Picus Blue Report 2026: 69% Perimeter Block Rate Drops to 37% Post-Compromise

The report isolates a clean split: noisy actions such as service-based lateral movement via Sharp-ServiceExec were blocked near 90%, and UAC bypasses near 85%. Quiet steps—domain mapping, share enumeration, and registry credential reads—remained below 22% prevention, with one registry variant under 1%. This pattern emerged from autonomous penetration testing run as authenticated users, exposing controls that trigger only on documented high-signal events.

Mimikatz testing confirmed the mechanism. The LSASS memory path triggered blocks in 94% of runs due to long-instrumented process handles. Identical objectives executed via registry reads or alternate memory locations produced near-zero prevention because they generate no matching event. The same binary, recompiled or loaded reflectively, evades the same signature stack entirely.

Enterprise telemetry investments have hardened the edge while leaving internal telemetry blind to standard privileged operations. The 58% logging high does not translate to prevention once the initial perimeter is passed. Attack chains that begin with enumeration therefore complete credential staging before any EDR rule fires.

Vendors must instrument registry and LSASS-alternative paths with behavioral baselines rather than process-specific signatures. Without those hooks, the measured 37% interior rate will persist regardless of further perimeter tuning.