Success Story: tbi bank & Picus

Dobrin Dobrev, CISO, tbi bank

“As a digital-first bank, security isn’t a secondary layer, it’s a foundational part of our customer trust and brand promise. We see cybersecurity as a business enabler, not a barrier.”

tbi bank combines a strong in-house security team with strategic partnerships to extend its capabilities. Dobrev explains:

“Our hybrid model allows us to stay agile. Netsmart’s deep expertise complements our internal strengths and serves as an extension of our own team.”

Even with significant investments in next-generation firewalls and EDR platforms, tbi bank needed definitive answers to a critical question:

“How effective are our controls against real-world threats today, not six months ago?”

Traditional penetration tests offered value but lacked continuity. The bank needed the ability to:

• Continuously validate controls against emerging threats
• Quantify the ROI of security investments with reliable data
• Identify weaknesses proactively
• Prioritize vulnerabilities based on actual exploitability, not just severity

This led to the decision to explore an automated, continuous validation solution.

The initiative focused on deploying the Picus Security Platform to validate tbi bank’s core security capabilities. The main objectives included:

1. Real-Time Visibility: Understanding the performance of security controls against thousands of threat samples
2. Optimization of Controls: Testing NGFW and EDR rules using real-world infiltration and post-exploitation techniques
3. Attack Surface Clarity: Mapping potential attacker paths through the environment using the Attack Path Validation module
4. Measurement & Reporting: Establishing a clear baseline for security effectiveness and continuously tracking improvements for internal and regulatory reporting

Technology Decision: What Set Picus Apart

• Threat-Centric Approach: Testing against a vast library of real-world attack techniques
• Actionable Mitigation: Immediate, vendor-specific mitigation content
• Safe Automation: Running thousands of attack simulations safely in production
• Continuous Improvement: Persistent validation cycles without operational disruption

Partner Decision: Why Netsmart Was the Right Fit

tbi bank chose Netsmart not just as a vendor, but as a long-term strategic partner. Dobrev highlights:

• “They understood both the Picus platform and the complexities of our security stack.”
• “Their team worked seamlessly with ours throughout the POC and deployment phases, and their continued support and guidance have been instrumental in our path to security excellence.”
• “Their expertise in the banking sector’s regulatory landscape was invaluable.”

The project delivered measurable improvements across cost efficiency, performance, and overall security posture.

1. Price & ROI

• Maximized effectiveness of existing security investments
• Identified misconfigurations quickly and accurately
• Reduced manual workload through automated validation

2. Operational Performance

• Attack Path Validation enabled precise prioritization of critical weaknesses
• EDR rules were fine-tuned to reduce false positives
• SOC teams gained higher-fidelity alerts and clearer visibility

3. Technology & Cyber Resilience

• Security became quantitative and data-driven
• Continuous validation enabled proactive risk detection
• The bank’s overall “Security Effectiveness Score” improved steadily

Evrim Özsoy, Director Of Sales, Netsmart

Our partnership with tbi bank brought a shared vision of proactive, validated security to life. By tuning the Picus platform to their environment and enhancing the performance of their existing controls, we helped deliver resilience that is measurable and continuously improving. At Netsmart, our goal is not just to make security work, but to make it work at its best and this project proved the impact of the right technology paired with the right partnership.

Dr. Süleyman Özarslan, Co-Founder, Picus Security

In banking, security cannot simply be a statement; it must be a validated reality. tbi bank stands out by treating security as a strategic capability rather than a checkbox. With the Picus platform and Netsmart, tbi bank continuously tests its defenses against real-world attacks, identifies and remediates gaps, and turns cyber resilience into a measurable, continuously improving capability.