Defenses in enterprises focus on detecting noisy intrusions This article explores intrusions picus labs. . In Picus Labs' Blue Report 2026, over 338 million real attack simulations were conducted across actual client production environments in the first half of 2026.
For the first time, Picus Labs assessed post-compromise protection through autonomous penetration testing: what controls actually fail to prevent breaches when an attacker already has access as a legitimate user. Malicious code running in background or jumping between machines was largely thwarted: lateral movement through service execution and using techniques like Sharp-ServiceExec and SMBExec was stopped around 90% of the time, and UAC-bypass privilege escalation succeeded only about 85%.
However, this 94% figure is even less pronounced than it initially seems, as it was measured against a known build of an open-source tool whose recognizability stems from how it was compiled rather than what actions it performs. Alternatively, bypass Mimikatz entirely by using a pre-installed Microsoft-signed tool instead. Signature-based detection alone can’t keep up with the rapid pace of new malware: VirusTotal processes over two million new file entries daily, making signatures outdated while the underlying behavior remains unchanged.
It breaks down prevention and detection by industry and region, identifies the MITRE ATT&CK techniques defenders block least, and tracks how threat groups and ransomware families have eroded defenses this year despite an overall average rise.
