Picus finds simulated attacks raised an alert 14% of the time across 338 million runs
Picus Security's Blue Report 2026 puts prevention at 69% across 338 million simulated attacks. The vendor says prevention falls to 37% once an attacker has authenticated access, while the alert score has not moved from 14%.
The Watch · Security desk
Three key figures from Picus Security's Blue Report: log score 58%, up from 54%; alert score 14%, held flat; prevention score 69%, up from 62%.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Log score | 58% | up from 54% | 3 |
| Alert score | 14% | held flat | 4 |
| Prevention score | 69% | up from 62% | 2 |
What happened
- The log score rose from 54% to 58% in the same data set.
- Play ransomware fell from 50% to 13% prevention and became the hardest strain to prevent, even as the overall score rose.
- Quiet discovery and collection actions are stopped one time in ten.
Why it matters
- Who's exposed exposure An attacker who has obtained authenticated access meets weaker controls than the 69% headline implies, and discovery inside the network is where Picus's tests found the least resistance.
- What it limits constraint Better logging has not produced more alerts. The log score rose 4 points while the alert score stayed flat, and Picus says the weak step is turning telemetry into timely alerts.
- What doesn't add up contradiction The 37% is described as a post-authentication result in one place and as a per-action average in another, so citing it as an authenticated-access figure rests on one of the two wordings.
The 37% figure has two descriptions on the same page. The executive summary says prevention drops to 37% once an attacker has authenticated access [5]. The key findings say that, averaged across individual attacker actions tested, only 37% were blocked [6]. The two wordings are not obviously the same measurement, and the summary does not reconcile them. The full report sits behind a download form [17]. On either description the distance from the 69% prevention score is 32 points [21].
Detection moved less than prevention. Prevention gained 7 points [24]. The log score gained 4 [25] and reached a four-year high [9]. The alert score gained nothing [4]. Picus defines the log score as the share of simulated attacks that were logged and the alert score as the share that generated an alert [15], so the two sit 44 points apart [22]. Picus says turning telemetry into timely alerts remains the hardest part of the pipeline [16].
Picus reads the pattern as attackers favoring stealth. In its data, prevention fell for just two tactics, and stealth was one of them [13]. Low-noise actions had the highest success rates, and discovery and collection ran almost unopposed [19]. According to Picus, loud actions are caught, while an attacker inside can still map the domain with little resistance [18]. These are simulated scenarios, so they show what controls stop, not what intruders chose to do in real intrusions [8].
Signature-based defense lost ground over the same two years. Two years ago the malware download figure was 71% [23]. Picus ties the indicator-based result to signatures that cannot keep pace with nearly 2 million new files a day [11]. It says IOC-based prevention must be reinforced with TTP-based prevention [14]. Ransomware went the same direction while the overall score rose: every one of the ten least-prevented families scored 38% or lower [20].
The scores come from simulations that Picus customers ran between January and June 2026, anonymized and aggregated [8]. They describe organizations that already run attack simulations [8].
What to watch
- The full Blue Report PDF: whether it defines the 37% figure and breaks it out by industry, region and attack vector.
- The next Picus edition: whether the alert score moves off 14% and whether Play recovers from 13%.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives70
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Blue Report 2026 analyzes 338 million attack simulations to show how enterprise security controls stand up to attacks.
- [2]
Prevention Score went from 62% to 69%.
- [3]
Log Score went from 54% to 58%.
- [4]
Alert Score held flat at 14%.
- [5]
In the executive summary, Picus says that once an attacker has authenticated access, prevention drops to 37%.
- [6]
In the key findings, Picus says the average prevention score rose back to 69%, but averaged across individual attacker actions tested, only 37% were blocked.
- [7]
Quiet discovery and collection are stopped just one time in ten.
- [8]
Findings are based on simulated attack scenarios executed by Picus Security customers from January to June 2026, anonymized and aggregated from over 338 million attack simulations.
- [9]
The log score reached a four-year high, yet fewer than 1 in 7 simulated attacks produced a meaningful alert.
- [10]
Prevention of malware download scenarios fell to 50%, a 21-point slide over two years.
- [11]
Indicator-based malware defense sits at 50% because signatures cannot keep pace with nearly 2 million new files a day.
- [12]
Play ransomware fell from 50% to 13% prevention, becoming the hardest strain to prevent even as the overall score rose.
- [13]
Picus says adversaries are leaning into stealth: stealth was one of only two tactics to decline in prevention.
- [14]
Picus says IOC-based prevention will always trail the threat and must be reinforced with TTP-based prevention.
- [15]
Log Score is the share of simulated attacks that were logged. Alert Score is the share of simulated attacks that generated an alert.
- [16]
Picus says turning telemetry into timely alerts remains the hardest part of the pipeline.
- [17]
The full report is a PDF available through a download form on the Picus page; it covers performance by industry, region, attack vector and MITRE ATT&CK, plus ransomware and vulnerability spotlights.
- [18]
Picus says loud actions are caught, while an attacker inside can still map the domain with little resistance.
- [19]
The actions that succeeded most were the low-noise ones; discovery and collection ran almost unopposed.
- [20]
Every one of the ten least-prevented ransomware families scored 38% or lower.
- [21]
The gap between the 69% prevention score and the 37% figure is 32 percentage points.
- [22]
The log score (58%) and alert score (14%) are 44 percentage points apart.
- [23]
Malware download prevention two years ago was 71%.
- [24]
Prevention score gained 7 percentage points.
- [25]
Log score gained 4 percentage points.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- https://www.sans.org/info/237020
picussecurity.com
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Breach and Attack SimulationFollow
- Detection and alertingFollow
- RansomwareFollow
Entities
- Picus SecurityFollow
- Blue Report 2026Follow
- MITRE ATT&CKFollow