Key Takeaways
- Enterprise perimeter defenses improved modestly, with average prevention effectiveness rising to 69% in the first half of 2026, matching the 2024 peak.
- Once inside the network, defenses block only 37% of attacker actions, revealing a large gap between perimeter and interior security.
- “Loud” attack techniques (lateral movement, privilege escalation) are stopped 85‑90% of the time, while “quiet” actions such as reconnaissance and credential harvesting succeed ≈ 80‑90% of the time.
- Signature‑based controls (e.g., classic Mimikatz LSASS dump) achieve high block rates (> 90%), but the same tool using less‑recognizable methods is blocked only 3‑17% of the time, highlighting the limits of indicator‑based prevention.
- Malware‑download prevention based on IOCs has fallen to 50%, a 21‑point drop over two years, whereas behavioral (TTP‑based) testing remains essential for detecting attacks that evade known signatures.
- The ten least‑prevented CVEs cluster by weakness class (memory‑safety, input‑handling, local privilege escalation) rather than by vendor, showing that attack techniques reuse across many vulnerabilities.
- Logging improved to 58% of simulated attacks, but alerting stayed flat at 14%, indicating a detection‑engineering bottleneck rather than a data‑collection problem.
- Strong security scores are “rented, not owned”: they decay quickly unless organizations continuously validate controls against the full, current kill chains of known threat groups and ransomware families.
- The Blue Report 2026 provides industry‑ and region‑specific benchmarks, MITRE ATT&CK® tactic gaps, ransomware trend analysis, detection‑rule failure details, and practical guidance for closing these gaps through continuous validation.
Perimeter Defenses Show Modest Recovery
The headline finding of the Blue Report 2026 is that average prevention effectiveness climbed from 62% to 69% in the first half of 2026, returning to the 2024 peak. This figure reflects how often security controls—spanning firewalls, web proxies, secure email gateways, endpoint protection, and other perimeter and endpoint technologies—blocked the attacker actions tested against them. The improvement is genuine but narrow; it tells us that organizations are getting better at stopping the noisy, obvious steps of an attack before they even reach the interior network.
Interior Controls Remain Weak
Once an attacker has crossed the boundary, the picture changes dramatically. Using autonomous penetration testing to emulate an adversary already inside the network, Picus Labs found that controls blocked only 37% of post‑compromise actions. In other words, defenses stop roughly one in three malicious activities after the initial breach, allowing two‑thirds to proceed unhindered. The 32‑point gap between the 69% perimeter prevention rate and the 37% interior rate underscores that strengthening the edge does not automatically translate to a contained attacker.
Loud Versus Quiet Attack Techniques
Inside the network, defenses split sharply by noise. Techniques that generate noticeable activity—lateral movement and privilege escalation—were blocked 85‑90% of the time. By contrast, reconnaissance (mapping the domain, enumerating shares and sessions) succeeded about 90% of the time, and reading credentials from memory was stopped only ≈ 22% of the time. An attacker can therefore chart the environment and harvest credentials with little friction before taking any step that would trigger an alarm, exploiting the defensive blind spot toward low‑noise, high‑value actions.
One Tool, Three Methods, Three Very Different Results
To illustrate how detection efficacy depends on recognizability rather than underlying behavior, the report examined a single credential‑theft tool, Mimikatz, across three execution styles. Dumping credentials from the LSASS process memory—the classic, signature‑heavy method—was blocked 94% of the time. Pulling the same credentials from alternative memory locations dropped to 17%, and reading them from the local registry fell to a mere 3%. The same tool, same goal, same environment produced vastly different outcomes solely based on how “loud” the technique appeared to security controls.
Signature‑Based Limits and the Need for Behavioral Testing
The stark variation with Mimikatz demonstrates a fundamental limitation of indicator‑or signature‑based prevention: it measures how well controls catch what they have already seen, not whether they stop the underlying behavior. 决赛, a recompiled, in‑memory load, or a signed Windows utility can evade detection while performing identical malicious actions. Consequently, relying solely on IOC‑based scores gives a false sense of security; behavioral, TTP‑based testing is required to verify that controls stop the action itself regardless of how it is packaged.
Malware Prevention Keeps Sliding at the Edge
The decline in perimeter effectiveness is especially evident for malware downloads. IOC‑based prevention fell to 50% in the first half of 2026, down from 60% in 2025 and 71% in 2024—a 21‑point drop over two years against one of the most studied attack vectors. The cause is structural: VirusTotal ingests close to two million new files daily, and adversaries constantly repackage payloads. Signature lists must grow explosively to keep pace, whereas behavioral approaches focus on the limited set of actions needed to achieve an objective (e.g., stealing credentials, establishing persistence), making them far more sustainable.
Both IOC and Behavioral Testing Matter
The report stresses that IOC‑based and behavioral testing answer complementary questions. IOC testing validates whether perimeter controls recognize known‑bad content—a critical check for firewalls, proxies, and email gateways. Behavioral testing, by contrast, asks whether endpoint and detection technologies stop the underlying action by any route, which is essential once an attacker is inside. A mature security program must run both: continuously feeding fresh malware samples to perimeter controls while executing TTP‑based simulations against EDR, XDR, and SIEM solutions to confirm they block the behavior, not just the file.
The Weakest CVEs Group by Flaw, Not Vendor
Analysis of the ten least‑prevented vulnerabilities showed each blocked in under 25% of exploit attempts. Rather than clustering by product or maker, these CVEs share common weakness classes: memory‑safety and input‑handling flaws in core libraries, and local‑privilege‑escalation bugs in operating‑system components. The same exploit techniques succeed across multiple CVEs, indicating that triaging solely by CVSS score overlooks the real risk—whether an attacker can chain a vulnerability’s techniques against your specific defenses.
Exposure Validation Answers the Chaining Question
To address this gap, the report introduces Exposure Validation, which deconstructs a CVE into the constituent techniques an attacker must chain and tests each against your controls on the day of disclosure—without executing a live exploit. This approach yields a defendable verdict for any CVE, including those affecting air‑gapped, business‑critical, or not‑yet‑weaponized systems where live testing would be unsafe or impossible.
Logging Climbed, Alerting Stayed Stuck
On the detection side, logging improved modestly to 58% of simulated attacks, while alerting remained flat at 14%. Fewer than one in seven attacks generated an actionable alert, meaning that organizations are collecting more telemetry than ever but converting little of it into usable signals for analysts. The log‑to‑alert gap is now a detection‑engineering challenge: teams must refine correlation rules, reduce noise, and ensure that salient behaviors trigger timely notifications rather than simply amassing data.
Good Scores Are Rented, Not Owned
The report’s overarching lesson is that strong performance is temporary. Prevention fell against nine of the ten hardest‑to‑stop threat groups, and every major ransomware family was blocked less than 38% of the time, with the Play family dropping from 50% to 13%. These are well‑documented adversaries; the decline occurs because signatures for known families do not cover the actual behaviors their operators run. Sustained security requires continuous validation against the full, current kill chains of known threats, not just periodic checks against static indicators.
Read the Full Report
The summary above captures only a thin slice of the Blue Report 2026. The complete document offers industry‑ and region‑specific benchmark scores, MITRE ATT&CK® tactic and technique gaps, year‑over‑year ransomware trend analysis, a detailed breakdown of detection‑rule failures behind the logging‑alert disparity, and practical guidance for closing these gaps through continuous validation from the perimeter to the quiet interior. Downloading the free copy lets organizations see precisely where their defenses held, where they gave way, and where they are most likely to fail.