Security Engineer at a tech services company with 201-500 employees
Real User
Apr 11, 2024
To improve, Picus Security could consider establishing a data center in India to address trust issues and increase interest from Indian customers, potentially boosting revenue.
Cybersecurity Customer Service Manager and Technical Account Manager at Cybersel
Reseller
Jul 26, 2023
The reporting and data analysis could be improved. Specifically, the analysis of the results. Along with the data analytics, Picus Security should improve its attack path validation feature. In future releases, I would like to see an adaptive analysis of the company's perimeter. The attack surface analysis feature would be a good point to introduce in the platform. Moreover, there is room for improvement in terms of scalability. Automating some processes could make it even better.
Cybersecurity Operations Engineer at a tech services company with 201-500 employees
Real User
Top 20
May 9, 2022
According to the attack vectors, you cannot specify which product is failing or which product is working well because there's no agent. The best case scenario is to add an agent solution where an agent would have the ability to actually detect which programs aren't working. For the attack software, you put a peer on the cloud site, and you have another peer internal network. There is IPS, firewall, WAF, and DBS amongst these peers. The cloud's peer is trying to send the attack file to the internal network. Maybe the firewall is blocking it, maybe the IP, maybe the WAF, but you cannot see the details. You can say, "Yes, my security product is blocking that attack scenario," or, "I cannot block this attack."
Solutions Architect Cybersecurity at a tech vendor with 11-50 employees
Reseller
Dec 13, 2020
Picus tells you that an attack has bypassed your security controls, but it doesn't tell you exactly where, or on which device the attack has been bypassed. I think that is one of the key components or features that is missing in the product, which requires some sort of enhancement. It doesn't provide patches automatically. It sends an update to the vendor, and the vendor will release the patch for you. If it allows or creates any sort of patch using Artificial Intelligence Modelling Language (AIML), it identifies the pattern of the signature and creates some sort of signature that will promptly block the attack, which will be most helpful as well. There are competitors of Picus which have been performing well. We have actually struggled to sell Picus in the market here because there are key enhancements that need to be implemented in the product. Especially the one where it has to identify which device has the loophole. Let's say if a customer's environment has 10 security devices and they need to know that there is an attack that has bypassed their devices, they cannot go and inspect every device and every rule in their security devices. They need to know exactly where that attack has been bypassed so that they can mitigate that weak link. That is one of the key aspects. Picus Security has competitors that are performing better. I'm not sure why we haven't assessed another product. Perhaps it is because they keep updating their rule sets. They're coming up with new features, and they are adding more UAB features to their products. There are a lot of other products, which are performing better. As far as Picus is concerned, we have been aggressively trying to reach out to customers to try to sell it, but have not been successful. Picus has also invested a lot of money in this product. They were coming here before the pandemic, every week. They've been sending their sales and pre-sales people to talk to our customers. Now they have permanently stationed one of their top executives in this region, he has been working in this region for about four months now, without a successful deal. So there are challenges that people see because when customers evaluate a product, they see other products as well. Very often customers acquire other competitor products. So we definitely need to do some more research about what others are doing.
Picus Security runs the Picus Autonomous Exposure Validation Platform, which proves what attackers can actually exploit in your environment and what your security controls stop. Picus pioneered Breach and Attack Simulation in 2013 and now unifies breach and attack simulation, automated penetration testing, and exposure validation into one continuous loop, so security teams act on real exploitation risk instead of severity scores.
Adversaries now weaponize new CVEs in hours, and manual...
There is room for improvement in the response rate provided by customer support. Picus Security could improve the response time.
To improve, Picus Security could consider establishing a data center in India to address trust issues and increase interest from Indian customers, potentially boosting revenue.
The amount of integrations that the product can handle is an area of concern, making it one of the aspects where improvements are required.
The reporting and data analysis could be improved. Specifically, the analysis of the results. Along with the data analytics, Picus Security should improve its attack path validation feature. In future releases, I would like to see an adaptive analysis of the company's perimeter. The attack surface analysis feature would be a good point to introduce in the platform. Moreover, there is room for improvement in terms of scalability. Automating some processes could make it even better.
According to the attack vectors, you cannot specify which product is failing or which product is working well because there's no agent. The best case scenario is to add an agent solution where an agent would have the ability to actually detect which programs aren't working. For the attack software, you put a peer on the cloud site, and you have another peer internal network. There is IPS, firewall, WAF, and DBS amongst these peers. The cloud's peer is trying to send the attack file to the internal network. Maybe the firewall is blocking it, maybe the IP, maybe the WAF, but you cannot see the details. You can say, "Yes, my security product is blocking that attack scenario," or, "I cannot block this attack."
Picus tells you that an attack has bypassed your security controls, but it doesn't tell you exactly where, or on which device the attack has been bypassed. I think that is one of the key components or features that is missing in the product, which requires some sort of enhancement. It doesn't provide patches automatically. It sends an update to the vendor, and the vendor will release the patch for you. If it allows or creates any sort of patch using Artificial Intelligence Modelling Language (AIML), it identifies the pattern of the signature and creates some sort of signature that will promptly block the attack, which will be most helpful as well. There are competitors of Picus which have been performing well. We have actually struggled to sell Picus in the market here because there are key enhancements that need to be implemented in the product. Especially the one where it has to identify which device has the loophole. Let's say if a customer's environment has 10 security devices and they need to know that there is an attack that has bypassed their devices, they cannot go and inspect every device and every rule in their security devices. They need to know exactly where that attack has been bypassed so that they can mitigate that weak link. That is one of the key aspects. Picus Security has competitors that are performing better. I'm not sure why we haven't assessed another product. Perhaps it is because they keep updating their rule sets. They're coming up with new features, and they are adding more UAB features to their products. There are a lot of other products, which are performing better. As far as Picus is concerned, we have been aggressively trying to reach out to customers to try to sell it, but have not been successful. Picus has also invested a lot of money in this product. They were coming here before the pandemic, every week. They've been sending their sales and pre-sales people to talk to our customers. Now they have permanently stationed one of their top executives in this region, he has been working in this region for about four months now, without a successful deal. So there are challenges that people see because when customers evaluate a product, they see other products as well. Very often customers acquire other competitor products. So we definitely need to do some more research about what others are doing.