Enterprise defenses are increasingly adept at thwarting 'noisy' attacks at the perimeter. **Picus Labs' Blue Report 2026**, which analyzed over 338 million real attack simulations in client production environments, shows average prevention effectiveness climbing from 62% to 69%, matching its 2024 peak. Logging also reached a four-year high of 58%.  While this recovery in perimeter defense is real, the report's more concerning finding emerges once that perimeter is breached. Inside the network, defenses that appear strong from the outside often prove to be alarmingly soft, particularly against quiet reconnaissance and credential theft – actions that precede virtually every major breach.  ## A Vulnerable Interior Behind a Recovering Perimeter For the first time, **Picus Labs** measured post-compromise prevention using autonomous penetration testing. The **Post-Compromise Prevention Rate** was a meager 37%. This means that while perimeter defenses block about two-thirds of attacks, interior defenses stop barely one in three once an adversary is operating inside the network as an authenticated user. This average, however, conceals a crucial pattern: the interior's failure is not uniform. Noisy actions are often caught, while quiet ones are not.  Malicious behaviors involving code execution or lateral movement, such as **Sharp-ServiceExec** and **SMBExec**, were blocked around 90% of the time. **UAC-bypass privilege escalation** also saw an 85% success rate in prevention. This indicates that **EDR** solutions and years of 'assume-breach' investments are effectively addressing high-profile, noisy threats. Conversely, quiet reconnaissance – mapping domains, enumerating shares and sessions – was the least-prevented category, stopped only 10% of the time. Defenses fared slightly better at detecting credential theft from memory (22%), but pulling secrets directly from the registry was prevented in less than 1% of attempts. Attackers can map environments, harvest sessions, and steal credentials with minimal resistance before escalating to noisier, more detectable actions. ## Signatures Catch the Famous, Not the Behavior One particular finding illustrates this disparity: the credential-theft tool **Mimikatz** was tested in three ways with vastly different prevention scores. Dumping credentials via the classic, heavily-signatured method from **LSASS** process memory was blocked almost every time. However, pulling them from other memory locations or directly from the registry was almost never blocked.  This highlights a critical flaw: a prevention score based on signatures primarily reflects the ability to catch known threats, not the underlying malicious behavior. Renaming strings, loading in memory, or using legitimate **Microsoft** utilities can bypass these signature-based detections, achieving the same malicious outcome undetected. ## Stealth Pays Off for Attackers The **Red Report 2026** corroborates this, indicating a deliberate shift by attackers towards stealthy tactics. The **Blue Report** confirms that these behaviors are highly effective. The least-prevented technique in the entire dataset was hiding command history, stopped in just 1% of attempts. The behaviors defenders miss are precisely the low-noise ones favored by today's evasion-minded adversaries. Malware defense is also slipping. The **IOC-Based Prevention Rate** for known-malicious files delivered as downloads fell to 50% this year, down from 60% last year and 71% in 2024.  Signature-based defenses struggle to keep pace with the nearly two million new files uploaded to **VirusTotal** daily. Repacking a payload renders an indicator stale while the underlying malicious behavior remains. While indicator-based testing is valuable for confirming perimeter defenses against known threats, it must be complemented by behavioral testing to truly assess whether malicious actions are being stopped. ## Organizations See Attacks They Can't Stop Beyond prevention, detection serves as the critical fallback when controls fail. While logging reached a four-year high of 58%, the alert score remained frozen at a mere 14%. This means fewer than one in seven simulated attacks generated an alert. Organizations are collecting more telemetry than ever, but converting very little of it into actionable alerts. This gap between logged events and actual alerts points to a significant detection-engineering challenge, rather than a collection problem. Intriguingly, the report also notes a shift in performance, with last year's leaders often becoming this year's laggards, and vice versa, sometimes by significant margins.