# Picus Security

**Canonical:** https://apis.io/providers/picus-security/  
**Website:** https://www.picussecurity.com/  
**APIs profiled:** 14

Picus Security is a cybersecurity company that pioneered Breach and Attack Simulation (BAS) in 2013 and now ships the Picus Security Validation Platform for Adversarial Exposure Validation (AEV) and Continuous Threat Exposure Management (CTEM). The platform continuously simulates real-world adversary techniques against network, endpoint, email and cloud controls, scores prevention and detection effectiveness, maps results to MITRE ATT&CK and the Unified Kill Chain, and returns vendor-specific mitigation signatures and validated detection rules from the Picus Mitigation Library. The Picus Customer API is a public REST API documented at apidocs.picussecurity.com and served from api.picussecurity.com, exposing simulations, simulation run results, the threat library, threat templates, agents, integrations, mitigation and detection content, exposure instance scores, users and roles, and activity logs, authorized with OAuth2-issued refresh and access tokens.

## Kin Score — 56.2 / 100 (strong)

Scored 2026-08-12 under rubric 0.11.0. Trend: flat (+0.0 from 56.2).

| Facet | Score |
|---|---|
| Discoverability | 92.6 |
| Contract Quality | 55.9 |
| Governance | 20.8 |
| Operational Transparency | 71.1 |
| Developer Ergonomics | 56.0 |
| Commercial Clarity | 50.0 |

## Agent readiness — 41.2 (agent-ready)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| MCP Server | derived |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | documented |
| OpenAPI Examples | partial |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | derived |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## APIs (14)

- **Picus Security Activity Logs API** — The Activity-Logs API from Picus Security — 1 operation(s) for activity-logs.
- **Picus Security Agents API** — The Agents API from Picus Security — 6 operation(s) for agents.
- **Picus Security Authentication API** — The Authentication API from Picus Security — 2 operation(s) for authentication.
- **Picus Security Instances API** — The Instances API from Picus Security — 1 operation(s) for instances.
- **Picus Security Integrations API** — The Integrations API from Picus Security — 2 operation(s) for integrations.
- **Picus Security Mitigation API** — The Mitigation API from Picus Security — 15 operation(s) for mitigation.
- **Picus Security Simulation Latest Result API** — The Simulation-Latest-Result API from Picus Security — 7 operation(s) for simulation-latest-result.
- **Picus Security Simulation Result API** — The Simulation-Result API from Picus Security — 8 operation(s) for simulation-result.
- **Picus Security Simulation Result Reports API** — The Simulation-Result-Reports API from Picus Security — 4 operation(s) for simulation-result-reports.
- **Picus Security Simulations API** — The Simulations API from Picus Security — 4 operation(s) for simulations.
- **Picus Security Summary API** — The Summary API from Picus Security — 1 operation(s) for summary.
- **Picus Security Templates API** — The Templates API from Picus Security — 2 operation(s) for templates.
- **Picus Security Threats API** — The Threats API from Picus Security — 13 operation(s) for threats.
- **Picus Security Users API** — The Users API from Picus Security — 5 operation(s) for users.

## MCP servers (1)

- **picus-security-mcp.yml**

## Agentic access (1)

- **Picus Security Agentic Access** — 84 operations · 25 acting

## Security (4)

- **Picus Security Authentication** — apiKey · 1 scheme
- **Picus Security Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Picus Security Vulnerability Disclosure** — Hackerone · contact published
- **Picus Security Trust Center** — ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 22301, ISO/IEC 20000-1, SOC 2 Type 2, CSA STAR Level One

## Tags

cybersecurity, security-validation, breach-and-attack-simulation, adversarial-exposure-validation, continuous-threat-exposure-management, penetration-testing, threat-intelligence, mitre-attack, detection-engineering, security-operations

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/picus-security/). Scores are computed from the provider's own public artifacts under a published rubric.