Enterprise Defenses Recovered at the Edge, Collapsed Inside

### Enterprise Defenses Show Improvement at the Perimeter A new report by Picus Labs has found that enterprise defenses have made significant improvements in preventing attacks at the perimeter. The report, which measured over 338 million real attack simulations across actual client production environments in the first half of 2026, found that average prevention effectiveness climbed from 62% to 69%, matching its 2024 peak, and logging reached a four-year high of 58%. ### A Fault Line Runs Through the Report However, the report also reveals a fault line that runs through the entire report. While defenses are strong at the perimeter, they are struggling to prevent quiet attacks inside the network. The report's sharper finding is that defenses that look strong from the outside turn soft inside, and are the softest of all against the quiet moves, the reconnaissance and credential theft that precede every serious breach. ### Post-Compromise Prevention Rate Remains Low The report's measurement of post-compromise prevention with autonomous penetration testing found that the Post-Compromise Prevention Rate was a meager 37%. This means that defenses stop barely one in three attacks inside the network. The report also found that the interior does not fail evenly, but rather fails along one clean line. Noisy actions get caught, while quiet ones don't. ### Malicious Behavior vs. Quiet Work The report found that malicious behavior, such as running code or jumping between machines, was blocked most of the time. However, the quiet work, such as reconnaissance, mapping the domain and enumerating shares and sessions, was the least-prevented category of all, only being stopped a paltry 10% of the time. Defenses did a little better at detecting credentials being quietly read out of memory at around 22%, and one variant, pulling secrets straight from the registry, was stopped in less than 1% of attempts. ### A Signature Catches the Famous Attack, Not the Behavior The report found that the same credential-theft tool, Mimikatz, was run at the same objective three ways, and the prevention scores could not have been further apart. Dumping credentials the classic, heavily signatured way, straight from LSASS process memory, was blocked almost every time. However, pulling them from other memory locations, or reading them from the registry, was almost never blocked at all. The report found that the only variable between these three was how conspicuous the route was. ### Stealth Pays Off for Attackers The report found that stealth pays off for attackers, and that the gap between what gets logged and what gets alerted is now a detection-engineering problem, not a collection one. The report also found that the single least-prevented technique in the entire dataset was hiding command history, stopped just 1% of the time. The behaviors defenders miss are exactly the low-noise ones that today's evasion-minded attackers rely on. ### Indicator-Based Testing Still Matters The report found that indicator-based testing still matters, but it's the fastest way to confirm the edge stops what is already known. However, it only ever checks the paths someone already wrote a signature for. It has to be paired with behavioral testing that asks whether the action itself is being stopped. ### Organizations Can See the Attacks They Can't Stop The report found that organizations can see the attacks they can't stop, and that the gap between what gets logged and what gets alerted is now a detection-engineering problem, not a collection one. The report also found that the sector that had been weakest a year earlier posted the largest gain in the dataset. ### What the Numbers Are Telling Us The report found that the recovery is itself the proof, and that prevention climbed seven points because organizations re-tested controls that had drifted and fixed what the tests exposed. The report also found that validation's no longer an annual audit; it's the difference between this year's winners and losers, and it only holds while it runs. ### Three Moves to Improve Defenses The report found that there are three moves to improve defenses: * Validate exposure, not inventory. Prove which exposures are actually exploitable in your environment instead of spinning your wheels cataloging theoretical ones. * Harden the interior against quiet actions. Test discovery, share and session enumeration, and passive credential access as rigorously as lateral movement, with detection that triggers on what an action does, not which signature it matches. * Treat detection rules as engineering. Write them against current behavior, confirm they fire, tune out the noise, and re-validate as things change, so logs finally become alerts. ### Read the Full Report The full report by Picus Labs provides more detailed information on the findings and recommendations outlined above. It is available for download on the Picus Labs website.