Picus Blue Report 2026 Finds Enterprise Defenses Block Just 37% of Post-Compromise Actions
Report discovered via Awesome Annual Security Reports.
Summary
Picus analyzed over 338 million attack simulations from January–June 2026. Overall prevention reached 69%, but only 37% of post-compromise actions were blocked, while the alert rate remained at 14%.
Key points
- Picus Labs analyzed anonymized, aggregated results from over 338 million attack simulations executed in customer environments between January and June 2026.
- Overall prevention effectiveness rose from 62% to 69%. Logging coverage increased from 54% to 58%, but only 14% of simulated attacks generated alerts, unchanged from the previous year.
- Autonomous penetration tests found that defenses blocked 37% of individual post-compromise actions. Quiet discovery and collection actions were blocked in approximately 10% of attempts, contrasting with stronger protection against conspicuous execution and lateral movement.
- Malware download prevention fell to 50%, down from 71% in 2024. Data exfiltration remained the least prevented attack vector at 7%.
- Prevention declined against nine of the ten least prevented threat groups. Play was the least prevented ransomware family at 13%, down from 50%; all ten lowest-scoring ransomware families scored 38% or less.
- Performance problems accounted for 49% of detection-rule issues, overtaking log collection issues at 41.5%. The report recommends continuously testing rule logic, processing efficiency, and telemetry health.
- All ten least prevented vulnerabilities were blocked in fewer than 25% of simulated exploit attempts. Linux libblockdev CVE-2025-6019 had the lowest prevention rate at 8%.
Article Details
- Publisher
- Picus Security
- Report Period
- 2026-01-01 to 2026-06-30
- Scope
- Anonymized, aggregated evaluation of prevention and detection controls in customer production environments, including simulated attack scenarios and autonomous post-compromise testing.
- Sample Size
- Over 338 million attack simulations; customer count not disclosed.
- Key Statistics
- Overall prevention effectiveness reached 69% in 2026, up from 62% in 2025.
- Autonomous penetration testing found that 37% of individual post-compromise attacker actions were blocked; discovery and collection actions were blocked in approximately 10% of attempts.
- Malware download prevention fell to 50%, compared with 60% in 2025 and 71% in 2024.
- The log score increased from 54% to 58%, while the alert score remained at 14% of simulated attacks.
- Performance issues accounted for 49% of detection rule issues, compared with 24% a year earlier; log collection issues accounted for 41.5%.
- Recommendations
- Continuously validate exploitability and control effectiveness in production environments, and retest after remediation or configuration changes.
- Test defenses against quiet discovery, collection, credential access, and evasion behaviors, and strengthen behavioral detection rather than relying only on signatures.
- Simulate complete, current ransomware and threat-group attack chains and verify that controls interrupt them at multiple stages.
- Continuously test and tune detection rules, validate log source health and coalescing behavior, and address inefficient queries and silent collection failures.
- Patch recent vulnerabilities promptly; where patching is delayed, validate compensating endpoint, intrusion prevention, and application-layer controls against relevant exploit attempts.
MITRE ATT&CK
T1003.001 · LSASS MemoryTesting included credential dumping directly from LSASS process memory, which was blocked in the large majority of attempts.T1005 · Data from Local SystemLocal file collection ran almost entirely unopposed during autonomous penetration testing.T1071 · Application Layer ProtocolCommand and control concealed within common application protocols such as HTTPS, DNS, or SMTP was prevented in 16% of simulations.T1078 · Valid AccountsAccess using valid credentials was prevented in 15% of simulations, illustrating difficulty distinguishing credential abuse from legitimate activity.T1132 · Data EncodingEncoding outbound command-and-control communications was prevented in 9% of simulations.T1135 · Network Share DiscoveryDomain file share enumeration ran almost entirely unopposed during autonomous penetration testing.T1216 · System Script Proxy ExecutionSigned Script Proxy Execution was prevented in 9% of simulations.T1480.001 · Environmental KeyingThe report associates this identifier with payload execution conditioned on confirming a real target rather than an analysis environment; prevention was 17%.T1489 · Service StopStopping services to disrupt operations or defenses was prevented in 19% of simulations.T1491 · DefacementDefacement of content was prevented in 12% of simulations.T1531 · Account Access RemovalDeleting or disabling accounts to deny legitimate users access was prevented in 2% of simulations.T1548.002 · Bypass User Account ControlPrivilege escalation through UAC bypass techniques was prevented in approximately 85% of autonomous penetration testing attempts.T1550.003 · Pass the TicketAutonomous penetration testing included Pass-the-Ticket as a credential-reuse behavior.T1562.003 · Impair Command History LoggingClearing or disabling shell command history was prevented in only 1% of simulations.T1562.010 · Downgrade AttackDowngrading systems to weaker protocol or logging modes was prevented in 16% of simulations.
CVE
CVE-2025-11001CVE-2026-2441 vulnerability (CVSS 8.8 High) and the 7-Zip CVE-2025-11001 vulnerability (CVSS 7.8 High) wereCVE-2025-15467Two critical-severity vulnerabilities also ranked among the least prevented. The OpenSSL CMS CVE-2025-15467CVE-2025-43530CVE-2025-43530 vulnerability, the only medium-severity entry on the list (CVSS 5.5 Medium), was blocked in justCVE-2025-6019At the bottom of the list, the Linux libblockdev CVE-2025-6019 vulnerability, a high-severity local privilegeCVE-2025-60719The Windows WinSock CVE-2025-60719 vulnerability (CVSS 7.0 High) was prevented 14% of the time, and theCVE-2025-6218each blocked in only 22% of simulations, and the WinRAR CVE-2025-6218 vulnerability (CVSS 7.8 High) in 24%.CVE-2026-20841successfully blocked. Close behind was the Windows Notepad CVE-2026-20841 vulnerability (CVSS 7.8 High) atCVE-2026-24061vulnerability (CVSS 9.8 High) was blocked in only 11% of simulations, and the GNU InetUtils CVE-2026-24061CVE-2026-2441CVE-2026-2441 vulnerability (CVSS 8.8 High) and the 7-Zip CVE-2025-11001 vulnerability (CVSS 7.8 High) wereCVE-2026-41651Pack2TheRoot CVE-2026-41651 vulnerability (CVSS 8.8 High) 16% of the time. The macOS Sequoia
Threat Actors
ChimeraIncluded among established espionage groups evaluated through simulations; prevention fell from 47% to 44%.ChinaZAssociated with Linux-focused malware and DDoS botnets; prevention fell from 51% to 45%.GALLIUMDescribed as targeting telecommunications providers and their infrastructure; prevention fell from 45% to 38%.InfyDescribed as a long-running espionage actor associated with targeted surveillance; prevention against its simulated attacks fell from 56% to 28%.KimsukyIncluded among established espionage groups evaluated through simulations; prevention fell from 48% to 39%.OutlawAssociated with opportunistic cryptojacking, botnet activity, and lateral movement; prevention against its simulated attacks was 31%, compared with 30% previously.Rampant KittenIncluded among established espionage groups evaluated through simulations; prevention fell from 49% to 44%.Sea TurtleDescribed as an espionage actor with DNS-focused operations against government and telecommunications targets; prevention fell from 55% to 48%.Silver FoxDescribed as an emerging APT group using loader frameworks and obfuscated malware; prevention fell from 38% to 32%.Venom SpiderAssociated with malware-as-a-service tooling used in financial and e-crime activity; prevention fell from 62% to 47%.
Malware
BabLockonly 30% of simulations, down sharply from 45%. BabLock followed at 31%, down from 34%, continuing to leverageBlackByteBlackByte, the least prevented variant in each of the previous two editions, remained near the bottom at 25%,BlackKingdomHive (38%, down from 53%), BlackKingdom (38%, down from 48%), and Maori (38%, down from 41%)FAUSTMagniber (35%, down from 45%) and FAUST (35%, down from 44%) showed similar prevention gaps, suggestingHive ransomwareHive (38%, down from 53%), BlackKingdom (38%, down from 48%), and Maori (38%, down from 41%)LockBitLockBit, despite years of law enforcement attention and extensive public documentation, was prevented inMagniberMagniber (35%, down from 45%) and FAUST (35%, down from 44%) showed similar prevention gaps, suggestingMaoriHive (38%, down from 53%), BlackKingdom (38%, down from 48%), and Maori (38%, down from 41%)Playmoved in the same direction: every one of the ten least prevented families scored 38% or lower, with Play falling from 50% to just 13% to become the hardest strain to prevent. In each case, these areSodinokibimovement within endpoint environments. Sodinokibi declined from 49% to 36%, a notable regression for one of the
Vendors
Products
7-Zipmemory-safety and improper-input-handling flaws in core libraries and utilities (OpenSSL, GNU InetUtils, 7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, WindowsGNU InetUtilssoftware: memory-safety and improper-input-handling flaws in core libraries and utilities (OpenSSL, GNU InetUtils, 7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev,Google ChromeEven the best-prevented entries in the bottom ten remain deeply concerning. The Google ChromeLinux(OpenSSL, GNU InetUtils, 7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product,Linux libblockdevGNU InetUtils, 7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product, indicatesmacOSand local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product, indicates that the gaps are systemic tomacOS Sequoiaand local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product, indicates that the gaps are systemic to howMicrosoft Windows7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product, indicates that the gapsOpenSSL CMSTwo critical-severity vulnerabilities also ranked among the least prevented. The OpenSSL CMS CVE-2025-15467Picus Autonomous Penetration TestingLeveraging the Picus Autonomous Penetration Testing product, organizations can emulate full-chain adversarial behavior, including credential compromise, lateral movement, and privilege escalation, without requiring redPicus Breach and Attack SimulationThe dataset for these statistics is sourced from Picus Breach and Attack Simulation (BAS), which uses a continuously updated checklist to identify and categorize over 50 recurring issues in detection rules.Picus Exposure Validationand Picus Exposure Validation, with Numi AI and Picus Swarm as the intelligence andPicus PlatformPicus Security provides an autonomous exposure validation platform, the Picus Platform,Windows Notepadsuccessfully blocked. Close behind was the Windows Notepad CVE-2026-20841 vulnerability (CVSS 7.8 High) atWindows WinSock7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, Windows WinSock, macOS Sequoia). The clustering by weakness type, rather than by product, indicates that the gaps areWinRARand improper-input-handling flaws in core libraries and utilities (OpenSSL, GNU InetUtils, 7-Zip, WinRAR), and local privilege escalation in operating system components (Linux libblockdev, Windows WinSock,
Tools
Sharp-ServiceExecLateral movement through service execution techniques such as Sharp-ServiceExec and SMBExec was prevented around 90% of the time, privilege escalation through UAC bypass techniques around 85%, and credential reuse andSharpHoundDomain enumeration through SharpHound, domain file share enumeration, session enumeration, and local file collection ran almost entirely unopposed.smbexecLateral movement through service execution techniques such as Sharp-ServiceExec and SMBExec was prevented around 90% of the time, privilege escalation through UAC bypass techniques around 85%, and credential reuse and
Industries
Banking, Financial Services, and Insurance (BFSI)Retail and Consumer Goods declined from 77% to 67%, and Banking, Financial Services, and Insurance (BFSI) fell from 76% to 67%.Educationsectors regressed while last year's weakest recovered. Transportation rose 29 points to 79%, while Education collapsed 30 points to 40%, now the least protected tracked industry. Regionally, South Asia climbedGovernment & Non-ProfitsGovernment & Non-Profits followed closely at 80%, an eight-point improvement that builds on last year's steady 72% and suggests sustained investment in control validation across public sector environments.Healthcare and PharmaceuticalsHealthcare and Pharmaceuticals, the top performer in 2025 at 83%, fell nine points to 74%.Manufacturing and EngineeringManufacturing and Engineering dropped from 81% to 72%.Professional ServicesProfessional Services also improved strongly, rising from 69% to 77%.Retail and Consumer GoodsRetail and Consumer Goods declined from 77% to 67%, and Banking, Financial Services, and Insurance (BFSI) fell from 76% to 67%.TechnologyTechnology fell from 62% to 49%, extending last year's surprising underperformance and suggesting that innovation-led priorities continue to crowd out security control maintenance in a sector that should know better.Telecommunicationsdown from 38%. GALLIUM, an actor known for targeting telecommunications providers and their infrastructure,TransportationLast year's strongest sectors regressed while last year's weakest recovered. Transportation rose 29 points to 79%, while Education collapsed 30 points to 40%, now the least protected tracked industry. Regionally, South