Pistachio, an Oslo cybersecurity startup focused on human risk, announced on September 2, 2026 that it had acquired Hugin Cybersecurity AS, the Norwegian company behind the cyber-risk management platform Hugin.io.
Financial terms were not disclosed. Pistachio chief executive Joe Jones later told Information Security Media Group that the company was acquiring only Hugin.io's technology and did not plan to bring any employees over.
Pistachio will use the technology to build a cybersecurity compliance and security posture management service, which it plans to launch in 2027. Hugin.io will not continue as a standalone product.
What Hugin.io built
Hugin.io was founded in 2023 and helped growing businesses assess, manage and demonstrate their cybersecurity posture and regulatory compliance. It employed 10 people as recently as March 2026 and had not disclosed any outside funding. Jørgen Færevaag, who is also a managing partner at Faerevaag Consulting and Norwegian Defence Industry Partners, led the company from its start.
Jones said Pistachio was drawn to how Hugin scores risk. Many cybersecurity risk scores, he said, are built on a basic underlying formula and can feel arbitrary. Hugin's approach takes in devices, the technologies running in a company's environment and its performance against compliance requirements, and explains how it reached a score.
For security chiefs and IT heads, Jones argued, being able to justify a risk score to a board can matter as much as the number itself. He praised the work Hugin's team had done but said Pistachio did not plan to keep running the acquired product unchanged.
Færevaag said the challenge for growing businesses is not knowing that rules exist, but understanding which ones apply, where the gaps are and what needs to be done to close them.
“Bringing Hugin's technology into the platform is a natural next step, allowing us to extend that approach from human risk into compliance and help more organizations build resilience without adding another layer of complexity.”
Why Pistachio is buying
Pistachio was founded in 2023 and sells human risk management to small and medium-sized businesses. Its platform automates personalised security awareness training and phishing simulations, rather than relying on generic annual courses, with the aim of stopping employees, contractors or compromised accounts from becoming the way into a network.
The Hugin technology lets Pistachio extend that approach into compliance. The planned service will help organisations define, measure and improve their security posture, add tools for managing devices and applications, and support standards and regulations including ISO 27001, the EU's NIS2 directive, SOC 2 and the EU's DORA rules for financial firms.
Jones said Pistachio chose to buy only the intellectual property because it already has its own product vision and intends to rebuild Hugin's technology into a wider platform. He sees compliance as a connecting layer between Pistachio's attack simulations and its tools for insider threats.
In his words, cybersecurity and compliance tend to drive each other, which is why Pistachio sees compliance as close to the core of what it is building.
Compliance for small teams
The product is aimed at smaller companies where one person or a small team often handles cybersecurity, IT and compliance at once. Jones said the system Pistachio has in mind would watch for regulatory changes, understand a customer's security set-up, compare it with the rules and automatically suggest what to fix, replacing a once-a-year checkbox exercise with continuous checks.
Pressure on that market is rising. SiliconANGLE noted that, as the UK advances its Cybersecurity and Resilience Bill and the EU brings in the Cyber Resilience Act, compliance is becoming a steadily heavier burden for companies.
A small Nordic deal
The acquisition is an example of a common kind of early-stage exit: a young company with a working product but no outside funding sells its technology to a slightly larger peer that wants to move faster. For Pistachio, buying Hugin's code is quicker than building a scoring engine from scratch; for Hugin, it offers a home for the technology even though the team is not moving with it.
