Picus Security
@PicusSecurity

Picus Security, the leading security validation company, gives organizations a clear picture of their cyber risk based on business context.

picussecurity.com
Joined January 2013
You wouldn’t measure fitness by counting gym machines. Security works the same way. Check what your controls stop. #CybersecurityAwarenessMonth #SecurityValidation
67
Picus Connect made its latest stop in Milan. Partners and customers joined us to talk about where security validation is heading. Full tables and lively conversations. On to the next stop. #PicusConnect
106
Attack chains that took weeks now run in minutes with AI. Isaac Yeo shows how defenders can start first at National #Cybersecurity Connect 2026. Oct 28 at 15:30 on the Cyber Stage. Booth #D07. Learn more: hubs.li/Q04C66Y20
89
We’re at the FS-ISAC 2026 Fall Summit in Austin, Oct 26-29. Meet our team at booth #25 to talk about closing the speed gap with AI-powered attackers. Book a meeting: hubs.li/Q04C66st0 #FSISAC #SecurityValidation
84
Risk-informed decisions on the grid start with knowing what your defenses stop. Rob Saland and Andrew Gazal brought that to #GridSecCon. Until the next one.
89
Malware download prevention fell from 71% to 50% in two years. VirusTotal now sees nearly 2 million new files a day. The Blue Report 2026 shows why IOC-based blocking needs technique-based backup. Read more: hubs.li/Q04Br8Fh0
1
1
104
Cybersecurity Awareness Month is about people. The defenses they rely on deserve a check too. Pick one recent attack technique. Run it safely against your controls. See whether it is blocked, logged or missed. #CybersecurityAwarenessMonth #SecurityValidation
107
HOLLOWGRAPH pulls its commands from Microsoft 365 calendar events dated 2050 through the Graph API. No attacker server carries that traffic. Read more: hubs.li/Q04Br8Dt0 #ThreatIntelligence #Microsoft365
174
A version number is an inventory fact. Evidence is what your controls did when the attack arrived. @su13ym4n on what php2shell taught us. Read more: hubs.li/Q04C7bt60 #PHP #SecurityValidation
1
139
Level 1 is Human Speed. Level 2 is Mythos AI. See how long you last, then tag who'd last longer. Play now: picussecurity.com/exposure-r… #ExposureRush
98
“Don’t approach this as just a tool investment. Approach it as a holistic security discipline.” Melike Ates of Istanbul Sabiha Gökçen Airport on making CTEM a practice the whole organization owns. Read more: hubs.li/Q04BqSQC0 #CTEM #CriticalInfrastructure
120
We’re at the FS-ISAC 2026 Fall Summit in Austin, Oct 26-29. Meet our team at booth #25 to talk about closing the speed gap with AI-powered attackers. Book a meeting: hubs.li/Q04BqXZ40
85
An attack path test stops at the first control that blocks it. Every control behind it goes untested in that run. Test each technique on its own to see what is prevented, detected or missed. Read more: hubs.li/Q04BqM170 #ExposureManagement #SecurityValidation
87
Your CLI may say PHP is patched while PHP-FPM still runs the old binary. Restart every worker and check the runtime behind each site for php2shell. Read more: hubs.li/Q04BYd0q0 #PHP #VulnerabilityManagement
2
2
321
Every game needs a power-up. In Exposure Rush, it's the one that tells you which exposures are actually exploitable before you spend hours on them. Play the game: hubs.li/Q04BqML40  #ExposureRush
97
CISA warns about SafePay ransomware in advisory AA26-293A. The group has at least 600 victims. It often goes from first access to encryption within 24 hours. Read more: hubs.li/Q04BSCLW0 #Ransomware #StopRansomware
102
Start small with an automated pentesting tool. Test one critical app path in week one. Widen the scope once findings reach the right owner. By day 90, it runs on demand and re-tests every fix. Read more: hubs.li/Q04BqJB20
86
Setting up an internal red team raises practical questions. Tom Parker and Picus co-founder @su13ym4n work through methods, opsec, org fit, and detection testing with @DarkReading Thu Oct 22, 1 PM EDT. Register: hubs.li/Q04BqFpD0 #RedTeam #Cybersecurity
106
BlueMoon needs three bugs in a row: a Chrome V8 type confusion (CVE-2026-85046), a V8 sandbox escape (CVE-2026-87491), and a Windows kernel flaw (CVE-2026-85880) that works only on older builds. Read more: hubs.li/Q04Bqyhh0 #ThreatIntelligence #SecurityValidation
177
We’ll be at National Cybersecurity Connect 2026 in Jakarta, Oct 28-29, showing how Picus tells you within hours if you’re exploitable, whether your controls stop the attack, and how fast you can respond. Visit us at booth #D07, Bidakara Hotel. #Cybersecurity #SecurityValidation
108
In your next triage meeting, start with findings that sit on a path an attacker could follow to a mission system, because fixing one link there closes a real route. Join the @AFCEA panel we're sponsoring, Oct 21 at 10 AM ET: hubs.ly/Q04Bp_Wp0 #Pentesting
1
110
SAMA CSF expects maturity Level 3 or higher, where controls must be demonstrable, and Level 4 adds measured effectiveness. Time-stamped results from testing controls against real attack techniques give you both. Learn more: hubs.li/Q04Bp-yc0
1
113
On-prem, multi-cloud, SaaS. One security team needed to know which vulnerabilities actually posed a risk. With Picus, it verified a 98–99% block rate on Windows endpoints and flagged overlooked CVEs for remediation. Customer story → hubs.li/Q04zRvYr0
114
Red teaming should go beyond proving that an exploit works. Join @tomwparker and @su13ym4n to discuss how to build an internal red team that runs realistic adversary simulations and tests detection and response. Register for the @DarkReading webinar: hubs.li/Q04zL5xC0
1
133
Every fix your team finishes is work worth protecting. Before you close the ticket, safely re-run the attack and confirm the control stopped or detected it. @AFCEA's "Find, Fix, Verify" webinar, which we're sponsoring, is on Oct 21 at 10 AM ET: hubs.li/Q04z-YbY0
1
126
AI in cybersecurity set the agenda at IT Solutions Day 2026 in Mexico City. As a Gold Sponsor, we took it to the attacker side with Francisco Espinosa’s talk and a live demo that drew a crowd. Thanks to @MapsDisruptivo for hosting. Until the next one!
1
96
338M+ attack simulations examined. 69% overall prevention. Just 37% of post-compromise attacker actions blocked. See what the Blue Report 2026 reveals about enterprise defenses. Download the report → hubs.li/Q04zRv-t0
94
98% of reviewers would recommend Picus. We're a 2026 Gartner® Peer Insights™ Customers’ Choice for Adversarial Exposure Validation, with a 4.8/5 overall rating (June 2026). Read the announcement → hubs.li/Q04zRvNv0
1
145
With a small team and a growing findings list, ask which ones an adversary could use against you today. Fixing those first puts your team's time where it cuts the most risk. We're sponsoring the @AFCEA webinar on this, Oct 21, 10 AM ET: hubs.li/Q04z-Xp90
1
142
35,364 CVEs in six months. Exposure Rush gives you 35 exposures and 180 analyst hours. Patch. Mitigate. Accept. Severity and EPSS help. Neither tells you what attackers can actually exploit in your environment. See how far the scores get you: hubs.li/Q04zRvMb0
100
The demo screen at Booth P26 drew a crowd on day two of #GovWare2026. Tomorrow is our last day in Singapore, so come see how Picus proves what an attacker can actually reach: hubs.li/Q04B5YH40
92
Picus’s Sıla Özeren Hacıoğlu explains what agentic pentesting proves and how to test beyond its reach in @TheHackersNews. Read the article → hubs.li/Q04zRvPf0
122
Day one of #GovWare2026 is in the books, and the Picus team at Booth P26 spent it showing what attackers can actually exploit and which controls stop them. We’re here through 15 Oct. Book a meeting: hubs.li/Q04z-X4b0
97
Picus offers local hosting on AWS in #Singapore. Run attack simulations and pentests while keeping customer data in-country. Details → hubs.li/Q04zRvDb0
115
And just like that, we’re back from Picus Getaway 2026. These photos are just a glimpse. The real thing? Even better ✨ For the sixth time, Picusers from 18 countries around the world came together for a few days we look forward to all year. Joining from across the world, we stepped away from our screens and into the same place for a few very good days. There’s a little bit of magic in that. From the Picus World Cup to the Picus Block Party, these past few days brought plenty of energy, friendly competition, and a lot of moments we’ll be talking about for a while. To be exact, probably until the next one. #PicusSecurity #PicusGetaway #LifeAtPicus
1
188
Not every exposure should be tested the same way. Meet Soon Bock Loh at #GovWare2026 to see when to validate with a live exploit chain and when to prove exploitability without firing one. Learn more: hubs.li/Q04z6h690
1
1
137
The VPN is legitimate. The access isn’t. CISA details how Chinese government-linked attackers use legitimate VPN software to maintain access and steal data. Read the breakdown → hubs.li/Q04zRvjM0 #ThreatIntelligence
156
Vidar keeps changing. Recent research from Zscaler @Threatlabz shows new VM-based obfuscation and per-build stream ciphers designed to make analysis harder. Our Picus Labs research breaks down how Vidar steals data, evades analysis, and operates. Read more: hubs.li/Q04z61TK0
1
159
An annual pentest leaves you blind for 365 days, so meet Isaac Yeo at #GovWare2026 to map a 90-day plan that shrinks that window to hours. Book a session with Isaac: hubs.li/Q04z61HG0 #GovWare2026
99
Automated pentesting is not the whole CTEM Validation stage. It proves exploitability where live attacks are safe. BAS tests whether controls stop and detect the attack. Exposure validation covers what live exploitation cannot. Validate → decide → fix → re-validate. That’s the loop. Read more: hubs.li/Q04z61BV0
124
A CVE drops at 08:00 with no patch and no exploit. 20 assets match. By 18:00 the attacker shows up and nothing happens. Picus shows the full day live at The Validation Summit ’26 on Oct 14 at 1 PM ET or Oct 15 at 11 AM BST. Save your seat: hubs.li/Q04z5-390
131
Remcos RAT is still active in 2026. Recent campaigns use phishing, fileless loaders, process hollowing, and steganography to deliver it. Our analysis breaks down what happens next, from persistence and injection to credential theft, surveillance, and C2. Read more: hubs.li/Q04ynM0L0
108
80% of APAC breaches start with system intrusions, and attackers now weaponize new exposures in hours. Meet Ye Xin Leow at #GovWare2026 to see how Picus finds the exposures that actually matter. Meet Ye Xin at GovWare: hubs.li/Q04z5Z-20
109
Overall prevention rose to 69% in 2026. Stealth went the other way, falling from 53% to 47% and becoming one of only two ATT&CK tactics to decline. Quiet attacker behavior is still proving much harder to stop. Read the full report: hubs.li/Q04z5ZYX0
100
AI is shrinking the exposure window. @Frost_Sullivan research shows that attackers can chain low-severity weaknesses, operate across the kill chain, and exploit exposures within minutes. That is pushing security from periodic testing toward continuous, exploitability-first validation. Watch now👇 #Cybersecurity #AI
1
124
Preparing for India’s #DPDPA means proving that the safeguards protecting personal data work. Our guide covers how to test controls, validate detection, prioritize exploitable gaps, retest fixes, and keep evidence for audits and breach response. Read the guide: hubs.li/Q04z5ZVT0
106
The old pace no longer works. At The Validation Summit ’26, @mikko opens with what has changed as AI speeds up attacks and why defenders need validation that can keep pace. Register now: hubs.li/Q04z5ZNC0
97
98–99% block rate on Windows endpoints. Older high-severity CVEs surfaced for remediation. That’s what changed when this enterprise software company connected vulnerability data with control evidence in Picus. Customer story: hubs.li/Q04z5ZJm0
104
Meet Pengfei Yu, our Solution Architect, at #GovWare2026 and see how Picus tests what your EDR, SIEM, and firewall actually stop, across 75+ integrations. Booth P26, 13 to 15 Oct, Singapore: hubs.li/Q04z5ZJv0
119
Meet Zane Lim, our VP of Sales for APAC, at #GovWare2026 and see how Picus proves which exposures attackers can reach and whether your controls stop them. Booth P26, 13 to 15 Oct, Singapore: hubs.li/Q04ynNJ10
130
Alex San Miguel, Tomás Maldonado, and David B. Cross join The Validation Summit ’26 to share how they are preparing for AI-speed attacks. What they changed. What they stopped doing. What broke along the way. Oct. 14 or 15: hubs.li/Q04ykPfx0
142
Easy to deploy. Clearer priorities. Istanbul Sabiha Gökçen International Airport used Picus to bring security data together, focus on genuinely exploitable risks, and act faster. Read the case study: hubs.li/Q04ynN_M0
169
Red teaming should go beyond finding weaknesses. Join @tomwparker and Picus Co-founder @su13ym4n on Oct. 22 to explore how effective red teams use realistic adversary simulation to test detection and response and drive real improvements. Register on @DarkReading: hubs.li/Q04ynMLJ0
1
150
Healthcare has a visibility problem. It logged just 50% of simulated attacks, the lowest rate of any industry, even as its alert score improved to 22%. Better detection rules cannot catch attacker behavior that never reaches telemetry. Read the analysis: hubs.li/Q04ykMc20 #HealthcareSecurity
1
107
Agents move at machine speed. You still decide what they do alone. Picus validates every exposure on signal, with a full audit trail and your team in command. #GovWare2026 | Booth P26 | 13 to 15 Oct hubs.li/Q04ynNxt0
130
98% of reviewers would recommend Picus. Based on 154 reviews, the most responses among AEV vendors included in the 2026 Gartner® Peer Insights™ Voice of the Customer. See the full report: hubs.li/Q04ykKYS0
112
“Attackers are letting AI COOK! Defenders are still validating findings quarterly.” @ronaldeddings of @TheHackerValley puts the gap plainly. Join Ron, Mikko Hyppönen, and security leaders at The Validation Summit ’26 on Oct. 14 or 15. Read more: hubs.li/Q04ykGlZ0
114
Quiet attacker activity is still getting through. The Blue Report 2026 found that discovery and collection were blocked just 1 time in 10. See what 338M attack simulations reveal about defenses after access. Download the Blue Report 2026 → hubs.li/Q04ykH9f0
1
1
118
Load more