Picus Labs Report: Enterprise Perimeter Defenses Improve, Internal Security Weak Against Covert Attacks

Perimeter Defenses Show Improvement

The Picus Labs Blue Report 2026, based on over 338 million attack simulations, reveals a significant improvement in enterprise perimeter defenses. The average prevention effectiveness climbed from 62% to 69% in the first half of 2026, matching its 2024 peak. Logging effectiveness also reached a four-year high of 58%, indicating better visibility at the network edge.

Internal Security Weaknesses Exposed

Despite stronger perimeter defenses, the report highlights a critical vulnerability within enterprise networks once the perimeter is breached. The Post-Compromise Prevention Rate, measured by autonomous penetration testing, was a meager 37%. This means that internal controls stop barely one in three attacks after an adversary has gained initial access as an authenticated user.

Covert Attacks Go Undetected

The report further details that internal defenses are particularly ineffective against quiet attack techniques. Reconnaissance, such as mapping domains and enumerating shares, was the least-prevented category, stopped only 10% of the time. Credential theft from memory was stopped around 22% of the time, and pulling secrets directly from the registry was stopped in less than 1% of attempts. In contrast, noisier actions like lateral movement via service execution were blocked around 90% of the time, and UAC-bypass privilege escalation was stopped approximately 85% of the time.

Implications for Enterprise Security

This disparity indicates that while EDR solutions are effective at detecting and preventing overt malicious behavior, enterprises are largely exposed to stealthy internal activities. Attackers can map environments and harvest credentials with minimal resistance once they are inside the network. This suggests a need for organizations to re-evaluate and strengthen their internal security controls to counter these quiet, pre-breach activities effectively.