Your security tools stopped the obvious attack. They missed the sneaky one.
A new Picus Security report shows defenses catch famous techniques but let quieter variations walk right through.
Key points
- Picus Security's Blue Report 2026 tested how well corporate security tools block real attack behaviours, not just known malware samples.
- Prevention rates swing wildly between attack techniques, with some blocked over 90% of the time and near-identical variants missed almost entirely.
- The gap is worst when attackers use built-in operating system tools instead of custom malware, an approach known as "living off the land".
- Picus argues that companies should test their defenses against attacker behaviour continuously, not once a year in a formal audit.
- The report is aimed at security teams but the takeaway is simple: passing a compliance checklist is not the same as being safe.
Security software is very good at spotting attacks it has seen before. It is much worse at spotting the same attack wearing a slightly different hat.
That is the uncomfortable finding in the Blue Report 2026 from Picus Security, a company that tests corporate defenses by safely simulating real attacks. First reported by BleepingComputer, the study looked at how often widely deployed security tools actually stop attacker behaviour, rather than just known bad files.
The numbers are all over the place. And that is the point.
What did the report actually find?
Companies block famous attack techniques well, but miss quieter versions of the same thing. Picus ran millions of simulated attacks against real customer environments and found prevention rates that varied dramatically from one technique to the next, even when the end goal was identical.
In practice, this means a company can proudly show an auditor that it blocks a well-known hacking tool, while a different tool doing the same job slips past unnoticed. The failure mode here is pattern matching. Security products learn what bad looks like, and attackers just change what it looks like.
Why do the same defenses catch one attack and miss another?
Because most defenses were built to spot signatures, not behaviour. A signature is a fingerprint of a specific piece of malicious software, which is malware, meaning software written to do harm. Change the fingerprint and the alarm goes quiet.
Attackers know this. Increasingly they use "living off the land" techniques, where the criminals abuse tools that are already built into Windows or Linux, such as PowerShell or scheduled tasks, instead of dropping their own malware. Nothing looks obviously wrong, because nothing obviously foreign is running.
Picus found this category especially poorly defended. One thing the post-mortem will say, again, is that the intruder never needed custom code.
What does this mean for regular businesses?
It means that buying the security product is not the same as being protected by it. Configuration matters. Testing matters more.
The report pushes what the industry calls behavioural testing, or continuous validation: quietly running fake attacks against your own network to see what your tools actually catch, then fixing the gaps. Think of it as a fire drill for the security stack, not a one-off inspection.
For customers and staff of any company, the practical read is boring but true. Ask whether your bank, your employer, or your health provider tests its defenses regularly, not just annually. A yearly penetration test is a snapshot. Attackers work every day.
| Attack style | How defenses tend to do |
|---|---|
| Known malware families | Blocked reliably |
| Slight variants of the same malware | Often missed |
| Built-in OS tools abused by attackers | Poorly detected |
| Data theft over normal web traffic | Frequently missed |
The operational takeaway
If your security programme cannot tell you what it blocked yesterday against live attacker behaviour, it is measuring paperwork, not risk.
