Global Retail Group Replaces Legacy BAS with Picus for Red Teaming and Auto-Remediation

Executive Summary

A global retailer with stores, an online shop and thousands of servers relied on outside red team exercises, which were commonly delayed by months in legal and procurement reviews. Its older attack simulation tool sat alongside single-purpose products and did not work well with its endpoint protection or its IOC automation.

After a proof of concept, the team moved to Picus Breach and Attack Simulation (BAS) and now runs its red teaming operations with Picus attack simulations, continuously, across every environment. Unblocked IOCs flow automatically into the EDR for blocking, and AI Threat Builder keeps simulations in line with the latest attacker techniques.

The Challenge: Delayed Red Team Exercises, No Unified View, Broken Automation

Security is split across specialist teams, from email and web to endpoint protection on thousands of servers, with no single view of how their controls held up against real attacks. The incumbent breach and attack simulation tool did not run smoothly alongside the EDR, and an earlier IOC automation was also not working well.

“We had an automated process that was being executed. It was not functioning very well.”

Platform Owner

The team focused on two priorities: testing the controls already in place against the latest attacker techniques without waiting on a procurement cycle, and turning every unblocked threat into an action the right team, or an automation, can take.

The Solution: Continuous Validation Against Today’s Attacks

The team ran a proof of concept to test whether Picus was mature enough to replace its incumbent tool, then deployed Picus Breach and Attack Simulation (BAS).

The team deployed Picus BAS agents across each environment, from stores and Windows user machines to Linux and Windows servers, so every environment is measured against its own policies. Picus AI Threat Builder turns new threat intelligence into custom simulations, keeping tests in line with current attacker activity. A SOAR playbook takes every IOC that was not blocked and adds it to the EDR for direct blocking. Results reach the relevant security teams, and reports are pulled through the API for internal use.

The IOC automation that once fell short now runs end-to-end.

The Results: Continuous Validation and Red Teaming, Clear Gaps, Automated Fixes

The first measurements gave the endpoint team a clear baseline to work from, showing which gaps to fix, with ready-to-apply mitigations for each.

The response loop now runs without hand-offs. Every IOC that Picus shows was not blocked flows through the SOAR playbook into the EDR for direct blocking, taking over from the earlier IOC automation that had not worked well.

Measuring each environment against its own policies keeps every team focused on its own gaps.

“The idea is to try to have a metric for each environment because each environment has its own different policies.”

Platform Owner

Picus AI Threat Builder also adds threat data that the intelligence team sometimes did not have.

Every simulation result maps to MITRE ATT&CK, the team’s second priority after security control validation, and reports pulled through the API reach relevant security teams that own each control, as well as the quarterly security committee.

Instead of waiting months for a red teaming exercise, the organization now continuously tests its controls against today’s attackers.