Picus Report: Mimikatz Credential-Dumping Prevention Ranged from 94% to 3%

Summary

Picus Security’s sponsored summary of Blue Report 2026 says more than 338 million simulations found Mimikatz credential-dumping prevention varied by method: 94% for LSASS memory access, 17% for alternate-memory access and 3% for LSA Secrets.

Key points

Picus Labs says its fourth annual Blue Report analyzed more than 338 million attack simulations in customer environments from January through June 2026.
The report puts overall prevention effectiveness at 69%, up from 62% in 2025 and matching 2024; IOC-based prevention of malware downloads fell to 50%, from 60% in 2025 and 71% in 2024.
In Picus Autonomous Penetration Testing, Mimikatz credential dumping from LSASS memory was blocked in 94% of attempts, compared with 17% for RDP credentials from other memory locations and 3% for LSA Secrets read from the local registry.
The article says LSASS access generates a recognizable event, while reading LSA Secrets does not touch LSASS and can resemble ordinary privileged activity; it also notes that signatures tied to one tool build can miss modified or alternative methods.
Across post-compromise actions, the report says controls blocked 37% overall. Reported rates included about 90% for lateral movement, 85% for UAC bypass, 63% for credential reuse and Active Directory abuse, and 10% for discovery and collection.
The article recommends testing both known-bad indicators at the perimeter and varied attacker behaviors against endpoint and detection controls, rather than treating success against one recognizable procedure as proof of coverage.

Article Details

Publisher: Picus Labs (Blue Report 2026); sponsored article on BleepingComputer, written by Picus Security
Report Period: 2026-01 to 2026-06
Scope: Enterprise prevention and detection performance in real customer environments, including perimeter and post-compromise behavior testing.
Sample Size: More than 338 million attack simulations.
Key Statistics: Overall prevention effectiveness was 69%, up from 62% the prior year and back to its 2024 peak.
IOC-based prevention of malware downloads was 50%, down from 60% the prior year and 71% in 2024.
Mimikatz credential-dumping attempts were blocked at different rates by method: 94% for LSASS memory, 17% for other memory locations, and 3% for LSA Secrets in the local registry.
Across tested post-compromise actions, 37% were blocked.
The report states that credential material read passively from memory and the registry was blocked 22% of the time; discovery and collection actions were blocked 10% of the time.
Recommendations: Use both IOC-based testing for perimeter controls and behavioral, TTP-based validation for endpoint and detection controls.
Test credential access across LSASS memory, the registry, alternate memory locations, native tooling, and recompiled builds rather than validating only a familiar procedure.
Validate behavioral variations against deployed controls; the article describes Picus Swarm as an orchestration layer for running these tests.