Enterprise defenses are getting better at stopping the kind of attacks that announce themselves. Yet the same 2026 data also shows a troubling pattern: attackers are increasingly winning by doing less loud work, especially once they’re already inside.
In Picus Labs’ Blue Report 2026, analysts ran more than 338 million real attack simulations in client production environments during the first half of 2026. The headline is encouraging—overall prevention improved and logging rose. But the story flips after the perimeter is crossed, revealing a gap that teams can’t close with perimeter-focused controls alone.
Why the perimeter recovered—then the inside softened
The report measures how well defenses prevent attacks and how much telemetry teams generate when those controls fail. Average prevention effectiveness rose from 62% to 69%, matching a high point seen in 2024. Logging reached a four-year high of 58%, which suggests organizations are collecting more data than ever.
However, the improvement is not evenly distributed. The perimeter blocks roughly two out of three attacks, while inside the network defenses stop barely one in three. In other words: the edge looks resilient, but the interior becomes a different environment—one where attackers find more room to maneuver.
Quiet actions are the real fault line
The report emphasizes that the interior doesn’t fail randomly. Instead, it tends to fail along a clear line between “noisy” and “quiet” attacker behavior.
When adversaries run actions that produce obvious signals—like executing code to move laterally—controls often work. Techniques associated with service-based execution and SMB-based execution were stopped around 90% of the time. Privilege escalation attempts via UAC bypass were blocked about 85% of the time. These results are consistent with endpoint and detection technologies doing what they were designed to do over the years.
But that’s not where the dataset shows the biggest problem. The least-prevented category is reconnaissance: mapping the domain and enumerating shares and sessions was stopped only 10% of the time. Defenses also struggled with passive credential theft patterns, such as reading credentials out of memory (stopped around 22%) and pulling secrets directly from the registry (stopped in less than 1% of attempts).
The attacker advantage is straightforward: they can prepare quietly—collecting environment details and harvesting credential material—without tripping the controls meant to catch the later, louder steps of an intrusion.
Post-compromise prevention rates show the scale of the gap
One of the sharper measurements in Blue Report 2026 is post-compromise prevention. Instead of only testing what happens before an adversary is present, Picus Labs used autonomous penetration testing to evaluate what controls actually break the attack chain after an attacker is already operating as an authenticated user.
The Post-Compromise Prevention Rate came out at just 37%. This figure helps explain why enterprise defenses can look “healthy” in perimeter testing while still being vulnerable once attackers are inside the normal trust boundary.
It also highlights a practical reality for defenders: many security programs measure prevention in scenarios that don’t fully represent what happens after initial access succeeds. If the interior isn’t tested the same way, the organization learns too late where defenses weaken.
Signatures catch what you’ve already seen—not what attackers can do
A key finding in the report focuses on how signature-based controls behave when an attacker changes their method. A single tool—Mimikatz—was used with the same objective in three different ways, and prevention results diverged dramatically.
When credentials were dumped in the classic approach from LSASS process memory, the attempt was blocked almost every time. But when the same goal was pursued by reading credentials from other memory locations, or by retrieving them from the registry, the attacks were almost never blocked.
The difference wasn’t the end result—it was the conspicuousness of the route. The LSASS memory-reading path involves an activity vendors have tracked for years: a process opens a handle to lsass.exe and reads memory. Reading from the registry, by contrast, can resemble ordinary privileged activity and does not touch LSASS, leaving signature logic with nothing relevant to trigger.
Even more concerning, the report notes that the observed high prevention (the “94%” figure in that experiment) was measured against a specific build of an open-source tool where recognizability is affected by compilation details, not only the behavior itself. In real-world terms, that means defenders may be measuring a known artifact rather than reliably stopping the underlying action.
Stealth pays: more evasion, less friction
The Blue Report aligns with Picus Labs’ broader observation that attackers are shifting toward stealth. In the enterprise-defense testing results, the least-prevented technique across the dataset was hiding command history, stopped only 1% of the time.
This matters because the techniques that defenders miss tend to be the low-noise behaviors used to shape the next steps. Instead of raising immediate alarms, these actions reduce visibility and help adversaries line up credentials and targets before taking moves that generate clearer signals.
Malware prevention shows a similar limitation. The report reports an IOC-Based Prevention Rate of 50% this year, down from 60% last year and 71% in 2024. The logic is familiar to anyone who has tried to rely on indicators alone: new files arrive constantly, and repackaging can render signatures stale while the behavior stays functionally similar.
Indicator-based testing still has value. It’s a fast way to confirm that edge defenses stop known-malicious downloads. But the report’s argument is clear: indicators can only validate what someone already wrote a rule for. To understand whether enterprise defenses can stop the real work, teams need behavioral testing that evaluates whether actions themselves are blocked.
Logging went up, but alerts didn’t follow
Prevention is only one side of the picture. When a control fails to stop an action, the expectation is that detection and alerting bring humans into the loop.
Blue Report 2026 suggests that this fallback mechanism is not firing reliably. Logging rose to 58%, but the alerting score stayed at 14%. Fewer than one in seven simulated attacks generated an alert—meaning organizations can collect more telemetry while still failing to convert that telemetry into actionable signals.
The report frames this as an engineering gap rather than a data collection problem. If enterprise defenses are producing logs but not alerts, the bottleneck is likely in how detection rules are authored, tuned, maintained, and validated against the behavior being tested.
Validation beats “last year’s wins”
Averages improved overall, but the report cautions that performance can be uneven across industries and across time. Some sectors that were stronger in the previous year appear to have slipped, while others—often those that kept testing and validation active—showed improvements.
The report points out that “strong performance” can be rented rather than owned. In practical terms, when an organization stops validating controls, attacker behavior that was already hard to block can become even easier to exploit.
It also notes that prevention fell against nine out of the ten hardest-to-stop threat groups even as the overall average rose. For ransomware families, prevention was blocked less than 38% of the time, and at least one family (Play) dropped from 50% to 13%.
What to do next: three moves for enterprise defenses
So how do teams respond to a dataset that shows a strong perimeter and weak interior—especially against quiet actions? The report offers three practical directions.
- Validate exposure, not inventory. Don’t just list systems and theoretical weaknesses—prove which exposures are truly exploitable in your environment.
- Harden the interior against quiet actions. Test discovery behaviors like share and session enumeration, and test passive credential reads with the same rigor used for lateral movement. Require detection that matches what an action does, not only the signature it resembles.
- Treat detection rules as engineering. Build detections against current behavior, confirm they fire reliably, tune out noise, and re-validate as systems and attacker techniques evolve.
The overall message is encouraging for defenders: the enterprise defenses already recovered when they were tested. What slipped through were the quiet behaviors—reconnaissance and credential access patterns that rarely trip signatures and, in this dataset, rarely triggered alerts either.
The bigger takeaway: test the attack chain, not just the entry
Blue Report 2026 runs these evaluations across the attack surface and breaks results down by industry and region. It also connects the gaps to techniques most defenders block least, as well as threat groups and ransomware families where prevention declined despite overall gains.
If the perimeter-versus-interior split described in this article feels familiar, the report is presented as a way to pinpoint where the quiet gap exists in your environment—and which reconnaissance and credential-access steps deserve priority today.
Download Blue Report 2026 to identify where enterprise defenses are likely to hold and where low-noise attacks may still be finding their way through.
Source: https://thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html
