What breach and attack simulation needs to become in the AI era
Picus argues calendar-driven BAS is obsolete as AI compresses exploit timelines, citing 338 million simulations showing 69% prevention and a flat 14% alert score.
In a vendor opinion piece, Picus Security contends that with over 130 CVEs disclosed daily, fewer than 0.5% patched upstream, and disclosure-to-weaponized-exploit timelines near 10 hours, scheduled breach and attack simulation no longer keeps pace. The Picus Blue Report 2026, aggregating 338 million production simulations, found average prevention effectiveness of 69%, 58% of attack actions captured in the SIEM, an unchanged 14% alert score, and detection rule failures driven by performance issues (49%) and silent log collection gaps (41%). Picus proposes agentic BAS as a closed loop—simulate, validate, fix, verify—with AI-built threats and humans at decision gates.
- Blue Report 2026: 69% average prevention across 338M simulations
- Detection rule failures: 49% performance, 41% silent log collection gaps
- Alert score stuck at 14% while SIEM logging hit a four-year high
- Exploit weaponization now ~10 hours; >130 new CVEs per day
- Pitch: agentic BAS closed loop with vendors-specific fixes and human decision gates
- Vendors
- Picus Security
- Products
- Picus BASAI Threat Builder
- Organizations
- Picus Security
From the original article
6 min read at helpnetsecurity.com
Breach and attack simulation (BAS) has always had a supply chain. Somebody has to read the threat report, pull out the techniques, and turn them into something that will actually run against your controls. That somebody has always been a human red team.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.