Executive Summary
A US public school district protects students, staff and systems with a small security team and a budget that covers one penetration test a year. It runs two EDR platforms side by side, and the security specialist’s worry was simple: what isn’t alerting?
With Picus Breach and Attack Simulation (BAS), the team tests endpoints and the network continuously against current threats, including campaigns aimed at education, and deploys the vendor-specific fixes Picus provides. Simulations quickly highlighted where endpoint controls needed tuning, and an Autonomous Penetration Testing trial surfaced potential attack paths, which the team promptly closed and verified through re-testing.
The Challenge: Two EDRs, but What Gets Through?
The district runs two EDR platforms side by side, along with a next-generation firewall. Each produces its own alerts, and neither shows what the other missed. Between annual penetration tests, there was no consistent way to confirm which attacks would be blocked, which would be seen, and which would get through.
The team focused on two priorities: testing both EDRs and the firewall against current, real-world techniques continuously, not once a year, and turning each finding into a fix the team can deploy, re-test and show to leadership.
One of the fears I have when we see alerts is what is it not alerting? What are we not seeing? Because we’ve had times where one tool will catch something but the other didn’t even alert on it. And vice versa.
Information Security Specialist, US Public K-12 School District
The Solution: Testing Both EDRs Continuously, Fixing What Gets Through
Rather than adding another security control tool to the stack, the team used Picus Breach and Attack Simulation (BAS) to test the ones it already ran.
With Picus BAS, the district continuously simulates the latest endpoint and network threats across its Windows 10, Windows 11 and Windows Server agents, including those used by threat groups known to target the education sector. When a simulation is not prevented, the team applies the vendor-specific mitigation rule Picus provides to the EDR, re-runs the test to confirm it is now blocked, and compares results over time to catch any drift. AI Threat Builder extends this coverage by turning the latest threat intelligence into custom simulations, so testing keeps pace with the evolving threat landscape.
Documentation of Picus is really good. It helped me catch up to speed pretty quick.
Information Security Specialist
The Results: Findings the Team Could Fix, Re-Test and Show
Picus detection analytics correlate EDR and firewall alerts with each simulation, so the team can see which attacks were blocked, which were only detected or logged, and which were missed entirely. With that visibility, early runs showed how prevention varied across endpoints, and Picus provided vendor-specific mitigations to close the gaps in the team’s security controls.
For example, when a Notepad++ CVE was disclosed, the team ran the simulation, deployed the matching vendor-specific rule, and updated the software.
“It was just kind of more of a double coverage. You had a preventative control in place along with your actual patching.”
Information Security Specialist
The results are also easy to share. PDF summaries go to leadership and CSV detail to the technical team, and the specialist has walked the executive sponsor through a full cycle live: simulate, deploy the rule, re-run, confirm.
“I can deploy it, let it run, show we patched and it’s no longer exploitable.”
Information Security Specialist
For a small district team with one pentest a year, that is the difference between hoping a control works and showing it does.
Being able, after the fact, to go and look at, okay, this is where we could have prevented this. This is what we can put in place through Picus to be able to prevent it.
Information Security Specialist, US Public K-12 School District
