Attackers Slip Past the Perimeter, Then Run Free Inside: Blue Report 2026

Key points

• Picus Labs ran more than 338 million simulated attacks inside real customer networks in the first half of 2026 for its Blue Report 2026.
• Perimeter defences, the tools that guard the edge of a network, are having their strongest year on record.
• Once attackers get past that edge, internal detection has collapsed, letting them move around unseen.
• The gap means a single successful phishing email or stolen password can still lead to a full breach.
• Security teams are advised to test defences from the inside out, not just at the boundary.

Enterprise security tools are catching the loud attacks. They're missing the quiet ones.

That's the headline finding from the Blue Report 2026 published by Picus Labs, the research arm of security-testing firm Picus. The team ran more than 338 million attack simulations across real client production environments during the first six months of 2026, first reported by The Hacker News. The results paint a split picture.

At the perimeter, defences are performing well. Average prevention effectiveness, the share of attacks blocked before they land, is at one of its highest recorded levels. Firewalls and email filters are catching more of the obvious threats.

Inside the network, it falls apart.

What is actually going wrong?

Once attackers pass the front gate, most companies barely see them. Detection tools inside the network, those meant to spot a criminal already walking the corridors, are missing most of the activity Picus threw at them.

Think of it like a bank with a solid front door and no cameras in the vault. If someone talks their way past reception with a stolen badge or a convincing lie, nothing else stops them. They can copy files and walk out.

In cyber terms, that stolen badge is usually a password harvested through phishing, where criminals send fake emails to trick staff into entering credentials on a lookalike site. Or it's a session token lifted from a compromised laptop. Either way, the attacker arrives looking like a real employee.

Why the imbalance?

Money and attention have gone to the edge for a decade. Companies bought better firewalls, email gateways and cloud filters. Those investments show in the numbers.

Internal detection is harder. It means watching normal employee behaviour and spotting the login or file copy that doesn't fit. That takes sustained effort and constant testing, and most teams don't have either. Picus found that many organisations had detection rules written but not actually firing, or firing into a queue nobody reads. Our 1 July story "Detection Engineering Grew Up. Most Security Stacks Didn't." traced exactly this dynamic: vendor-supplied rules aging out while teams lack the capacity to replace them.

What the numbers show

Should ordinary people care?

Yes, in a practical way. When a company you deal with gets breached, the pattern is almost always the one Picus describes: someone got in through a phishing email or a reused password, then wandered for days before anyone noticed. That wandering time is when your data gets copied.

The usual advice still holds. Use a password manager so each site has a unique credential. Turn on two-factor authentication, the code sent to your phone or generated by an app, wherever it's offered. Treat unexpected login requests in your inbox as hostile until proven otherwise.

What security teams are being told to do

Picus recommends testing defences the way an attacker would: assume the perimeter will fail and see what happens next. That means running simulated intrusions inside the network, checking whether alerts reach a human, and closing the gap between a detection rule existing on paper and working in practice.

The front door is holding. What's behind it isn't.