Enterprise defenses are tuned to catch the attacks that make noise. This year's data shows attackers winning by making none.
According to Picus Labs' new Blue Report 2026, which measured more than 338 million real attack simulations across actual client production environments in the first half of 2026, defenses are having one of their strongest years yet. Average prevention effectiveness climbed from 62% to 69%, matching its 2024 peak, and logging reached a four-year high of 58%.
The good news: The recovery is real. The bad news: It's taking place almost exclusively at the perimeter.
The report's sharper finding is what happens after that perimeter is crossed. Inside, the picture inverts: defenses that look strong from the outside turn soft, and are the softest of all against the quiet moves, the reconnaissance and credential theft that precede every serious breach.
This is a fault line that runs through the entire report.
