🟡 Medium | Source: The Hacker News
Picus Labs’ Blue Report 2026, based on over 338 million attack simulations run in live production environments, finds that perimeter defences are performing well but attackers are increasingly bypassing them by operating quietly inside networks. The data shows a significant gap between edge prevention rates and lateral movement detection, meaning organisations are stopping the loud attacks but missing the subtle ones. This matters because low-and-slow techniques — such as credential abuse and living-off-the-land — are slipping through once initial access is achieved.
Security Architect’s Take: Audit your detection coverage for post-compromise behaviours rather than focusing solely on perimeter controls — prioritise use cases around lateral movement, credential misuse, and living-off-the-land techniques in your SIEM or XDR platform, and use continuous breach and attack simulation (BAS) tooling to validate internal detection gaps against real attack paths.
Original advisory: Enterprise Defenses Recovered at the Edge and Collapsed Inside