Picus Security

Picus Security’s Security Validation Platform continuously tests an organization’s actual security controls against real adversary techniques mapped to MITRE ATT&CK, rather than relying on point-in-time penetration tests or assumed control coverage. It simulates attacks across endpoint, network, email, web, and cloud, shows which detection and prevention rules actually fire versus which gaps exist, and generates vendor-specific mitigation content (tuned rules or signatures for tools like Splunk, CrowdStrike, and Palo Alto Networks products) so teams can close the gaps it finds.

Founded in 2013 in Ankara, Turkey by Alper Memis, Volkan Erturk, and Suleyman Ozarslan, Picus later established its corporate headquarters in San Francisco while retaining a large engineering base in Ankara and additional offices in London and Singapore. The company raised a $45 million Series C in September 2024, led by Riverwood Capital with Bek Ventures participating, bringing total disclosed funding to roughly $80 million, and has grown headcount from about 268 in 2023 to roughly 315 by early 2026.

Picus publishes an annual ‘Red Report’ analyzing large volumes of real-world malware samples to identify the MITRE ATT&CK techniques attackers use most often, feeding that intelligence back into its simulation library. That gives it a credible research-driven identity versus breach-and-attack-simulation peers like SafeBreach and AttackIQ, though the broader BAS category is increasingly folded into vendors’ ‘continuous threat exposure management’ (CTEM) messaging industry-wide, making sustained differentiation harder over time.