Executive Summary
A US federal agency supports hundreds of sites nationwide from a single Active Directory domain, and a staff of three runs its validation program. Detection engineering had used Picus for more than a year when the red team took on a harder question: once an attacker is inside one site, what stops them, and who notices?
The team added Autonomous Penetration Testing (APV) to Breach and Attack Simulation (BAS) and began gray-box, assume-breach runs scoped to one site’s subnet at a time. Network controls and the EDR held, with no successful lateral movement in the scan review. Detection was the gap: only about one site in ten detected the activity, and credential hashes were retrievable on hosts where an endpoint agent only monitored.
The Challenge: Hundreds of Sites, One Domain, a Staff of Three
The agency’s estate is one Active Directory domain, with each site organized as an organizational unit rather than a separate domain, so a foothold at any one site sits inside the same directory as every other. Detection engineering had validated controls with BAS for more than a year. The red team needed to see what happens after initial access, site by site, without the people to do it by hand across the whole estate.
The team focused on two priorities: testing what an attacker could do from a foothold inside a site, under an assume-breach model, and showing which controls held and which sites saw the activity, with evidence the team could act on.
We’re hoping to do this all automatically because otherwise... we only have a staff of three to manage it.”
Senior Security Engineer, US Federal Agency
The Solution: Assume-Breach Testing, One Site at a Time
Rather than adding another tool, the team extended the platform it already ran from detection engineering to the red team. Picus runs fully on premises, inside the agency’s own environment.
Breach and Attack Simulation (BAS) has been in regular use by detection engineering for more than a year. Simulations run under both standard-user and admin credentials, and results feed custom SIEM dashboards the team built for internal reporting.
Autonomous Penetration Testing (APV) brought the red team in, and three of its four engineers use it. Gray-box runs start from a supplied credential, target a single site’s subnet, and end with an attack map the team checks against SIEM and directory logs before notifying the SOC and sending remediation guidance to the sites involved.
We’re getting ready to... bring our red team on to use the tool a lot more. Not just our detection engineering team.”
Senior Security Engineer
The Results: Evidence of What Held, and Where It Didn’t
The gray-box runs answered both questions with evidence. Network controls and the EDR held: the scan review found no successful lateral movement from the initial foothold. On hosts where an endpoint agent ran in monitor-only mode, the result was different. Credential hashes could be pulled straight from the operating system, because the agent watched the activity without blocking it.
Detection was the larger finding. Across early runs, only about one site in ten detected the simulated activity.
That split is what assume-breach testing is for. A blocked attack and a detected attack are different results, and testing from inside a site is how the team learned it had the first without reliably having the second.
The next step is scale. Today the team pilots APV site by site, installing agents by hand. The goal is testing as a service: a site requests a simulation through the ITSM platform, and orchestration installs the agent, creates the test accounts and opens the firewall ports. The team is shaping that path directly with the Picus product team, submitting requests through the Idea Portal as it goes.
“Our crawl, walk, run approach is manually installing APV agents now.”
Automation Team Lead
For a staff of three responsible for hundreds of sites, assume-breach evidence shows where to look first.
Two out of 29. Maybe 10%, right? That tells you something.”
Senior Security Engineer, US Federal Agency
