Pistachio has acquired the technology behind Hugin.io, expanding its human risk management platform into compliance management and giving the company a broader role in helping organizations manage security and regulatory requirements.
The acquisition extends Pistachio beyond its existing focus on human cybersecurity risk and into workflows associated with maintaining compliance, preparing for audits and demonstrating that required controls are in place.
Financial terms of the transaction were not disclosed.
Pistachio said the acquisition will allow it to apply the same approach it has used to reduce the ongoing workload associated with human cybersecurity risk to compliance-related activities.
The company has spent the past three years building a platform designed to make human risk management more continuous and less dependent on repetitive manual work.
Pistachio now plans to use the technology acquired from Hugin.io to bring a similar model to compliance management.
For many growing companies, compliance can become increasingly complicated as the business adds customers, employees, technology systems and external partners.
Organizations may need to demonstrate that security controls are operating effectively, collect evidence for audits and maintain documentation showing that internal policies and processes satisfy applicable requirements.
Much of that work is still managed through spreadsheets, manually collected evidence and recurring administrative processes.
Pistachio plans to reduce that burden by incorporating more compliance functionality directly into its platform.
The company said the new capabilities are intended to help businesses remain secure and audit-ready while reducing time spent on manual compliance administration.
That includes activities such as tracking requirements, collecting evidence and maintaining documentation needed to demonstrate compliance.
Automating more of those processes could be particularly useful for companies that are growing quickly but do not yet have large internal compliance teams.
As organizations scale, compliance responsibilities can expand faster than the teams responsible for managing them.
A platform capable of continuously monitoring requirements and gathering evidence could allow security and compliance professionals to spend more time addressing actual risks and less time managing repetitive administrative tasks.
Pistachio also sees compliance becoming increasingly important outside traditional regulatory environments.
The company said customers, business partners and insurers are increasingly asking companies to provide evidence of compliance before entering or continuing commercial relationships.
That shift makes compliance not simply an internal governance requirement but potentially a factor in winning customers, securing partnerships and obtaining insurance coverage.
A company seeking to sell software or services to larger enterprises, for example, may be required to demonstrate that its security controls and internal processes meet specific standards before a contract can be approved.
Insurers may similarly want evidence that appropriate cybersecurity and risk controls are in place before providing coverage or determining policy terms.
As a result, companies can face pressure to remain continuously prepared to demonstrate compliance rather than treating audits as isolated annual events.
Pistachio’s strategy is to incorporate those requirements into an ongoing operational process.
The company is extending the philosophy behind its human risk management platform, where the objective is to reduce recurring administrative work while helping organizations improve security behavior over time.
By adding compliance management, Pistachio can potentially connect human risk, cybersecurity awareness and compliance activities through a single platform.
That integration could help companies gain a more complete view of how employee behavior and organizational controls relate to broader security requirements.
Human behavior remains an important component of cybersecurity because employees regularly interact with email, cloud applications, sensitive data and other systems that can become targets for attackers.
Security training and human risk management are intended to reduce the probability that individual actions create security incidents.
Compliance programs frequently include many of those same controls, meaning Pistachio’s existing human risk capabilities can overlap naturally with compliance management.
The Hugin.io technology gives Pistachio a foundation for expanding into those additional workflows.
Instead of building an entirely separate compliance platform from the ground up, the company can integrate acquired technology into its existing product and apply its established approach to automation and risk management.
That could also create cross-selling opportunities among Pistachio’s existing customers.
Organizations already using the platform to manage human cybersecurity risk may be able to adopt compliance functionality within the same environment.
For Pistachio, that expands the amount of security and risk-related activity that can be managed through its software.
The move also reflects a broader convergence between cybersecurity and compliance.
Historically, the two functions have often been managed separately, with security teams focused on preventing attacks and compliance teams focused on proving that required controls exist.
In practice, however, the two areas increasingly overlap.
Organizations need security controls not only to reduce risk but also to satisfy customers, regulators, insurers and other stakeholders.
Technology that can connect those functions may therefore reduce duplication across teams.
Pistachio plans to make the new compliance capabilities available within its platform in 2027.
The company will use the period leading up to launch to integrate the Hugin.io technology with its existing human risk management capabilities.
Once available, the expanded platform is expected to help customers manage both cybersecurity-related human risk and compliance requirements from a more unified environment.
For growing companies, the value proposition centers on reducing manual work while improving audit readiness.
Instead of relying extensively on spreadsheets and periodic evidence-gathering exercises, Pistachio wants to make compliance a more continuous process.
That could help organizations respond more quickly when customers, partners, auditors or insurers request proof that required controls are operating.
The acquisition therefore represents a meaningful expansion of Pistachio’s addressable market.
After spending three years developing its human risk platform, the company is moving into a neighboring category where many of the same customers face significant administrative challenges.
By acquiring the technology behind Hugin.io, Pistachio is positioning its platform to address both the human side of cybersecurity and the operational work required to demonstrate compliance.
The new functionality is expected to become available in 2027, giving Pistachio a broader product offering focused on helping companies remain secure, audit-ready and less dependent on manual compliance processes.
