Human risk management cybersecurity firm Pistachio AS today announced it acquired Hugin Cybersecurity AS, a Norwegian cyber-risk management platform, to launch a new cybersecurity compliance and posture management service.
Founded in 2023, Oslo-based Pistachio builds what’s known as human risk management solutions for the small and medium-sized business market. It focuses on reducing the chances that employees, contractors or other human-controlled assets, such as compromised accounts, become the entry point for attack.
The company’s platform automates personalized security-awareness training and phishing attack simulation, rather than relying on annual generic compliance courses. Phishing is a method consisting of emails, text messages or phone calls designed to trick employees into revealing sensitive data – especially credentials, passwords or other account information – that could allow an attacker entry into a network.
Hugin focuses on cyber-risk management, helping growing businesses assess, manage and demonstrate cybersecurity posture and regulatory compliance. With the acquisition, Pistachio seeks to broaden its offering beyond human risk security management and into assisting with what comes after.
“We built Pistachio around the idea that effective cybersecurity should not require constant effort from already stretched teams,” said Pistachio co-founder and Chief Executive Joe Jones. “Bringing Hugin’s technology into the platform is a natural next step, allowing us to extend that approach from human risk into compliance and help more organizations build resilience without adding another layer of complexity.”
The service is set to officially launch in 2027 and will encompass a suite of tools designed to help organizations define, measure and improve their security posture. It will add capabilities for managing devices and applications, and lay the foundation for an ambient compliance product that helps growing businesses stay secure and audit-ready.
Pistachio intends to support organizations in meeting industry-standard regulations, including ISO 27001, the international standard for information security management; NIS2, the European Union directive for cybersecurity requirements in critical sectors; SOC 2, a framework for security and data management; and DORA, the EU regulation establishing cybersecurity and operational resilience requirements.
As the United Kingdom and the EU continue to advance cybersecurity legislation, including the Cybersecurity and Resilience Bill in the U.K. and the Cyber Resilience Act in the EU, compliance is becoming an ever-increasing burden.
“Cybersecurity is one of the most significant challenges for growing businesses,” said Hugin co-founder and CEO Jørgen Færevaag. “The issue is not simply knowing that requirements exist, but understanding what applies to your organization, where the gaps are and what needs to be done to address them.”