Overview
Picus Labs' Blue Report 2026, based on analysis of 338 million attack simulations across enterprise environments, reveals a stark paradox in organizational security posture: perimeter defenses improved significantly year-over-year, while post-compromise controls deteriorated to near-useless levels. Once an attacker breaches the edge, the interior of most enterprise networks offers virtually no resistance.
The Split: Edge vs. Interior
Perimeter (Edge) — Improving
| Metric | 2025 | 2026 |
|---|---|---|
| Prevention rate | 62% | 69% |
| Logging coverage | — | 58% (four-year high) |
Nearly two-thirds of inbound perimeter attacks are now blocked, and logging has reached a record high. On the surface, this looks like progress.
Post-Compromise (Interior) — Deteriorating
| Technique | Prevention Rate |
|---|---|
| Overall interior | 37% |
| Domain enumeration | 10% |
| Credential harvesting from memory | 22% |
| Registry secret extraction | <1% |
| Command history hiding | 1% |
An attacker who has breached the perimeter can perform full reconnaissance, harvest credentials from memory and the registry, and prepare for lateral movement — with near-zero interference from internal controls.
The Signature Detection Gap
Picus uses Mimikatz as a case study to illustrate why interior detection fails so completely. Classic LSASS memory dumping — the technique most defenders have signature rules for — is blocked approximately 95% of the time. But this high block rate creates a false sense of security.
The same tool applied to registry-based credential stores is blocked less than 1% of the time. Defenders built signature rules for the well-known technique and stopped there. Attackers simply pivoted to behavioral variations that existing signatures don't cover.
This is the core finding: signature-based detection cannot keep pace with behavioral variation of known attack tools. The techniques themselves haven't changed; only the implementation path has shifted.
The Detection Engineering Crisis
The report identifies a critical disconnect between data collection and actionable alerting:
- Logging rate: 58% — organizations are collecting telemetry at a record pace
- Alert generation: 14% — but only a fraction of that telemetry produces alerts
Organizations are swimming in logs and generating almost no alerts from them. This isn't a data collection problem — it's a detection engineering problem. Security teams are not building, validating, and tuning detection rules fast enough to keep up with the volume of collected data.
Threat-Specific Regressions
The report highlights regressions against specific threat groups:
- Prevention declined against 9 of the 10 hardest-to-stop threat groups
- Ransomware families collectively achieved less than 38% prevention rates
- Play ransomware prevention collapsed from 50% to just 13% — a 37-point regression in a single year
Play ransomware's trajectory is particularly alarming: it was already one of the more impactful families, and defenses against it have more than halved in effectiveness.
Why This Matters
The practical implication is that the attacker kill chain now has a predictable structure:
- Breach the perimeter — 31% of inbound attacks succeed
- Enumerate the domain — 90% undetected
- Harvest credentials — registry: 99% undetected; memory: 78% undetected
- Move laterally and deploy ransomware — 62%+ of ransomware techniques succeed
The expensive, loudly-advertised perimeter investment is real, but it doesn't matter if everything behind it is transparent to an attacker.
Recommended Remediation
Picus recommends three structural changes:
1. Validate actual exposure, not theoretical coverage
Stop cataloging which controls you have and start measuring what they actually block. Continuous breach and attack simulation (BAS) gives a ground-truth picture of prevention rates that vulnerability scanning alone cannot.
2. Harden interior controls with behavioral detection
Shift detection rules from signature-based matching (known-bad tool names, exact command strings) to behavioral patterns — process injection behaviors, unusual LSASS access patterns, registry reads targeting credential paths (HKLM\SECURITY, HKLM\SAM), and suspicious use of built-in Windows tools (living-off-the-land).
3. Treat detection engineering as continuous, not one-time
Detection rules decay. Tools evolve, techniques diverge from the baseline, and attackers adapt faster than most teams update their SIEM content. Build a process for continuously generating, validating, and tuning detection content — and measure alert coverage as a KPI alongside prevention rate.