Enterprise security controls are blocking barely one in three attacks once hackers have breached the perimeter and are operating inside networks as authenticated users, according to Picus Labs' Blue Report 2026, which analyzed more than 338 million real attack simulations across client production environments in the first half of 2026. While average prevention effectiveness at the perimeter climbed from 62% to 69%, matching its 2024 peak, the report found defenses turn "soft" once adversaries cross that boundary, particularly against reconnaissance and credential theft that precede serious breaches.

The contrast between edge and interior protection is stark. Picus Labs measured post-compromise prevention for the first time using autonomous penetration testing and found a rate of just 37%, meaning defenses stop fewer than four in ten attacks once an adversary is already inside. Meanwhile, logging hit a four-year high of 58%, but the alert score remained frozen at 14%, meaning fewer than one in seven simulated attacks produced an alert despite rising telemetry collection. The gap is widest for stealthy actions: reconnaissance such as mapping domains and enumerating shares was stopped only 10% of the time, while defenses detected credentials being read from memory around 22% of the time, and one variant pulling secrets from the registry was blocked in less than 1% of attempts. Noisy behavior fared far better, with lateral movement through service execution stopped around 90% of the time and privilege escalation blocked at roughly 85%. The same credential-theft tool, Mimikatz, demonstrated the split: dumping credentials the classic way from LSASS process memory was blocked almost every time, while pulling them from other memory locations or reading them from the registry was almost never blocked, even though the tool, goal, and environment remained identical.

The report's authors write that the behaviors defenders miss are exactly the low-noise ones that today's evasion-minded attackers rely on, noting that the single least-prevented technique in the entire dataset was hiding command history, stopped just 1% of the time. According to the Blue Report 2026, IOC-based prevention, which measures how often security controls block known-malicious files delivered as downloads, fell to 50% this year from 60% last year and 71% in 2024. The report states that last year's leaders slipped and last year's laggards climbed, often by wide margins, with education falling 30 points in a single year to become the least-protected industry. Even as overall scores climbed, prevention fell against nine of the ten hardest-to-stop threat groups, and every one of the top ransomware families was blocked less than 38% of the time, with Play collapsing from 50% to 13%.

The report explains that signature-based prevention tells organizations how well they catch what they've already seen, not whether they're actually stopping the underlying behavior. The LSASS credential-dumping path is loud in a way tools can match because a process opens a handle to lsass.exe and reads its memory, an event vendors have instrumented for years, but reading the registry never touches lsass and looks like ordinary privileged activity, so a control built for the first event has nothing to fire on for the second. Signatures alone can't keep pace because VirusTotal takes in close to two million new files daily, and repacking a payload makes the indicator stale while the behavior underneath stays the same. The report notes that the gap between what gets logged and what gets alerted is now a detection-engineering problem, not a collection one, as teams are collecting more telemetry than ever but converting almost none of it into action.

The report recommends three moves: validate exposure rather than inventory by proving which exposures are actually exploitable in your environment, harden the interior against quiet actions by testing discovery and passive credential access as rigorously as lateral movement, and treat detection rules as engineering by writing them against current behavior and confirming they fire. The authors state that strong performance is rented, not owned, and lasts only as long as the validation behind it, pointing out that prevention climbed seven points because organizations re-tested controls that had drifted and fixed what the tests exposed, while sectors that regressed are the ones that stopped testing. The quiet actions slipping through, reconnaissance and credential reads that never trip a signature and rarely trip an alert, are the ones defenders need to focus on now. The perimeter's recovery proves that validation works, but it also shows that protection is a continuous process rather than a permanent achievement. Organizations betting their security posture on annual audits are falling behind competitors who treat testing as an ongoing discipline, and the gap between those two approaches will likely widen as attackers continue refining evasion tactics that exploit the difference between detecting noise and detecting intent.