G2

Rohit Y.

Cyber Security Analyst

Small-Business (50 or fewer emp.)

7/31/2025

"A Proactive Approach to Threat Readiness"

4.5/5

What do you like best about Picus Security?

Picus Security has introduced several new features to enhance efficiency, visibility, within Breach and Attack Simulation (BAS) operations:

1. Share Agent Logs

Previously, troubleshooting required remote access to endpoints where the Picus agent was installed in order to manually collect logs. With the Share Agent Logs feature, logs can now be directly downloaded from the Picus dashboard. This eliminates the need for remote sessions, saving time and simplifying support processes.

2. Manage Execution User

This feature enables organizations to create and manage multiple users with different privilege levels and use them during simulations. While performing endpoint attack simulations, you can select the specific user context under which the simulation will run.

This allows attacks to be executed from the perspective of different user types—such as standard or privileged users—making scenarios more realistic.

3. Network Attack-Only Mode

Previously, when endpoint security solutions such as EDR were active, the results of simulations often appeared combined, making it difficult to clearly identify which security control—network or endpoint—had taken action. To evaluate network security controls in isolation, it was necessary to disable or remove the EDR.

With the introduction of Network Attack-Only Mode, this limitation has been addressed. Users can now exclude endpoint security directly from the Picus portal, allowing them to simulate attacks focused solely on network controls. This provides clear, independent visibility into the effectiveness of network defenses without the need to remove or disable EDR, ensuring both accurate evaluation and continuous endpoint protection.

4. Enhanced Visibility

In environments with multiple network security controls and endpoint protection solutions, Picus now provides clear visibility into which control has blocked an attack. When integrated with SIEM platforms, this capability helps security teams evaluate the effectiveness of each layer in their defense architecture.

5. Expanded SIEM/EDR/XDR Integrations

Picus has broadened its integration capabilities with a wider range of OEM solutions. Review collected by and hosted on G2.com.

What do you dislike about Picus Security?

Picus Security could further improve detection accuracy, particularly in concurrent simulation scenarios. When the same attack simulation is executed simultaneously on multiple systems at a same time and if system is unable to find logs for the intended machine, it may fetch logs from another system instead, leading to incorrect attribution of results. Review collected by and hosted on G2.com.

What problems is Picus Security solving and how is that benefiting you?

Every organization implements a diverse set of security controls across various layers of their infrastructure. For instance:

-> Network layer: NGFWs, proxies

-> Data protection: DLP solutions

-> Endpoint: EDR tools

-> Web applications: WAFs

While these investments are essential, a critical question arises: How can we validate the effectiveness and readiness of these controls against emerging threats—especially those targeting our specific sector? Are the security policies configured correctly? Are they actually working as intended?

$ This is where Picus comes into play.

Picus offers a comprehensive threat library based on real-world TTPs (Tactics, Techniques, and Procedures) used by known threat actors. This enables us to:

-> Continuously assess whether our security controls—especially at the endpoint—are capable of detecting and preventing these behaviors.

-> Gain insights into visibility gaps across layers.

-> Validate control configurations against threat-specific scenarios.

By automating these assessments, Picus allows our security team to focus their efforts on higher-value tasks such as researching emerging threats and building custom detection rules. The platform also supports the creation and testing of specific TTPs, enabling ongoing evaluation of our detection and prevention capabilities in a proactive, controlled manner. Review collected by and hosted on G2.com.