Picus Research Finds Defenses Block Only 37% of Post-Compromise Attacker Actions

Analysis of more than 338 million attack simulations finds prevention improved, but significant gaps remain in post-compromise defense, ransomware protection and data-loss prevention

SAN FRANCISCO, Aug. 11, 2026 (GLOBE NEWSWIRE) -- Picus Security, the leading exposure validation company, today published The Blue Report 2026, which shows a sharp divide between the attacks organizations stop at the perimeter and the actions they prevent after an attacker gets inside. Prevention effectiveness recovered to 69%, returning to its 2024 peak. However, once an attacker gains access, only 37% of their actions get blocked.

Findings are based on analysis of more than 338 million attack simulations run in production environments between January and June 2026. The study showed that security controls perform best against conspicuous activity, including certain lateral movement and privilege escalation techniques. The largest post-compromise gaps involved low-noise activity. Quiet discovery and collection actions were blocked in approximately one in 10 attempts, allowing simulated attackers to enumerate domains, identify file shares, discover active sessions and collect credential material with limited resistance.

“Organizations have become much better at stopping attacker activity that creates obvious signals,” said Dr. Süleyman Ozarslan, co-founder of Picus Security and VP of Picus Labs. “The problem is what happens before those signals appear. Attackers can quietly map an environment, locate valuable systems and gather credentials while many defenses remain inactive. This is why validating defenses across the entire attack path is so critical.”

Detection and prevention gaps persist across the attack chain

The findings also point to a persistent gap between telemetry collection and actionable detection across industries. Organizations logged 58% of simulated attacks but generated alerts for only 14% of them. Fewer than one in seven attacks produced an alert. Performance issues accounted for 49% of identified detection-rule issues, up from 24%.

Other findings include:

• Evasion techniques were the hardest for controls to block: organizations blocked just 1% of Impair Command History Logging (T1562.003) simulations and 9% of Signed Script Proxy Execution (T1216) simulations, the two lowest technique-level prevention scores in the report. Prevention effectiveness against the Stealth tactic also weakened, from 53% to 47%, one of only two tactics for which controls performed worse than last year.
• Endpoint security improved as the assume-breach mindset took hold: endpoint prevention reached 83% and Privilege Escalation rose 24 points to 79%, the largest tactic-level gain of the year.
• Malware prevention fell again as IOC-based detection lost ground: malware-download prevention declined to 50%, down 21 points over two years.
• Strong performance is rented, not owned: last year’s strongest sectors regressed and last year’s weakest recovered. Transportation gained 29 points to reach 79%, Education lost 30 to land at 40%, South Asia moved from last place to a share of first at 71%, and North America fell to the lowest prevention score of any region at 60%.
  
  

Action items for security teams

Based on these findings, Picus recommends that organizations continuously test whether their controls can prevent, detect and contain current attacker behavior. This includes validating complete attack paths, particularly quiet post-compromise discovery, collection and credential-access activity.

Security teams should regularly test detection rules, confirm log-source health and verify that attacks generate actionable alerts. They should also strengthen behavioral detection to reduce reliance on static signatures and known indicators.

Organizations should simulate current ransomware and threat-group behavior across the full attack chain. Vulnerability remediation should prioritize demonstrated exploitability rather than severity scores alone.

About The Blue Report

The Picus Security Blue Report offers empirical evidence of how well security controls perform in real-world conditions. Findings are based on millions of simulated attacks executed by Picus Security customers from January to June 2026. The simulations were conducted safely in live production environments using Picus’ Security Validation Platform and analyzed by the Picus Labs and Picus Data Science teams. The report also includes ecosystem- and industry-specific findings and recommendations to help companies reduce exposure and improve threat readiness.

To read the full findings and recommendations, download the Blue Report 2026.

About Picus Security

Picus Security, the leading exposure validation company, proves what attackers can exploit and what your defenses stop, then closes real gaps with ready-to-deploy fixes and re-validates to confirm, at the machine speed today's AI threats demand. The Picus Platform spans Breach and Attack Simulation, Autonomous Penetration Testing and Exposure Validation, unified by Picus Swarm, a swarm of AI agents that runs the whole validation loop continuously with human oversight. With 75+ integrations, it reaches across on-prem, hybrid cloud, and endpoint environments.

Trusted by many Fortune 500 enterprises, Picus was named a 2025 Gartner Peer Insights Customers' Choice for Adversarial Exposure Validation and is recognized as an Innovation Leader in the Frost Radar for Automated Security Validation.

Follow Picus Security on X and LinkedIn.

Media Contact
Jennifer Tanner
Look Left Marketing
picus@lookleftmarketing.com

A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/bc3718a1-6b01-439f-a14c-0b2040de830d