersecurity should not require constant effort from already stretched teams. Bringing Hugin's technology into the platform is a natural next step, allowing us to extend that approach from human risk into compliance and help more organisations build resilience without adding another layer of complexity," said Joe Jones, Chief Executive Officer & Co-founder, Pistachio.

Market pressure

The appeal of such software is strongest among smaller companies without large internal security or compliance teams. For those businesses, the challenge is not only understanding which rules apply, but also proving to outside parties that they have the right controls in place.

That pressure is becoming commercial as well as regulatory. Buyers and larger partners increasingly ask suppliers to demonstrate basic cyber governance before signing or renewing contracts, while insurers often require evidence of controls before offering cover.

Hugin's leadership said that market dynamic shaped the company's product design. Its software is intended to make compliance requirements easier to interpret for growing companies that lack specialist staff.

"Cybersecurity is one of the most significant challenges for growing businesses. The issue is not simply knowing that requirements exist, but understanding what applies to your organisation, where the gaps are and what needs to be done to address them. Hugin's technology makes that process simpler and more accessible. With Pistachio, the technology will reach a much larger customer base as part of a broader cybersecurity platform, putting knowhow in the hands of those that need it most as they scale," said Jørgen Færevaag, Co-Founder and Chief Executive Officer, Hugin.io.