Picus Security Partners with ThreatConnect to Deliver Evidence-Based Risk Quantification

Combining Breach and Attack Simulation and Risk Quantification into a Single Platform, Picus Brings Real-World Evidence to Cyber Risk Calculations

SAN FRANCISCO, August 6, 2025 — Picus Security, the leading security validation company, today unveiled its industry-first Risk Quantification Module, delivering a transparent, validation-first approach to cyber risk measurement. At the heart of this new module is ThreatConnect’s Risk Quantifier (RQ), which powers the financial modeling engine behind Picus' real-time risk insights. Together, the two platforms enable security and business leaders to quantify cyber risk in monetary terms based not on assumptions, but on validated control performance from Picus. By replacing assumption-driven models with continuous attack simulations, Picus enables security and business leaders to quantify risk in financial terms based on how well defenses actually perform. 

With the average cost of a data breach being $4.4 million, companies are increasingly concerned with quantifying risk. These outdated approaches often fail to reflect how security defenses behave in real-world scenarios — limiting their value in executive decision-making. The new Picus Risk Quantification Module, backed by ThreatConnect RQ, fundamentally changes this paradigm by combining continuous breach and attack simulation (BAS) with rigorous financial risk modeling.Rather than estimate how defenses should perform, Picus demonstrates how they actually perform against real-world adversary techniques.

“Security leaders can’t afford to make security decisions based on assumptions,” said Volkan Ertürk, Co-founder and CTO of Picus Security. “Together, Picus and ThreatConnect offer organizations something they’ve never had before: a defensible and transparent way to link security performance with business impact, backed by live attack simulation data.”

The Picus Risk Quantification Module takes a validation-first approach with continuous breach and attack simulation (BAS) capabilities testing security controls across cloud, network and endpoint layers. These simulations are mapped to the MITRE ATT&CK framework, providing traceable evidence of which adversarial techniques can breach defenses, which are blocked and where exposures persist. These results feed directly into ThreatConnect’s Risk Quantifier, which dynamically calculates financial risk by factoring in exploitability, control efficacy, asset value, threat actor behavior, and residual exposure. The outcome is a more accurate financial risk assessment, driven by variables such as exploitability, asset value, threat actor activity, and real-world control efficacy.

These insights are brought to life in the Picus Business Risk Dashboard — a real-time view of validated cyber risk tailored to an organization’s environment. Security teams can assess the financial impact of potential breaches based on observed exposures, business context and industry benchmarks. They can measure security control visibility to understand which tools are performing under pressure and compare risk across defined business scopes, such as departments, services or regions. The dashboard also reveals which adversary groups pose the greatest financial risk to an organization based on simulation results and threat intelligence. 

“Understanding risk without business context is like flying blind”, said Jerry Caponera, General Manager of Risk Quantification for ThreatConnect. “Picus delivers unmatched insight into how defenses actually perform, and when that validated control data is combined with our financial risk modeling, organizations gain a clear, credible view of what threats truly mean to the business. It’s a powerful combination — one that transforms technical findings into actionable business decisions.”

Learn more about the Picus Risk Quantification Module or see it in action at Black Hat USA, booth [#3741].

About Picus Security 

Picus Security, the leading security validation company, gives organizations a clear picture of their cyber risk based on business context. Picus transforms security practices by correlating, prioritizing and validating exposures across siloed findings so teams can focus on critical gaps and high-impact fixes. With Picus, security teams can quickly take action with one-click mitigations to stop more threats with less effort. Offering Adversarial Exposure Validation with Breach and Attack Simulation and Automated Penetration Testing, working together for greater outcomes, Picus delivers award-winning, threat-centric technology that allows teams to pinpoint fixes worth pursuing. 

About ThreatConnect

ThreatConnect delivers industry-leading cyber risk quantification through its Risk Quantifier (RQ) platform. RQ empowers organizations to model financial exposure, evaluate security control effectiveness, and prioritize mitigations based on real-world risk. Trusted by enterprises worldwide, ThreatConnect enables risk-informed decision-making at the speed of business.

ThreatConnect provides solutions to enable cyber defenders to continuously manage threat exposure and improve cyber resilience. Our threat and risk-informed defense products give defenders the advantage over adversaries with rich context, risk-based prioritization, and the ability to quickly and precisely act on emerging threats. Our products span threat, risk, and security operations, and come together in a single intelligence hub. More than 250 global enterprises rely on ThreatConnect every day to contextualize and prioritize emerging threats and automate defenses.

Follow Picus Security on X and LinkedIn.

Media Contact

Jennifer Tanner
Look Left Marketing
picus@lookleftmarketing.com