How a Federal Credit Union Validates Its Security Stack Against Real-World Threats with Picus