Picus Security

Picus Security is a cybersecurity company that specializes in Breach and attack simulation (BAS) and continuous security validation. It is headquartered in Wilmington, Delaware.

Picus Security was founded in 2013 in Ankara, Turkey, by H. Alper Memiş, Volkan Ertürk, and Süleyman Özarslan who identified a need for organizations to gain real-time visibility into their security posture, moving beyond periodic assessments such as Penetration testing.^[1][2] Originally based in Ankara, Turkey, Picus later relocated its headquarters to San Francisco, California.^[1]

In 2019, Picus received a $5 million investment in a Series A round led by Bek Capital, formerly Earlybird Venture Capital, following an earlier seed round of $1.7 million.^[3][2]

In 2021, Picus raised $24 million in Series B funding from Turkven, Earlybird, and Nathan Dornbrook.^[4][5] A year later, in 2022, Mastercard acquired a minority stake in Picus and integrated Picus’ technology into its "Cyber Front" platform.^[6]

In 2024, Picus completed a $45 million Series C funding round led by Riverwood Capital.^[7][8][9]

Picus Security’s platform continuously assesses cybersecurity controls through automated breach and attack simulations (BAS).^[1] It identifies security gaps, evaluates prevention and detection systems, and provides vendor-specific mitigation recommendations.^[2] Picus Platform includes Exposure Validation, Security Control Validation, Attack Surface Management, Attack Path Validation, Detection Rule Validation and Cloud Security Validation.^[10][4]

Picus launches two annual reports, Picus Red Report and Picus Blue Report.^[11] Picus’ Red Report 2023 uses data from malware samples to identify common MITRE ATT&CK techniques, integrating these findings into the platform's threat library to reflect current attacker behaviors.^[12]

In 2023, Picus added a Continuous Threat Exposure Management module that correlates vulnerability, configuration and attack-path data to give CISOs a quantified view of risk and a prioritised remediation roadmap.^[13]

In 2024, Picus added the Numi AI feature, allowing users to query security validation data through natural language to support decision-making in security operations.^[14]

In 2025, Picus launched Exposure Validation, a system that assesses which vulnerabilities are exploitable in an organization’s environment by testing defenses against real-world attack methods and assigning context-aware risk scores.^[15]