Cybersecurity validation startup Picus Security Inc. today launched the Picus Autonomous Exposure Validation Platform, a system that merges breach and attack simulation, autonomous penetration testing and exposure validation into a single automated loop.

The platform is aimed at a question security teams struggle to answer when a critical vulnerability drops: Can this actually be exploited against the controls we already run? Picus argues that the gap has widened as artificial intelligence compresses the time between disclosure and attack, with attackers now weaponizing new bugs in hours against a backdrop of about 132 common vulnerabilities and exposures published each day.

At the core is a decision to converge three validation tools that usually ship separately. Picus Breach and Attack Simulation tests what an organization’s endpoint detection, security information and event management, firewall and web application firewall tools actually block and detect, then ships fixes and re-tests. Picus Autonomous Penetration Testing runs real exploit chains against reachable assets to show what an attacker can touch rather than what a severity score predicts.

The newest piece, Picus Exposure Validation, targets the vulnerabilities the other two cannot reach. It breaks each one into the exploit steps an attacker must execute, then runs that chain against a customer’s control stack to determine, asset by asset, whether the path succeeds and which control stops it. Picus said the check runs the moment a CVE is published and covers restricted assets and vulnerabilities that have no safe exploit for standalone penetration testing. When a patch is weeks out, it recommends a compensating control for each step in the chain.

The platform runs on Picus Swarm, a set of five specialist agents for discovery, exploitation, validation, mobilization and reporting orchestrated by an engine the company calls Numi AI. Customers set the autonomy level for each workflow step, from manual to supervised to fully autonomous, with audit trails on every action.

Picus pointed to enterprise results to support the launch. At a Fortune 100 financial services firm, a single simulation surfaced a 15-hour detection-logging lag in a leading extended detection and response tool that no dashboard had flagged. “We thought our detection coverage was solid and on paper it was,” the firm’s chief information security officer said, according to Picus. “Picus showed us a gap no dashboard had flagged and then proved it was closed once we fixed it.”

Across deployments, the company said customers doubled security control effectiveness within 90 days and cut mean time to remediation by 89%, with more than 75 integrations feeding the platform.

“Finding the exposure was never the hard part,” said Volkan Erturk, co-founder and chief technology officer of Picus. “The hard part is acting on the right issue: the defensible decision, the fix that closes the gap, and the evidence it worked.”

Picus is a venture capital-backed company that has raised $80 million over five rounds, including a round of $45 million in September 2024. Investors in the company include Riverwood Capital, Earlybird Digital East, Mastercard Inc. and Turkven Private Equity Fund Management Inc.

Image: Picus