The Picus Blue Report 2026 puts a number on the gap between what your controls recognise and what they actually stop, and some of those numbers are genuinely difficult to read. Published by Picus Security, the report draws on more than 338 million attack simulations run in real customer environments between January and June 2026, making it one of the more substantive datasets the industry has produced on production-environment defence performance.
The headline finding sounds encouraging at first: overall prevention effectiveness recovered from 62% to 69%, returning to its 2024 peak. Sila Ozeren Hacioglu, Security Research Engineer at Picus Security, is clear about what that number actually represents, though. It is a stack-wide average, and averages have a way of flattering the parts of your environment that are genuinely struggling.
IOC-based and TTP-based testing measure entirely different things
The report draws a structural distinction that matters more than most security teams treat it. IOC-based testing asks whether a control recognises known-bad content: malware samples are delivered as download attempts, and perimeter controls either block them or they do not. That is the right instrument for firewalls, web proxies, and secure email gateways, because stopping known-malicious content at the edge is precisely what those controls are built for.
Behavioural, TTP-based testing asks a harder question: can a process on this host obtain credential material at all, regardless of which tool or route it uses? By the time endpoint and intrusion detection controls are involved, the adversary is almost always already executing. Artefacts are cheap to change; behaviour is not.
The problem is that even the IOC layer is degrading. The IOC-based prevention rate for malware downloads fell to 50% in this year’s data, down from 60% the previous year and 71% in 2024. That is a 21-point drop in two years from the layer that signature-based detection should, in principle, cover most reliably.
Picus Blue Report 2026 exposes the Mimikatz three-route test
The credential-dumping results are where the report becomes genuinely hard to explain away. Using MITRE ATT&CK technique T1003 (OS Credential Dumping) as the frame, Picus ran the same tool, Mimikatz, at the same objective via three different routes in customer environments.
Dumping credentials from LSASS process memory, the classic and heavily signatured path, was blocked in 94% of attempts. Pulling RDP credentials from other memory locations with the same tool: 17%. Reading LSA Secrets from the local registry: 3%. All three end with an attacker holding usable credential material. The only variable was how conspicuous the route was.
The mechanics explain the spread. The LSASS path is loud in a matchable way: a process opens a handle to lsass.exe and reads its memory, an event that vendors have instrumented for years. Reading LSA Secrets never touches lsass at all; it runs with SYSTEM privileges and reads a registry hive, behaviour that is largely indistinguishable from ordinary privileged activity. A control built around the first event has nothing to fire on for the second.
And even that 94% is thinner than it looks. It was measured against one known build of an open-source tool. Rename the strings a signature keys on, recompile it, load it reflectively so the code never lands on disk, or replace it entirely with a Microsoft-signed utility such as ProcDump or comsvcs.dll and parse the dump offline. Each approach ends the same way. The behaviour never changes; only the thing the signature was looking for does.
The same split runs across the full interior. Post-compromise, across all actions an authenticated attacker might take, only 37% were blocked. Loud actions fared better: lateral movement was caught around 90% of the time, UAC bypass around 85%, credential reuse and Active Directory abuse around 63%. Then the floor drops. Credential material read passively from memory and the registry was blocked 22% of the time, with local registry secret extraction blocked in less than 1%. Discovery and collection sat at 10%, with domain enumeration and local file collection running largely unopposed.
Detection fares no better on the logging side: the report records a 58% log score and a 14% alert rate, which means the visibility gap compounds the prevention gap.
The practical prescription the Picus Blue Report 2026 offers is not a larger stack. It is proving coverage by behaviour rather than by the one procedure a signature already recognises. Validating only the famous LSASS procedure closes an item on paper that remains genuinely open in practice, which the report describes as the most dangerously incorrect verdict a validation programme can produce. Running behavioural variations at scale across every route to a given technique is the only way to know whether the chain actually breaks where you think it does.
