The Blue Report 2026 from Picus Labs shows enterprise prevention recovered to 69%, but the gains hide serious weaknesses in behavioral defenses, especially once attackers are inside the network. Testing across Mimikatz and other post-compromise techniques shows that signature-based controls often miss quieter variants, with credential dumping and registry-based attacks slipping through far more easily than classic LSASS memory access. #PicusLabs #BlueReport2026 #Mimikatz #LSASS #ProcDump #comsvcsdll #SharpHound #T1003
Keypoints
- Prevention effectiveness rose to 69%, but the overall average hides major gaps.
- IOC-based testing measures known-bad detection, while TTP-based testing measures whether an action is stopped.
- Malware download prevention fell to 50%, showing the edge is weakening.
- Mimikatz was blocked 94% of the time in LSASS memory dumping, but only 17% for another memory path and 3% for registry-based LSA Secrets access.
- Inside the environment, prevention dropped to 37%, and low-visibility actions like registry secrets extraction and SharpHound enumeration were barely stopped.