Executive Summary
A global enterprise software company ran security across on-premises infrastructure, multiple cloud providers, and SaaS. Vulnerability data lived in one place, control effectiveness in another, and no layer connected the two. After its previous simulation tool was retired, nothing continuously tested whether controls blocked real-world threats, and severity scores kept driving the remediation queue whether or not the controls already blocked the finding.
The team deployed Picus and connected the silos. Scheduled simulations now run across dev, QA, and production, asset inventory spans tens of thousands of endpoints, and Exposure Validation layers control evidence over CVE data. Windows endpoints proved a 98 to 99 percent block rate against emerging threat campaigns, and half a dozen old high-severity CVEs on active assets went straight to remediation.
The Challenge: Vulnerability Data and Control Evidence Never Met
The environment is genuinely hybrid, and that was the starting point of the problem.
Vulnerability scans produced findings in one system while control effectiveness lived in another, and no layer connected the two to drive prioritized remediation. After the previous simulation tool was retired, nothing continuously tested whether the controls in place would block real-world threats. Severity scores kept driving the queue, whether or not the controls already blocked the finding. The team needed remediation effort to rank by real, validated exposure, and continuous validation restored across the whole hybrid estate.
It’s a mix of quite a lot of things: on-premises, different cloud providers, SaaS. We wanted to understand how things actually look.
Senior Technology Specialist
The Solution: Connecting Exposures to the Controls That Block Them
Rather than treating vulnerabilities and controls as separate problems, the team used Picus to connect them: one platform where simulation evidence and exposure data meet, with every result mapped to MITRE ATT&CK.
Security Control Validation runs scheduled simulation campaigns across dev, QA, and production environments, using custom templates the team curates for emerging threat campaigns. Results feed back through native integrations with the EDR, firewall, and email security layers. Attack Surface Validation syncs asset inventory across tens of thousands of endpoints from the EDR, vulnerability scanner, and directory services. Exposure Validation then layers simulation evidence over CVE data, so remediation queues rank by validated exposure rather than severity scores alone.
Exposure Validation has come out pretty nicely in terms of feature set and speed of improvements, putting things in perspective. We have been able to draw quite some conclusions out of it.
Senior Technology Specialist
The Results: From CVE Lists to Validated Priorities
Windows endpoints proved a 98 to 99 percent block rate against emerging threat campaigns. Exposure Validation surfaced half a dozen older, high-severity CVEs sitting unaddressed on active assets, and the team pushed them straight to remediation with evidence attached.
The shift is in how remediation decisions get made. A severity score says how bad a vulnerability could be. Validation shows whether it is exploitable here, against the controls already deployed, so the queue ranks by what an attacker could actually use. Asset inventory now gives simulation results and vulnerability findings one shared foundation, turning validation output into structured evidence the team can act on.
There are at least half a dozen CVEs we were working with the respective teams to handle. They were older CVEs with higher score ratings, and they were just sitting out. It just can’t be explained why a 2021 CVE should exist at all on some assets. So we pushed them.
Senior Technology Specialist
Why the Team Chose Picus
The team found Picus before any formal evaluation was underway, through its threat research.
“The way I figured out the offering was, I had been reading some pretty good blog posts and fantastic analysis being done on different malware and ransomware families. That is where I found it.”
Senior Technology Specialist
Deep-dive analyses of active ransomware campaigns put the platform on the team’s radar, and the product kept it there: native integrations with the stack they already ran, new threats added to the simulation library within 24 hours, and an Exposure Validation layer that connected data nothing else connected.
“This is different than what we were expecting, but it looks compelling.”
Director of Cyber Security Threat Management, at the first demo
The Takeaway
A vulnerability list says what could be attacked. Control evidence says what is defended. Kept apart, they produce remediation queues full of theoretical risk and blind spots around real risk. Connecting them changes the question from how severe is this finding to can an attacker actually use it here. For a security team running a hybrid estate of tens of thousands of endpoints, that connection is what turned two silos into a single, prioritized picture of what holds and what needs fixing next.
