"Change how Mimikatz dumps credentials, and prevention drops from 94% to 3%." That stark finding — reported by Sila Ozeren Hacioglu of Picus Security in the Blue Report 2026 — frames a wider problem: controls that detect known artifacts can give a false sense of security when attackers take quieter routes to the same objective.
Blue Report 2026 and 338 million simulated attacks
Picus Labs' Blue Report 2026 measured how enterprise prevention and detection perform in production across more than 338 million attack simulations run in customer environments from January through June 2026. The headline: overall prevention effectiveness rose from 62% to 69%, returning to the program’s 2024 peak. But that stack-wide average masks substantial variation between edge controls and what defenders actually stop once an adversary is inside.
IOC-based testing at the edge is slipping
The report separates two testing approaches with different purposes. IOC-based testing — delivering known-malicious samples to perimeter controls such as firewalls, web proxies, and secure email gateways — evaluates whether those controls recognize circulating malware. For that layer, performance has declined: IOC-based prevention of malware downloads fell to 50% across customer environments, down from 60% last year and 71% in 2024. A passing IOC score tells you what a control recognizes at the edge, not whether the behavior that completes the attack will be stopped later.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMimikatz experiment: the same outcome, three prevention rates
Picus Autonomous Penetration Testing ran a single credential-theft objective using Mimikatz three different ways inside customer environments. Results showed how much the attack route, not the objective, drives success:
- Dumping credentials from LSASS process memory (the classic, heavily signatured path) was blocked in 94% of attempts.
- Pulling RDP credentials from other memory locations with the same tool was blocked in 17% of attempts.
- Reading LSA Secrets from the local registry was blocked in 3% of attempts.
The difference reflects detectability. LSASS access is a noisy, matchable event: a process opens a handle to lsass.exe and reads memory, an action vendors have instrumented for years. Reading LSA Secrets runs as SYSTEM and reads a registry hive — activity indistinguishable from ordinary privileged operations, and therefore often invisible to signature-driven rules. The report also notes simple evasion paths — renaming strings signatures rely on, recompiling, reflective loading so the code never lands on disk, or using Microsoft-signed utilities such as ProcDump or comsvcs.dll and parsing a dump offline — all of which preserve the behavior while defeating artifacts signatures look for.
Inside the environment: prevention collapses to 37%
Autonomous penetration testing measures what an authenticated attacker can accomplish post-compromise. Across the full set of post-compromise actions in customer environments, only 37% were blocked. Put another way: the perimeter stopped about two attacks in three (the 69% figure); once an attacker is inside, controls prevented barely one in three.
Some loud actions were reliably caught: lateral movement was discovered around 90% of the time and UAC bypass around 85%; credential reuse and Active Directory abuse were detected in roughly 63% of attempts. Then performance drops sharply: credential material read passively from memory and the registry was blocked only 22% of the time, with local registry secret extraction blocked in less than 1% of attempts. Discovery and collection were blocked in 10% of attempts — the report calls out SharpHound domain enumeration and local file collection as running almost entirely unopposed. Detection failures underpinning those gaps show up as a 58% log score and a 14% alert rate in the dataset.
What this means for technologists, procurement leaders, and incident responders
- Technologists and security teams: Validate controls by behavior, not only by known artifacts. The report urges testing every route to an objective — LSASS memory, other memory regions, the registry, native tooling and recompiled builds — because a single signatureable procedure can hide a much larger coverage gap.
- Finance and procurement leaders: Adding more products is not the prescribed fix. The Blue Report stresses that what’s required is knowing which existing controls will actually "break the chain" so exposures become defensible decisions: Patch, Mitigate, Monitor, or Accept with Evidence.
- Incident responders and detection engineers: Prioritize behavioral detection content for post-compromise actions and expand validation to include automated, scaled variations. Picus recommends orchestration layers such as Picus Swarm to run many behavioral variations across an environment and validate coverage against deployed controls.
The arithmetic is clear and uncomfortable: artifacts are cheap to change, behavior is not. Signatures will keep catching the loud, familiar builds, but attackers who choose quieter routes will succeed unless defenders prove the behavior is covered. The Blue Report 2026’s test-by-behavior message is a direct challenge — validate the objective, not just the procedure.
Original: Your Controls Block Known Attacks. What About the Behavior?
