Picus Security
Picus Security runs safe simulations of real attacks against a company's own defenses, then shows which ones its firewalls, endpoint tools and detection rules missed and what settings or signatures would stop them.
CyberReviewed Editorial Team · Updated · picussecurity.com
Company details
- Score
- 7.2/10Ranked 11 of 17
- Category
- Penetration testing
- Founded
- 2013
- Headquarters
- San Francisco, California
- Leadership
- Alper Memiş, co-founder and CEO
- Funding disclosed
- $80 million, including a $45 million Series C in 2024
- Pricing
- From $12,000 per year for AWS cloud auditing; control validation from $150,000 per year (AWS Marketplace)
- Best fit
- Large security teams that want proof their controls stop real attacks
Our take
Picus is a strong choice for large security teams that want continuous proof that the tools they have paid for block and detect current attacks. Its entry bundle costs $150,000 a year on AWS Marketplace, which puts it beyond most small companies.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 6.7 |
| Product scope and fit | 7.6 |
| Company durability | 7.9 |
| Evidence of adoption | 7.7 |
| Ease of adoption | 6.1 |
| Overall score (average of the five) | 7.2 |
Each criterion is defined on our methodology page.
Testing the defenses, not just the network
Picus runs breach and attack simulation, automated penetration testing and checks of detection rules across a company's separate security tools. It says it integrates with about 80 security vendors, whose alerts flow into one dashboard, so a team can see which simulated attacks its tools blocked or detected and which went unnoticed.1 Its latest platform also brings together vulnerability, attack simulation and attack surface data so teams can decide which exposures can really be exploited.2
Prices on AWS Marketplace
Picus does not publish prices on its own site, but its AWS Marketplace listing does. A 12-month Security Control Validation entry bundle, which tests how well a company's controls stop ransomware, costs $150,000. Cloud Security Validation for AWS costs $20,000 and Cloud Security Auditing for AWS $12,000 a year.3
Three mathematicians and a slow start
Alper Memiş, Volkan Ertürk and Süleyman Özarslan, friends from their university mathematics studies, founded Picus in Turkey in 2013. It ran without outside funding for its first five years and later moved its headquarters to San Francisco.1 In September 2024 it raised a $45 million Series C led by Riverwood Capital, with Earlybird Digital East, bringing total funding to $80 million. It then had more than 500 enterprise customers, including Mastercard, Visa, Vodafone and ING, and about 200 employees, and said revenue had tripled since 2022.12 The three founders still lead the company.4
How it compares with Horizon3.ai
Horizon3.ai's NodeZero tries to break into a network and shows the path it took. Picus asks a narrower question: when a known attack technique runs, does each security product block or detect it? Teams that buy both get the path an attacker could take and a list of which controls failed along the way.
Limits
Picus is priced and built for enterprise security teams; a small company without a SOC will get little from detection rule validation. Reviewers have asked for clearer analysis in its reports and for better pinpointing of which product failed in a test. It does not replace a signed report from a human tester where an auditor requires one.
What customers say
Quoted word for word from public reviews on PeerSpot and TrustRadius, retrieved October 22, 2026. Each quote links to the review or post it comes from.
Where it helps
I can simulate an attack into a live environment, testing whether my controls are operational and able to stop or mitigate attacks.
Attack vectors are mapped with existing vendors like Checkpoint and Mcafee, where you don't spend time finding out which cve mapped to which protection
Where it falls short
The reporting and data analysis could be improved. Specifically, the analysis of the results.
According to the attack vectors, you cannot specify which product is failing or which product is working well because there's no agent.
