Picus Security, the leading security validation company, gives organizations a clear picture of their cyber risk based on business context.
- Tweets 3,351
- Following 49
- Followers 2,947
- Likes 440
Pinned Tweet
Attackers do not care about CVSS scores.
100,000 vulnerabilities. The real risk hides in low-severity exposures that chain into a path to your crown jewels.
@volkanerturk on why attack path context beats severity scoring.
#SecurityValidation #ExposureManagement #CyberSecurity
1
3
395
Picus Connect made its latest stop in Milan. Partners and customers joined us to talk about where security validation is heading. Full tables and lively conversations. On to the next stop. #PicusConnect
57
Attack chains that took weeks now run in minutes with AI. Isaac Yeo shows how defenders can start first at National #Cybersecurity Connect 2026. Oct 28 at 15:30 on the Cyber Stage. Booth #D07.
Learn more: hubs.li/Q04C66Y20
65
We’re at the FS-ISAC 2026 Fall Summit in Austin, Oct 26-29. Meet our team at booth #25 to talk about closing the speed gap with AI-powered attackers. Book a meeting: hubs.li/Q04C66st0
#FSISAC #SecurityValidation
78
Risk-informed decisions on the grid start with knowing what your defenses stop. Rob Saland and Andrew Gazal brought that to #GridSecCon. Until the next one.
79
Malware download prevention fell from 71% to 50% in two years. VirusTotal now sees nearly 2 million new files a day. The Blue Report 2026 shows why IOC-based blocking needs technique-based backup. Read more: hubs.li/Q04Br8Fh0
1
1
97
Cybersecurity Awareness Month is about people. The defenses they rely on deserve a check too. Pick one recent attack technique. Run it safely against your controls. See whether it is blocked, logged or missed. #CybersecurityAwarenessMonth #SecurityValidation
100
HOLLOWGRAPH pulls its commands from Microsoft 365 calendar events dated 2050 through the Graph API. No attacker server carries that traffic. Read more: hubs.li/Q04Br8Dt0
#ThreatIntelligence #Microsoft365
169
A version number is an inventory fact. Evidence is what your controls did when the attack arrived. @su13ym4n on what php2shell taught us. Read more: hubs.li/Q04C7bt60
#PHP #SecurityValidation
1
139
For the technical side of php2shell, our breakdown covers both CVEs, the fixed versions and what to watch for in your logs. Read more: picussecurity.com/resource/p…
112
Level 1 is Human Speed. Level 2 is Mythos AI. See how long you last, then tag who'd last longer. Play now: picussecurity.com/exposure-r…
#ExposureRush
97
“Don’t approach this as just a tool investment. Approach it as a holistic security discipline.” Melike Ates of Istanbul Sabiha Gökçen Airport on making CTEM a practice the whole organization owns. Read more: hubs.li/Q04BqSQC0
#CTEM #CriticalInfrastructure
120
We’re at the FS-ISAC 2026 Fall Summit in Austin, Oct 26-29. Meet our team at booth #25 to talk about closing the speed gap with AI-powered attackers. Book a meeting: hubs.li/Q04BqXZ40
84
An attack path test stops at the first control that blocks it. Every control behind it goes untested in that run. Test each technique on its own to see what is prevented, detected or missed. Read more: hubs.li/Q04BqM170
#ExposureManagement #SecurityValidation
87
Your CLI may say PHP is patched while PHP-FPM still runs the old binary. Restart every worker and check the runtime behind each site for php2shell. Read more: hubs.li/Q04BYd0q0 #PHP #VulnerabilityManagement
2
2
321
Every game needs a power-up. In Exposure Rush, it's the one that tells you which exposures are actually exploitable before you spend hours on them.
Play the game: hubs.li/Q04BqML40
#ExposureRush
94
CISA warns about SafePay ransomware in advisory AA26-293A. The group has at least 600 victims. It often goes from first access to encryption within 24 hours. Read more: hubs.li/Q04BSCLW0 #Ransomware #StopRansomware
101
Start small with an automated pentesting tool. Test one critical app path in week one. Widen the scope once findings reach the right owner. By day 90, it runs on demand and re-tests every fix. Read more: hubs.li/Q04BqJB20
86
Setting up an internal red team raises practical questions. Tom Parker and Picus co-founder @su13ym4n work through methods, opsec, org fit, and detection testing with @DarkReading Thu Oct 22, 1 PM EDT.
Register: hubs.li/Q04BqFpD0
#RedTeam #Cybersecurity
106
BlueMoon needs three bugs in a row: a Chrome V8 type confusion (CVE-2026-85046), a V8 sandbox escape (CVE-2026-87491), and a Windows kernel flaw (CVE-2026-85880) that works only on older builds.
Read more: hubs.li/Q04Bqyhh0
#ThreatIntelligence #SecurityValidation
176
We’ll be at National Cybersecurity Connect 2026 in Jakarta, Oct 28-29, showing how Picus tells you within hours if you’re exploitable, whether your controls stop the attack, and how fast you can respond. Visit us at booth #D07, Bidakara Hotel. #Cybersecurity #SecurityValidation
108