Key Takeaways
- Enterprise perimeter defenses have rebounded, with average prevention effectiveness rising to 69% in the first half of 2026, matching the 2024 peak.
- Once attackers are inside, defenses block only about 37% of their actions, revealing a stark gap between perimeter and interior security.
- Detection controls excel at stopping noisy activities (lateral movement, privilege escalation) but miss quiet reconnaissance and credential‑access steps, which succeed >75% of the time.
- Signature‑based tools catch well‑known attack variants (e.g., classic Mimikatz LSASS dump ≈ 94%) but fail dramatically when the same behavior is performed via less‑observable methods (registry reads ≈ 3%).
- Malware‑download prevention based on indicators of compromise continues to slide, falling to 50% in 2026 from 71% in 2024, because attackers constantly re‑package payloads.
- The ten least‑prevented CVEs cluster by weakness class (memory safety, input handling, local privilege escalation) rather than by vendor, showing that chaining techniques—not CVSS scores—determines real risk.
- Logging improved modestly to 58% coverage, yet alert generation remained flat at 14%, indicating a detection‑engineering bottleneck rather than a data‑collection problem.
- Top ransomware families and well‑known threat groups saw prevention drop below 38% on average, proving that “good scores are rented, not owned” and decay without continuous validation.
- Effective security posture requires combining IOC‑based perimeter testing with behavioral, TTP‑based simulations that exercise the full range of attacker methods inside the network.
Perimeter Improvements vs Interior Gaps
The Blue Report 2026 shows that enterprise prevention effectiveness rose from 62% to an average of 69% across the first half of 2026, returning to the 2024 peak. This figure aggregates how often security controls—spanning firewalls, web proxies, endpoint protection, and other perimeter and endpoint tools—blocked the attacker actions tested. While the headline number looks encouraging, it masks a critical divergence: once an attacker crosses the boundary, the same controls stop only about 37% of subsequent actions. In other words, defenses halt roughly one in three internal moves and allow two‑thirds to proceed unhindered. The 32‑point gap between edge and interior performance is the report’s core insight: improvements at the perimeter have not translated into comparable resilience inside the network.
Noise‑Based Detection Split
When the report examined what happens after compromise, it split attacker behavior by “noise.” Controls blocked lateral movement and privilege escalation—actions that generate observable code execution or traffic between machines—85 to 90 % of the time. By contrast, reconnaissance steps such as mapping the domain, enumerating shares and sessions, and reading credentials from memory were stopped only about 10 % and 22 % of the time, respectively. This pattern means an attacker can silently chart the environment and harvest credentials with little friction before triggering any alarm‑raising activity. Detection capabilities are therefore strong against noisy post‑exploitation but weak against the low‑profile intelligence‑gathering phase that often precedes it.
Autonomous Penetration Testing Reveals Hidden Weaknesses
To uncover the interior deficit, Picus Labs employed autonomous penetration testing that emulates an adversary already inside the network. This approach runs full attack chains inside production environments, showing what an intruder could actually achieve once the perimeter is breached. By exercising the complete range of attacker tactics—not just the well‑known signatures—the test exposed where controls fail quietly. The resulting 37% interior block rate is a direct measurement of how defenses behave when faced with realistic, multi‑stage intrusion paths, providing a more honest assessment than aggregated prevention scores alone.
Signature Limits Illustrated by Mimikatz Variants
A single credential‑theft tool, Mimikatz, produced wildly different block rates depending on how it was used. Dumping credentials from the LSASS process memory—the classic, heavily monitored method—was stopped 94 % of the time. Extracting the same credentials from other memory locations fell to 17 %, and reading them from the local registry dropped to a mere 3 %. The underlying goal—credential access—remained identical; only the visibility of the technique changed. This demonstrates that signature‑based detection excels at catching known variants but cannot reliably stop the underlying behavior when attackers alter their methods, recompile tools, or leverage legitimate Windows utilities to evade fingerprints.
Behavioral Testing vs Indicator‑Based Testing
The report distinguishes two complementary questions: IOC‑based testing asks whether a control recognizes known‑bad files (the job of perimeter defenses such as firewalls, web proxies, and secure email gateways), while behavioral/TTP‑based testing asks whether a control stops the malicious action itself regardless of how it is delivered (the job of endpoint detection, XDR, and SIEM once an attacker is inside). Malware‑download prevention based on indicators of compromise fell to 50 % in 2026, down from 60 % in 2025 and 71 % in 2024, reflecting the sheer volume of new file variants—VirusTotal sees close to two million new files daily. In contrast, behavior‑centric testing scales with the attacker’s objective (e.g., credential theft) and offers a more stable measure of defensive efficacy because there are only so many ways to achieve a given goal.
Weak CVEs Group by Flaw, Not Vendor
The ten vulnerabilities with the lowest prevention rates were each blocked in under 25 % of exploit attempts. Rather than sorting them by vendor or product, Picus Labs grouped them by weakness class: memory‑safety and input‑handling flaws in core libraries, and local‑privilege‑escalation bugs in OS components. The same exploit techniques repeatedly succeeded across different CVEs, undermining the practice of triaging solely by CVSS score. The true risk lies in whether an attacker can chain a vulnerability’s techniques within a specific environment and against its particular defenses—a question answered only by TTP‑chaining validation.
Logging Gains, Alerting Stagnation
Prevention is only half the battle; detection must alert humans when controls fail. The report logged a modest rise in telemetry collection, with logging coverage reaching 58 %, yet the alert rate remained flat at 14 %—the same as the previous year. Fewer than one in seven simulated attacks triggered a usable alert. This widening log‑to‑alert gap signals a detection‑engineering problem: organizations are gathering more data but are not converting it into actionable alerts. Improving alert quality, tuning detection rules, and correlating telemetry effectively are essential to turn increased visibility into real‑time response capability.
Good Scores Are Rented, Not Owned
Top ransomware families and well‑documented threat groups saw prevention effectiveness drop below 38 % on average, with some groups (e.g., Play) collapsing from 50 % to 13 %. These adversaries are not obscure; their tradecraft is publicly analyzed, yet defenses lost ground because reliance on signatures for known families does not cover the full range of behaviors those groups employ. The report concludes that strong performance is “rented, not owned”—it lasts only as long as continuous validation against current, full kill chains is maintained. Without ongoing testing that mimics the adversary’s evolving tactics, even previously solid scores deteriorate.
How to Apply the Findings
The Blue Report 2026 offers a benchmark organizations can use to measure their own security programs. It provides industry‑ and region‑specific prevention and detection scores, maps the MITRE ATT&CK tactics and techniques that defenses miss most, lists the threat groups and ransomware families where prevention lost the most ground, breaks down detection‑rule failures behind the logging‑alert gap, and gives practical guidance on closing those gaps through continuous validation from the perimeter to the quiet interior. By combining IOC‑based perimeter testing with behavioral, TTP‑based simulations that emulate real attacker behavior inside the network, enterprises can move beyond rented scores toward truly owned resilience.