US Federal Agency Red Team Runs Assume-Breach Tests Across an Estate of Hundreds of Sites
Challenges & Results
Challenge: Hundreds of sites in one domain, a small team to cover them
Result: Autonomous pentesting that scales across hundreds of sites
Challenge: Post-compromise paths untested from a real foothold
Result: Attack paths validated by execution from a real foothold
Challenge: No evidence of how far an attacker could move from a foothold
Result: Runs showed both successful and unsuccessful lateral movement attempts
Challenge: Pentest findings are hard to act on across hundreds of sites
Result: A clear attack map from every autonomous pentesting run
Executive Summary
A US federal agency protects hundreds of sites nationwide, all in one Active Directory domain, with a security engineering team. Its detection engineers had run Picus Breach and Attack Simulation for over a year. Then the four-person red team took on a different question: once an attacker has a foothold in one site, how far can they get?
In summer 2026 the red team began gray-box, assume-breach assessments, one site at a time. From a single foothold, each run chains attacker techniques to map the attack paths available and prove which exposures are exploitable, covering credential exposure, privilege escalation, and lateral movement. Every run ends with an attack map and remediation guidance.
The Challenge: Hundreds of Sites, The Solution: Assume-Breach Assessments With Autonomous Pentesting
The agency’s estate is one Active Directory domain, with each site organized as an organizational unit rather than a separate domain, so a foothold at any one site sits inside the same directory as every other.
“It’s one giant domain.”
Offensive Security Engineer, US Federal Agency
The detection engineering team had validated controls with BAS for more than a year. The red team needed to see what happens after initial access, site by site, without the people to do it by hand across the whole estate.
The team focused on two priorities: testing what an attacker could do from a foothold inside a site, under an assume-breach model, and scaling testing across hundreds of sites so the red team can focus more on work that needs creativity and deeper thinking.
We’re hoping to do this all automatically because otherwise we’re talking hundreds of sites and we only have a staff of three to manage it. So if all of them want to try it and set something up, it could be a real headache.
Senior Security Engineer
The Solution: Assume-Breach Assessments With Autonomous Pentesting
Rather than adding another tool, the agency extended the Picus Platform it already ran to the red team, with Picus Autonomous Penetration Testing.
Each assessment is gray-box: supplied credentials stand in for a compromised user, and the scope is one site’s IP range. The run starts from a stager on a dedicated host and chains techniques from that foothold toward the rest of the domain. Afterward, the team reviews the attack map, then triages which sites were touched, notifies the SOC, and sends remediation guidance to the site owner.
We’re getting ready to bring our red team on to use the tool a lot more. Not just our detection engineering team.
Senior Security Engineer
The Results: Evidence of What a Foothold Can Reach, and What Stops It
Across the assessments run in summer 2026, the red team worked site by site from an assumed foothold. Each run produced an attack map of every step it completed, which the team reviewed against SIEM and directory logs, triaged, and turned into remediation guidance for the site owner. Anything that needed action went to the owner through the agency’s normal process, with the evidence attached.
For every site assessed, the agency now holds evidence of what an attacker could do from inside that site, in place of an assumption, together with a site-by-site view of how monitoring responded during the test. Both feed the central team’s planning for the next sites and the detection engineers’ rule work.
Detection engineering keeps running breach and attack simulations on a tracked cadence, with results on SIEM dashboards the team built. Each run produces the per-host evidence its exposure and impact tiers ask for. Next, the agency plans to let a site request an assessment through a ticket, with orchestration handling the setup and the run.
We want sites to be able to run simulations as a service. They would go to ServiceNow, submit a ticket request, and then we would use some orchestration to install the Picus agent and initiate the execution of that simulation.
Automation Team Lead, US Federal Agency
What Our Customers Say
It is no different from a Magician. Ever since we took Picus into our inventory, it has helped significantly to increase our maturity level.
IT Security and Risk Management- Energy and Utilities Industry
Picus completes the task it is required to do perfect as a BAS solution. Threat database is up to date & updated frequently after a new malware or campaign.
If you have a complex environment and not enough human resource, Picus will help you to prioritize your tasks with its extended detection capabilities.
We have been using Picus more than 1,5 years, we can truly say this product gives us every aspect of our protection. Its suggestions save our times and show us how we are ready for upcoming threats.
.png?width=734&height=464&name=picus-Global-Retail-Group-CaseStudy-Preview%20(1).png)
