Case study

How a K-12 School District Gained Visibility into Attacks Its Defenses Missed

Industry: Education (K-12)
Products: Breach and Attack Simulation (BAS)
Autonomous Penetration Testing
About: The organization is a public K-12 school district in the US. Its small security team protects students, staff, and district systems under an annual cybersecurity audit, with NIST-aligned reporting to district leadership and the school board. It has run Picus since 2024.

Challenges & Results

Challenge: One pentest a year, set by budget

Result: Continuous validation between annual assessments
Challenge: Limited visibility into endpoint effectiveness

Result: Measurable, validated protection across every endpoint
Challenge: CVE patches with no second line of defense

Result: Vendor-specific rule deployed alongside the patch
Challenge: New threat reports with no quick way to test them

Result: AI Threat Builder turns latest threat intel into simulations
Challenge: Findings are hard to show to leadership

Result: Clear findings with fix verification through retesting, ready for the executive sponsor

Executive Summary

A US public school district protects students, staff and systems with a small security team and a budget that covers one penetration test a year. It runs two EDR platforms side by side, and the security specialist’s worry was simple: what isn’t alerting?

With Picus Breach and Attack Simulation (BAS), the team tests endpoints and the network continuously against current threats, including campaigns aimed at education, and deploys the vendor-specific fixes Picus provides. Simulations quickly highlighted where endpoint controls needed tuning, and an Autonomous Penetration Testing trial surfaced potential attack paths, which the team promptly closed and verified through re-testing.

The Challenge: Two EDRs, but What Gets Through?

The district runs two EDR platforms side by side, along with a next-generation firewall. Each produces its own alerts, and neither shows what the other missed. Between annual penetration tests, there was no consistent way to confirm which attacks would be blocked, which would be seen, and which would get through.

The team focused on two priorities: testing both EDRs and the firewall against current, real-world techniques continuously, not once a year, and turning each finding into a fix the team can deploy, re-test and show to leadership.

One of the fears I have when we see alerts is what is it not alerting? What are we not seeing? Because we’ve had times where one tool will catch something but the other didn’t even alert on it. And vice versa.

Information Security Specialist, US Public K-12 School District

The Solution: Testing Both EDRs Continuously, Fixing What Gets Through

Rather than adding another security control tool to the stack, the team used Picus Breach and Attack Simulation (BAS) to test the ones it already ran.

With Picus BAS, the district continuously simulates the latest endpoint and network threats across its Windows 10, Windows 11 and Windows Server agents, including those used by threat groups known to target the education sector. When a simulation is not prevented, the team applies the vendor-specific mitigation rule Picus provides to the EDR, re-runs the test to confirm it is now blocked, and compares results over time to catch any drift. AI Threat Builder extends this coverage by turning the latest threat intelligence into custom simulations, so testing keeps pace with the evolving threat landscape.

Documentation of Picus is really good. It helped me catch up to speed pretty quick.

Information Security Specialist

The Results: Findings the Team Could Fix, Re-Test and Show

Picus detection analytics correlate EDR and firewall alerts with each simulation, so the team can see which attacks were blocked, which were only detected or logged, and which were missed entirely. With that visibility, early runs showed how prevention varied across endpoints, and Picus provided vendor-specific mitigations to close the gaps in the team’s security controls.

For example, when a Notepad++ CVE was disclosed, the team ran the simulation, deployed the matching vendor-specific rule, and updated the software.

“It was just kind of more of a double coverage. You had a preventative control in place along with your actual patching.”

Information Security Specialist

The results are also easy to share. PDF summaries go to leadership and CSV detail to the technical team, and the specialist has walked the executive sponsor through a full cycle live: simulate, deploy the rule, re-run, confirm.

“I can deploy it, let it run, show we patched and it’s no longer exploitable.”

Information Security Specialist

For a small district team with one pentest a year, that is the difference between hoping a control works and showing it does.

Being able, after the fact, to go and look at, okay, this is where we could have prevented this. This is what we can put in place through Picus to be able to prevent it.

Information Security Specialist, US Public K-12 School District

What Our Customers Say

It is no different from a Magician. Ever since we took Picus into our inventory, it has helped significantly to increase our maturity level.

IT Security and Risk Management- Energy and Utilities Industry
Read more
Picus completes the task it is required to do perfect as a BAS solution. Threat database is up to date & updated frequently after a new malware or campaign.

IT Security Engineer - Banking
Read more
Using Picus, we can conduct risk analysis about possible attacks for their impact on people, processes and technology layers.

IT Manager - Healthcare and Biotech Industry
Read more
A very successful platform where we can test the accuracy of our security investments and see their scores.

Manager, IT Security and Risk Management - Manufacturing
Read more
Picus is very good attack simulation tool in overall. It shows all security vulnerabilities and guides..

Sr. Information Security & Risk Officer - Banking
Read more
There is a very nice team from which I can get quick support. The application provides us with great convenience and confidence in our work.

Information Security Specialist - Transportation
Read more
We've been using product for seven years. It's very useful and easily integrated with the network environment and security products.

System Engineer - IT Services
Read more
If you have a complex environment and not enough human resource, Picus will help you to prioritize your tasks with its extended detection capabilities.

IT Specialist - Insurance
Read more
We have been using Picus more than 1,5 years, we can truly say this product gives us every aspect of our protection. Its suggestions save our times and show us how we are ready for upcoming threats.

CIO - Banking
Read more
It helped us a lot in detecting faulty configurations and troubleshooting. It also gave us an idea about the investments we are planning to make.

IT Security and Risk Management - Retail
Read more