338 Million Attack Simulations Reveal The State Of Enterprise Defense
Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.
Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.
- Perimeter prevention improved to 69%, but post-compromise blocking was only 37% of actions.
- Reconnaissance was stopped ~10% of the time and credential memory reads ~22%.
- Mimikatz LSASS dumping blocked 94%, but other memory locations only 17% and registry 3%.
- IOC-based malware download prevention dropped 21 points in two years to 50%.
- Vendors
- Victims
- Android users
- Countries
- US
From the original article
6 min read at helpnetsecurity.com
First, a bit of good news: Enterprise defenses are recovering. However, it’s a narrow recovery, with a twist. Today, organizations are better at stopping loud attacks but have barely moved the needle at all against the quiet ones.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.