Recent data indicates that while enterprise security measures have bolstered perimeter defenses, internal protections remain inadequate, particularly against stealthy cyberattacks.
According to Picus Labs’ latest Blue Report 2026, which analyzed over 338 million attack simulations in client production environments during the first half of 2026, average prevention effectiveness has risen from 62% to 69%, matching its 2024 peak. Additionally, logging effectiveness has reached a four-year high of 58%.
However, this improvement is predominantly observed at the network perimeter. Once attackers breach this outer layer, internal defenses are significantly less effective. The report introduces the Post-Compromise Prevention Rate, measuring the ability to halt attacks after an adversary gains authenticated access. This rate stands at a mere 37%, indicating that internal defenses stop only about one in three attacks.
The disparity is further highlighted when examining specific attack techniques. Noisy actions, such as lateral movement through service execution using methods like Sharp-ServiceExec and SMBExec, are blocked approximately 90% of the time. Similarly, privilege escalation via User Account Control (UAC) bypass is prevented in about 85% of cases. These figures suggest that Endpoint Detection and Response (EDR) systems are effectively identifying and mitigating overt malicious activities.
In contrast, stealthy operations face minimal resistance. Reconnaissance activities, including domain mapping and share enumeration, are thwarted only 10% of the time. Credential theft methods, such as reading credentials from memory, are blocked in about 22% of instances, while extracting secrets from the registry is stopped in less than 1% of attempts. This indicates that attackers can quietly gather critical information with little interference before initiating more conspicuous actions.
A notable example from the report involves the credential-theft tool Mimikatz. When used to dump credentials directly from the LSASS process memory—a well-known and heavily monitored method—the attack is blocked almost every time. However, when Mimikatz retrieves credentials from other memory locations or the registry, the success rate of the attack increases dramatically. This suggests that security controls are more attuned to specific, recognizable attack patterns and may overlook variations of the same threat.
These findings underscore a critical vulnerability within enterprise security frameworks: while perimeter defenses have improved, internal protections against subtle, low-noise attacks are lacking. Organizations must enhance their internal security measures to detect and prevent stealthy activities, such as reconnaissance and credential theft, to effectively safeguard against sophisticated cyber threats.
In light of these insights, it’s imperative for enterprises to adopt a more holistic security approach. Strengthening internal defenses, improving detection capabilities for subtle attack vectors, and regularly updating security protocols can help close the gap between perimeter and internal security effectiveness. As cyber threats continue to evolve, a comprehensive and adaptive security strategy is essential to protect organizational assets and data.
