Alper Memiş

Mathematics, Finance and Risk

He studied mathematics, and while his friends from those years went into cyber defense and academia he moved toward business and finance, according to TechCrunch. Picus's leadership page says he held strategy, risk management and treasury management roles in government institutions and global companies, earned an MBA at Boston University, became a Chartered Financial Analyst and published academic work on treasury management.

An Idea Among Three Friends

His co-founders, Volkan Ertürk and Süleyman Özarslan, had been his friends since university. Ertürk went into cyber defense and Özarslan became an academic. They kept in touch, and in 2013 the conversation turned to a business. We liked to exchange ideas about what might be the next big thing, he told TechCrunch.

Ertürk described a large project that seemed to be configured correctly but was breached a month later. Özarslan argued that a system that keeps changing has to be tested all the time. Memiş brought the habit of finance, where firms run constant simulations to predict the results of their decisions. The three built Picus around that idea. Outside funding was slow to come for a Turkish security startup in 2013, and they ran it without investors for its first five years.

Selling Continuous Validation

He describes the problem Picus set out to fix as companies buying security on faith. In a 2025 Q&A with citybiz he said: Most organizations acted on assumptions back then. They bought new security tools but could not measure their effectiveness. Annual penetration tests and scans, he argued, give only a snapshot and leave teams with false confidence.

In September 2024 Picus raised a $45 million Series C led by Riverwood Capital, bringing its total to $80 million. It then had more than 500 enterprise customers and about 200 employees. He told TechCrunch that every security vendor has its own way of measuring risk: The holy grail is creating a connection between them. In the company's announcement he said that Enterprises are looking for a more effective approach than their legacy vulnerability management practices.

What the Red Report Found

Picus publishes a yearly study of attack techniques, the Red Report. Discussing the 2025 edition with citybiz, he singled out malware that steals saved passwords: Most worrying is a threefold increase in credential-stealing malware, targeting password managers and vaults and handing attackers the keys to an organization's entire network. The report found that 93% of malicious activity relied on just 10 techniques, which he argues lets companies focus their testing on the attacks they are most likely to face.