Case study

How an Enterprise Software Company Separates Real Risk from Theoretical Risk with Picus

Industry: Enterprise Software
Environment: Hybrid: on-premises, multiple cloud providers, and SaaS
Products: Security Control Validation (SCV)
Attack Path Validation (APV)
Attack Surface Validation (ASV)
Exposure Validation (EXV)
About: A global enterprise software company operating across on-premises infrastructure, multiple cloud providers, and SaaS. Its security team runs a continuous validation program aligned to MITRE ATT&CK and NIST frameworks, spanning tens of thousands of endpoints.

Challenges & Results

Challenge: Vulnerability data siloed from control effectiveness evidence

Result: Exposure Validation layers control evidence over CVE findings
Challenge: No continuous validation after the previous tool was retired

Result: Scheduled simulation campaigns across dev, QA, and production
Challenge: Fragmented visibility across on-prem, multi-cloud, and SaaS

Result: Asset inventory spanning tens of thousands of endpoints
Challenge: Old high-severity CVEs sitting unnoticed on active assets

Result: Half a dozen surfaced with evidence and pushed to remediation
Challenge: No proof of coverage against emerging threat campaigns

Result: 98 to 99 percent validated block rate on Windows endpoints
Challenge: Remediation queues driven by severity scores alone

Result: Prioritization ranked by what controls already block
Challenge: New threat campaigns moving faster than manual testing

Result: New threats simulated through a library updated within 24 hours

Executive Summary

A global enterprise software company ran security across on-premises infrastructure, multiple cloud providers, and SaaS. Vulnerability data lived in one place, control effectiveness in another, and no layer connected the two. After its previous simulation tool was retired, nothing continuously tested whether controls blocked real-world threats, and severity scores kept driving the remediation queue whether or not the controls already blocked the finding.

The team deployed Picus and connected the silos. Scheduled simulations now run across dev, QA, and production, asset inventory spans tens of thousands of endpoints, and Exposure Validation layers control evidence over CVE data. Windows endpoints proved a 98 to 99 percent block rate against emerging threat campaigns, and half a dozen old high-severity CVEs on active assets went straight to remediation.

The Challenge: Vulnerability Data and Control Evidence Never Met

The environment is genuinely hybrid, and that was the starting point of the problem.

Vulnerability scans produced findings in one system while control effectiveness lived in another, and no layer connected the two to drive prioritized remediation. After the previous simulation tool was retired, nothing continuously tested whether the controls in place would block real-world threats. Severity scores kept driving the queue, whether or not the controls already blocked the finding. The team needed remediation effort to rank by real, validated exposure, and continuous validation restored across the whole hybrid estate.

It’s a mix of quite a lot of things: on-premises, different cloud providers, SaaS. We wanted to understand how things actually look.

Senior Technology Specialist

The Solution: Connecting Exposures to the Controls That Block Them

Rather than treating vulnerabilities and controls as separate problems, the team used Picus to connect them: one platform where simulation evidence and exposure data meet, with every result mapped to MITRE ATT&CK.

Security Control Validation runs scheduled simulation campaigns across dev, QA, and production environments, using custom templates the team curates for emerging threat campaigns. Results feed back through native integrations with the EDR, firewall, and email security layers. Attack Surface Validation syncs asset inventory across tens of thousands of endpoints from the EDR, vulnerability scanner, and directory services. Exposure Validation then layers simulation evidence over CVE data, so remediation queues rank by validated exposure rather than severity scores alone.

Exposure Validation has come out pretty nicely in terms of feature set and speed of improvements, putting things in perspective. We have been able to draw quite some conclusions out of it.

Senior Technology Specialist

The Results: From CVE Lists to Validated Priorities

Windows endpoints proved a 98 to 99 percent block rate against emerging threat campaigns. Exposure Validation surfaced half a dozen older, high-severity CVEs sitting unaddressed on active assets, and the team pushed them straight to remediation with evidence attached.

The shift is in how remediation decisions get made. A severity score says how bad a vulnerability could be. Validation shows whether it is exploitable here, against the controls already deployed, so the queue ranks by what an attacker could actually use. Asset inventory now gives simulation results and vulnerability findings one shared foundation, turning validation output into structured evidence the team can act on.

There are at least half a dozen CVEs we were working with the respective teams to handle. They were older CVEs with higher score ratings, and they were just sitting out. It just can’t be explained why a 2021 CVE should exist at all on some assets. So we pushed them.

Senior Technology Specialist

Why the Team Chose Picus

The team found Picus before any formal evaluation was underway, through its threat research.

“The way I figured out the offering was, I had been reading some pretty good blog posts and fantastic analysis being done on different malware and ransomware families. That is where I found it.”

Senior Technology Specialist

Deep-dive analyses of active ransomware campaigns put the platform on the team’s radar, and the product kept it there: native integrations with the stack they already ran, new threats added to the simulation library within 24 hours, and an Exposure Validation layer that connected data nothing else connected.

“This is different than what we were expecting, but it looks compelling.”

Director of Cyber Security Threat Management, at the first demo

The Takeaway

A vulnerability list says what could be attacked. Control evidence says what is defended. Kept apart, they produce remediation queues full of theoretical risk and blind spots around real risk. Connecting them changes the question from how severe is this finding to can an attacker actually use it here. For a security team running a hybrid estate of tens of thousands of endpoints, that connection is what turned two silos into a single, prioritized picture of what holds and what needs fixing next.

What Our Customers Say

It is no different from a Magician. Ever since we took Picus into our inventory, it has helped significantly to increase our maturity level.

IT Security and Risk Management- Energy and Utilities Industry
Read more
Picus completes the task it is required to do perfect as a BAS solution. Threat database is up to date & updated frequently after a new malware or campaign.

IT Security Engineer - Banking
Read more
Using Picus, we can conduct risk analysis about possible attacks for their impact on people, processes and technology layers.

IT Manager - Healthcare and Biotech Industry
Read more
A very successful platform where we can test the accuracy of our security investments and see their scores.

Manager, IT Security and Risk Management - Manufacturing
Read more
Picus is very good attack simulation tool in overall. It shows all security vulnerabilities and guides..

Sr. Information Security & Risk Officer - Banking
Read more
There is a very nice team from which I can get quick support. The application provides us with great convenience and confidence in our work.

Information Security Specialist - Transportation
Read more
We've been using product for seven years. It's very useful and easily integrated with the network environment and security products.

System Engineer - IT Services
Read more
If you have a complex environment and not enough human resource, Picus will help you to prioritize your tasks with its extended detection capabilities.

IT Specialist - Insurance
Read more
We have been using Picus more than 1,5 years, we can truly say this product gives us every aspect of our protection. Its suggestions save our times and show us how we are ready for upcoming threats.

CIO - Banking
Read more
It helped us a lot in detecting faulty configurations and troubleshooting. It also gave us an idea about the investments we are planning to make.

IT Security and Risk Management - Retail
Read more

How an Enterprise Software Company Separates Real Risk from Theoretical Risk with Picus

Challenges & Results

Executive Summary

The Challenge: Vulnerability Data and Control Evidence Never Met

The Solution: Connecting Exposures to the Controls That Block Them

The Results: From CVE Lists to Validated Priorities

Why the Team Chose Picus

The Takeaway

What Our Customers Say

Latest Resources

Global Retail Group Replaces Legacy BAS with Picus for Red Teaming and Auto-Remediation

How a K-12 School District Gained Visibility into Attacks Its Defenses Missed

US Federal Agency Red Team Runs Assume-Breach Tests Across an Estate of Hundreds of Sites

Istanbul Sabiha Gokcen International Airport (ISG) Transforms Critical Infrastructure Security with Picus