Global Retailer Uses Picus for Continuous Attack Simulation and Automated IOC Blocking
Summary
A Picus case study says an unnamed global retailer replaced its legacy BAS with Picus, continuously tests controls across stores and servers, and routes unblocked IOCs through a SOAR playbook to its EDR for blocking.
Key points
- The retailer adopted Picus Breach and Attack Simulation after a proof of concept, replacing a legacy attack simulation tool.
- Picus BAS agents run across stores, Windows user machines, and Linux and Windows servers, measuring each environment against its own policies.
- Picus AI Threat Builder uses new threat intelligence to create simulations aligned with current attacker activity.
- A SOAR playbook sends IOCs that were not blocked to the EDR for blocking.
- The company says initial measurements established a baseline and identified control gaps with ready-to-apply mitigations.
- Simulation results map to MITRE ATT&CK, and reports are shared with relevant security teams and a quarterly security committee.
Article Details
- Topic
- A global retailer uses Picus for continuous security control validation and automated IOC remediation.
Vendors
Products
Picus AI Threat Builderto Linux and Windows servers, so every environment is measured against its own policies. Picus AI Threat Builder turns new threat intelligence into custom simulations, keeping tests in line with currentPicus Breach and Attack Simulation (BAS)After a proof of concept, the team moved to Picus Breach and Attack Simulation (BAS) and now runs its red teaming operations with Picus attack simulations, continuously, across every environment. Unblocked IOCs flow