Picus Joins CrowdStrike Project QuiltWorks to Make Organizations Mythos-Ready with Unified Validation

Machine-speed validation across every asset, exposure, and control, working with the coalition to achieve proven resilience against AI-powered attacks.

Defending against AI-powered attackers, organizations face a problem that has quietly inverted: not too little information, but too much. Telemetry and finding-generating security tools now produce more outputs than any team can absorb, and much of it arrives as noise rather than clarity. Meanwhile the attackers themselves have accelerated: the mean time from disclosure to exploitation has collapsed from 21.5 days in 2025 to roughly 8 hours in 2026, while 35,364 CVEs were published in the first half of 2026 alone, up 49.5% year over year. Teams end up spending more time triaging findings than reducing risk.

The answer is not producing more findings.It is turning the findings organizations already have into action, through validation, internal and external context, and automated mobilization. That is exactly what CrowdStrike's Project QuiltWorks was formed for: building proactive resilience against AI-powered attackers and making organizations Mythos-ready (announcement).

Picus brings machine-speed unified validation to the coalition. Point solutions validate only what they can see: the assets a pentest can reach, the CVEs with public exploits, the controls a simulation covers. The Picus way is unified validation: every asset, every CVE and exposure, every control, one platform, one continuous loop. That completeness is what answers the questions discovery alone never can: Are we exposed? Do our defenses actually work? Are we more resilient than yesterday? Can we respond at machine speed? Can we prove all of it, right now?

As Volkan Erturk, Co-founder and CTO of Picus Security, puts it:

"Vulnerability discovery shows defenders where to look; validation proves where to act. Picus brings unified, machine-speed validation into Project QuiltWorks, proving what attackers can actually exploit and showing whether controls block, detect, and contain real-world attack behaviors, across every asset, every exposure, and every security control. Picus also turns that evidence into defensible decisions and action, deploying the fixes that close gaps, and revalidating that they stay closed"

Why Validation, and What Happens Without It

Modern security tools generate findings faster than ever, and that work matters. The challenge is what comes next: each finding still needs to be understood, prioritized, and acted on, and at today's volumes and the speed of attackers that work outpaces the time teams have. Without validation, the costs show up in five places:

• Severity is not exploitability. Only 0.25% of published CVEs in 2026 are ever exploited in the wild (CISA KEV). Severity scores cannot tell you which of your findings are truly exploitable in your environment, so teams treat thousands of criticals as urgent while the handful that matter stay hidden in the pile.
• Defenses go unproven. Every EDR policy update, segmentation change, or rule tune silently shifts your posture. What was blocked last month may pass through today, and nobody notices until it matters.
• Improvement goes unmeasured. Organizations own powerful security stacks yet cannot say, with evidence, what those tools block, detect, log, or miss.
• Response runs at human speed. Against 8-hour weaponization, fewer than 0.5% of new CVEs get patched in time. In one recent AI-scale disclosure wave, frontier models surfaced 23,019 vulnerability candidates and 97 were patched upstream. Compensating controls must carry the load, but only if you know they work.
• Proof stays unavailable. "Are we secure right now?" gets answered with opinion instead of evidence.

The Strategic Approach

Analyzing how critical an exposure is for your organization comes down to three inseparable questions:

• Exploitability analysis. Can this exposure actually be exploited in my environment, against my deployed controls? Not in a lab, not in theory.
• Compensating controls, back to basics. When a patch is not coming, and for most CVEs it effectively is not, are the controls you already own effective in mitigating the exposure? How can existing assets be leveraged to shrink the attack surface today?
• Attack paths and business impact. An exposure's true severity is decided by what comes after the first foothold. Vulnerable does not automatically mean exploitable, and exploitable does not automatically mean business-impacting; the attack path decides. So the third question is: if this exposure links into an attack path, which crown jewels become reachable, and at what cost to the business?

Asking all three about one exposure is achievable. The hard part is every exposure, every day, as the environment changes. Scheduled assessments are out: Gartner's Continuous Offensive Security Testing COST framework (March 2026) retires calendar-based testing for continuous, trigger-driven validation, and CISA Binding Operational Directive BOD 26-04 retired CVSS-led patching. The triad must run continuously, at machine speed, calibrated to organizational context.

Continuous execution also needs fuel: deep internal and external context, so validation is accurate rather than generic. Picus has ingested CrowdStrike EDR and CTI data for years; new with the integration launched alongside QuiltWorks, the platform processes that telemetry and CTI agentically, continuously generating and running dynamic attack simulations that reflect the environment as it actually is.

The market's common answer to AI-speed attacks is an AI attacker of your own, and Picus agrees with the premise: it is exactly why Picus built Picus Autonomous Penetration Testing, which delivers live, in-production proof for parts of the first and third questions. Building and running one at scale is also how the boundaries become clear. Live testing covers the slice of the environment it can safely reach, typically excluding 65 to 70% of an estate, the business-critical, restricted, and air-gapped assets that often matter most, and it cannot assess exposures with no working exploit. That is why, in the Picus way, the AI attacker is one instrument in a unified validation loop rather than the whole answer.

The Solution: One Platform, Unified Coverage

Follow one exposure through the Picus Platform, and the three questions become a single motion rather than three tools.

• The exposure enters the loop, and Picus Exposure Validation answers the first question: it maps the exposure to the TTPs its exploitation requires and validates that chain against your real, deployed controls, drawing on evidence from Picus BAS and Picus Autonomous Penetration Testing. Outcome is a defensible exploitability result on day one, for every exposure on every asset, including CVEs with no working exploit and assets live testing cannot reach. Are we exposed? Answered, with evidence.
• Where the verdict is exploitable, Picus Breach and Attack Simulation takes up the second question, continuously proving what your EDR, SIEM, firewall, and segmentation block, detect, and miss, then shipping ready-to-deploy mitigations so the stack you already own carries the load. Do our defenses work, and are we more resilient than yesterday? Measured, continuously.
• And when the question is the attack path itself, Picus Autonomous Penetration Testing answers it the most direct way possible: it discovers and safely executes real attack paths in production, chaining exposures across hosts, identities, and misconfigurations to crown jewels, with an average breakout of about 12 minutes, and returns each path as step-by-step proof of compromise ordered by blast radius. What is the business impact? Demonstrated, not estimated.

What keeps the loop at machine speed is Picus Swarm, the agentic workforce of the platform: five specialist AI agents spanning discovery, exploitation, validation, mobilization, and reporting, orchestrated by Numi AI and grounded in your environment through 75+ integrations. Swarm replaces static, scheduled testing with continuous, autonomous, adaptive validation that fires on signal rather than schedule: the moment a CVE drops, a rule ships, a configuration changes, or new intelligence lands, the relevant part of the loop runs, and only that part, so validation stays current without drowning anyone in duplicate work. Autonomy is tunable per workflow, from supervised to fully autonomous, so conservative and regulated environments adopt at their own pace, and every action carries a full chain of custody.

And what increasingly starts the loop is threat intelligence itself. With its newest innovation, Picus mobilizes CTI as a live signal that starts validation on its own, no analyst required, and CrowdStrike is the pioneering partner: new CrowdStrike CTI is automatically converted into environment-specific attack scenarios and validated against production controls. Where validation identifies an opportunity to strengthen detection, Picus deploys the Indicator of Attack rule directly into CrowdStrike Falcon; for other controls, vendor-specific mitigations from the Picus Mitigation Library reach the teams that own them, and closure is proven by re-validation.

What Picus Contributes to the Coalition

Working closely with CrowdStrike and coalition members, Picus turns the ecosystem's discovery power into outcomes organizations can stand behind: proven readiness against emerging campaigns the moment they are reported, gaps closed with evidence, and unified validation across the whole environment. Picus validation data flows into Falcon Next-Gen SIEM, so the coalition's evidence-based prioritization reflects each organization's real risk. This is the coalition's stated vision, proactive resilience and Mythos-ready organizations, made operational.

And it extends forward: Picus Swarm is built to integrate with the AI agents of coalition vendors and partners, reaching toward end-to-end machine-speed execution across the ecosystem, from discovery to validated remediation.

Become Mythos-Ready, Together

With unified validation running continuously, "are we secure right now" stops being a question you hope about and becomes one you answer with evidence, every day, as threats and your environment change.

Want to talk this through and exchange perspectives with us? Get in touch to learn how the Picus Platform gives you the edge in becoming and staying Mythos-ready. We are ready to be your partner in validating all of your attack surfaces, your exposures, and your security controls.