Case study

Global Retail Group Replaces Legacy BAS with Picus for Red Teaming and Auto-Remediation

Challenges & Results

Challenge: Red team exercises delayed for months by procurement

Result: Current attacker techniques simulated in-house, continuously
Challenge: No measured baseline for endpoint protection

Result: Endpoint protection measured, with ready-to-apply mitigations for each gap
Challenge: An IOC automation that wasn’t working well

Result: Unblocked IOCs now go to the EDR automatically for blocking
Challenge: Threat intelligence with blind spots

Result: Picus AI Threat Builder adds data the intelligence team sometimes did not have
Challenge: Validation results that stayed with one team

Result: Findings shared across teams and the security committee

Executive Summary

A global retailer with stores, an online shop and thousands of servers relied on outside red team exercises, which were commonly delayed by months in legal and procurement reviews. Its older attack simulation tool sat alongside single-purpose products and did not work well with its endpoint protection or its IOC automation.

After a proof of concept, the team moved to Picus Breach and Attack Simulation (BAS) and now runs its red teaming operations with Picus attack simulations, continuously, across every environment. Unblocked IOCs flow automatically into the EDR for blocking, and AI Threat Builder keeps simulations in line with the latest attacker techniques.

The Challenge: Delayed Red Team Exercises, No Unified View, Broken Automation

Security is split across specialist teams, from email and web to endpoint protection on thousands of servers, with no single view of how their controls held up against real attacks. The incumbent breach and attack simulation tool did not run smoothly alongside the EDR, and an earlier IOC automation was also not working well.

“We had an automated process that was being executed. It was not functioning very well.”

Platform Owner

The team focused on two priorities: testing the controls already in place against the latest attacker techniques without waiting on a procurement cycle, and turning every unblocked threat into an action the right team, or an automation, can take.

It is common for a red team exercise planned for February to be postponed until June due to delays in legal and procurement reviews. This represents a loss of time in testing tactics currently employed by attackers in real-time.

Cybersecurity Lead, Global Retail Group

The Solution: Continuous Validation Against Today’s Attacks

The team ran a proof of concept to test whether Picus was mature enough to replace its incumbent tool, then deployed Picus Breach and Attack Simulation (BAS).

The team deployed Picus BAS agents across each environment, from stores and Windows user machines to Linux and Windows servers, so every environment is measured against its own policies. Picus AI Threat Builder turns new threat intelligence into custom simulations, keeping tests in line with current attacker activity. A SOAR playbook takes every IOC that was not blocked and adds it to the EDR for direct blocking. Results reach the relevant security teams, and reports are pulled through the API for internal use.

The IOC automation that once fell short now runs end-to-end.

They download all IOCs that have not been blocked and automatically add them to the EDR for direct blocking. This part is complete.

Platform Owner

The Results: Continuous Validation and Red Teaming, Clear Gaps, Automated Fixes

The first measurements gave the endpoint team a clear baseline to work from, showing which gaps to fix, with ready-to-apply mitigations for each.

The response loop now runs without hand-offs. Every IOC that Picus shows was not blocked flows through the SOAR playbook into the EDR for direct blocking, taking over from the earlier IOC automation that had not worked well.

Measuring each environment against its own policies keeps every team focused on its own gaps.

“The idea is to try to have a metric for each environment because each environment has its own different policies.”

Platform Owner

Picus AI Threat Builder also adds threat data that the intelligence team sometimes did not have.

Every simulation result maps to MITRE ATT&CK, the team’s second priority after security control validation, and reports pulled through the API reach relevant security teams that own each control, as well as the quarterly security committee.

Instead of waiting months for a red teaming exercise, the organization now continuously tests its controls against today’s attackers.

For us, security control validation is the number one objective. But after that, I will say the MITRE ATT&CK framework.

Cybersecurity Lead, Global Retail Group

What Our Customers Say

It is no different from a Magician. Ever since we took Picus into our inventory, it has helped significantly to increase our maturity level.

IT Security and Risk Management- Energy and Utilities Industry
Read more
Picus completes the task it is required to do perfect as a BAS solution. Threat database is up to date & updated frequently after a new malware or campaign.

IT Security Engineer - Banking
Read more
Using Picus, we can conduct risk analysis about possible attacks for their impact on people, processes and technology layers.

IT Manager - Healthcare and Biotech Industry
Read more
A very successful platform where we can test the accuracy of our security investments and see their scores.

Manager, IT Security and Risk Management - Manufacturing
Read more
Picus is very good attack simulation tool in overall. It shows all security vulnerabilities and guides..

Sr. Information Security & Risk Officer - Banking
Read more
There is a very nice team from which I can get quick support. The application provides us with great convenience and confidence in our work.

Information Security Specialist - Transportation
Read more
We've been using product for seven years. It's very useful and easily integrated with the network environment and security products.

System Engineer - IT Services
Read more
If you have a complex environment and not enough human resource, Picus will help you to prioritize your tasks with its extended detection capabilities.

IT Specialist - Insurance
Read more
We have been using Picus more than 1,5 years, we can truly say this product gives us every aspect of our protection. Its suggestions save our times and show us how we are ready for upcoming threats.

CIO - Banking
Read more
It helped us a lot in detecting faulty configurations and troubleshooting. It also gave us an idea about the investments we are planning to make.

IT Security and Risk Management - Retail
Read more