Executive Summary
A US-based real estate development company ran security the way many lean teams do: annual penetration tests, tabletop exercises, and trust that deployed tools were working. With a two-person security team and no compliance mandate forcing the issue, the drive to validate came purely from risk management. The team needed proof, not practice.
During the proof of concept, Picus surfaced a blind spot the team did not know existed: Fortinet firewall logs were not flowing into Microsoft Sentinel. That single finding sealed the decision. Today the team runs monthly simulations against current threat actor campaigns, has validated its MDR’s response under real conditions, and used Picus evidence to justify enabling nearly all CrowdStrike protection controls.
The Challenge: Tabletop Exercises Could Not Prove the Controls Worked
A two-person security team was protecting the entire organization with an entirely point-in-time approach: annual penetration tests, vendor-led assessments, and tabletop exercises that rehearsed incident response verbally rather than testing it live. Between assessments, there was no way to confirm the controls were actually working, whether the SIEM was seeing everything it should, or whether the third-party MDR would escalate a real incident within SLA.
“We’ve gone through our tabletop walkthroughs. It’s literally practice. What we needed to know was: are our controls effective, how quickly can our teams see it, and do they escalate to us?”
VP overseeing GRC
Notably, no regulation forced the change. The organization has no external compliance obligations, so the continuous validation initiative was driven entirely by risk management and best-practice mandate, a deliberate investment in knowing rather than assuming.
“What we’re looking for is testing to see how people are responding to what happens, kind of like a purple team. If there’s some alert that should have fired, did the person do what he’s supposed to do? Do people follow the incident response plan?”
Director of IT Security
The Solution: The POC That Found a Real Gap
The team evaluated multiple vendors, including a Big Four firm it suspected would simply white-label a validation platform anyway, and chose Picus after a structured comparison.
“We did comparisons and we like your product the best of all the different vendors.”
Director of IT Security
The proof of concept settled it. During POC testing, Picus revealed that Fortinet firewall logs were not being ingested into Microsoft Sentinel, a silent blind spot no annual assessment had caught. Finding a real gap was the point, and Picus found one before the contract was even signed.
“Part of the point of us getting this was to find the gaps. And this has already found a gap as far as I’m concerned. We can correct that during onboarding.”
Director of IT Security
Today, Security Control Validation runs monthly simulations against current threat actor campaigns, with results mapped to MITRE ATT&CK. Findings are batched and deployed on a steady rhythm. Detection Rule Validation results are shared with the third-party MDR to tune SIEM rules and benchmark detection coverage, and Attack Path Validation extends testing into the internal network through carefully scoped sessions.
Validating the MDR: An Unannounced Test
One of the team’s first moves was the kind of test no tabletop can replicate. They ran a live simulation deliberately without warning their MDR provider, to see how escalation would actually work.
The response chain was validated under real conditions, not assumed on paper. The MDR relationship now includes a working loop: simulation findings feed rule tuning, and detection coverage is benchmarked with evidence.
The first time we did it, all the alarms went off and they were very caught off guard. We did that on purpose. We just wanted to make sure how the escalation works. They reached out within what the SLA agreement is. They passed.
IT Security Engineer
The Results: From Annual Tests to Continuous Proof
The Fortinet log gap was corrected at onboarding, restoring SIEM visibility the team did not know it had lost. Picus findings then built the evidence-based case to enable nearly all CrowdStrike protection controls, a hardening step that would have been difficult to justify on assumptions alone.
“We’ve already gotten past the proof of concept around deploying better protections with CrowdStrike based on Picus findings, so that’s rolling out slowly.”
Director of IT Security
On a recent simulation of an active APT campaign, the team blocked the threats and scored full marks on detection. Monthly simulations now run on a steady cadence: test, batch the fixes, deploy, and re-run to confirm the gaps stayed closed.
“I’d say overall, we’re not in a stuck state like we were in the past. We deployed the changes and then reran it again. And it looks good.”
IT Security Engineer
The shift also changed the conversation with leadership. Instead of reporting that an annual test happened, the team now reports what was tested, what held, what was fixed, and what the re-run proved. Framing findings as preventive maintenance rather than alarms turned validation results into a story the audit committee could act on.
Why the Team Chose Picus
The team compared Picus against multiple vendors and preferred the product outright. The economics reinforced the choice: continuous validation runs year-round for a fraction of what recurring penetration testing engagements would cost, and it validates the response chain, people, process, and partners, that no pentest report covers. For a two-person team with no compliance mandate, continuous validation is what turns best-practice intent into working proof.
The Takeaway
Tabletop exercises rehearse the plan. Annual tests photograph a moment. Neither proves that controls, detections, and response partners will actually perform when it matters. Continuous validation closes that gap: it finds the blind spots no assessment catches, builds the evidence to harden what is already deployed, and tests the full response chain under real conditions. For lean teams especially, it is the difference between practicing security and proving it.
