--- title: Your Controls Block Known Attacks. What About the Behavior? description: Picus Security's Blue Report 2026, based on over 338 million attack simulations across customer environments from January through June 2026, shows overall... canonical: https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Controls Block Known Attacks. What About the Behavior? | daily.dev og:description: Picus Security's Blue Report 2026, based on over 338 million attack simulations across customer environments from January through June 2026, shows overall... og:url: https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu og:image: https://api.daily.dev/og/posts/Eto0TdJDU.png og:image:alt: Your Controls Block Known Attacks. What About the Behavior? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Controls Block Known Attacks. What About the Behavior? **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 7 min read · 1 upvotes · 1 comments ## Summary Picus Security's Blue Report 2026, based on over 338 million attack simulations across customer environments from January through June 2026, shows overall prevention effectiveness recovered to 69%, but the aggregate masks huge gaps. Testing the same Mimikatz credential-dumping technique (T1003) three different ways revealed prevention rates of 94% for the classic LSASS memory approach, 17% for RDP credentials from alternate memory, and just 3% for LSA Secrets read from the registry. Post-compromise, only 37% of attacker actions inside an environment were blocked overall, with credential access from memory/registry blocked only 22% of the time and discovery/collection activity (like SharpHound enumeration) stopped only 10% of the time. The piece argues organizations need behavioral, TTP-based validation in addition to IOC-based signature testing to catch quieter variants of known attack techniques, and promotes Picus's autonomous testing and Picus Swarm orchestration tooling. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does Mimikatz get blocked 94% of the time when dumping LSASS memory but only 3% when reading LSA Secrets from the registry? Prevention controls are built around specific detectable events, not the underlying behavior. Dumping LSASS memory triggers a well-instrumented event (a process opening a handle to lsass.exe), which is blocked in about 94% of attempts. Reading LSA Secrets from the registry runs as SYSTEM and looks like ordinary privileged activity, with no matching signature, so it is blocked only 3% of the time despite achieving the same credential theft goal under MITRE technique T1003. _Teams weighing signature versus behavioral detection coverage can track findings like this on daily.dev._ ### What percentage of post-compromise attacker actions do enterprise security controls actually block once an attacker is already inside as an authenticated user? Only 37% of post-compromise actions were blocked across customer environments tested with autonomous penetration testing between January and June 2026. Loud actions like lateral movement (about 90%) and UAC bypass (about 85%) were caught reliably, but quieter actions like passive credential reads from memory and registry (22%) and discovery/collection activity such as SharpHound enumeration (10%) went almost entirely unopposed. _Security engineers benchmarking internal detection coverage can follow findings like these on daily.dev._ ### How much did IOC-based malware download prevention rates decline for enterprise security controls between 2024 and now? IOC-based prevention of malware downloads fell to 50% across customer environments, down from 60% the prior year and 71% in 2024, a 21-point drop over two years. This decline occurred even though overall stack-wide prevention effectiveness recovered from 62% to 69% in the same period, showing perimeter signature-based defenses eroding even as aggregate scores improved. _Anyone tracking how perimeter defenses hold up over time can follow security benchmarks like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 0 upvotes > Detection tests should rotate execution paths for the same ATT&CK technique. LSASS memory reads and LSA Secrets should be separate regression cases. ## Similar posts on daily.dev - [How to improve your organization's security based on compromise assessment findings](https://daily.dev/posts/how-to-improve-your-organization-s-security-based-on-compromise-assessment-findings-jf4fzwgg5) · Securelist · 0 upvotes · 0 comments - [Routine Access Is Powering Modern Intrusions, a New Threat Report Finds](https://daily.dev/posts/routine-access-is-powering-modern-intrusions-a-new-threat-report-finds-id7ymbim2) · BleepingComputer · 0 upvotes · 0 comments - [Credential Stuffing: A Defender’s Guide to Detecting Automated Login Attacks](https://daily.dev/posts/credential-stuffing-a-defender-s-guide-to-detecting-automated-login-attacks-wqhb4uiu9) · Latest Hacking News · 0 upvotes · 0 comments - [Now, defenders are embracing the prompt injection, too](https://daily.dev/posts/now-defenders-are-embracing-the-prompt-injection-too-mgu0dfkqx) · Ars Technica · 3 upvotes · 0 comments - [AI Has Cut Post-Compromise Timelines to Minutes. Your Validation Cadence Needs to Catch Up.](https://daily.dev/posts/ai-has-cut-post-compromise-timelines-to-minutes-your-validation-cadence-needs-to-catch-up--zu3x3zrcx) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Controls Block Known Attacks. What About the Behavior?","url":"https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu"},"datePublished":"2026-08-18T14:08:22.475Z","dateModified":"2026-09-14T09:02:07.108Z","description":"Picus Security's Blue Report 2026, based on over 338 million attack simulations across customer environments from January through June 2026, shows overall...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/982bef33bbbc10be6f08940c43d0c59d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/982bef33bbbc10be6f08940c43d0c59d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Your Controls Block Known Attacks. What About the Behavior?"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu","comment":[{"@type":"Comment","text":"Detection tests should rotate execution paths for the same ATT&CK technique. LSASS memory reads and LSA Secrets should be separate regression cases.","datePublished":"2026-08-25T05:15:54.637Z","url":"https://daily.dev/posts/Eto0TdJDU#c-kZOKitm9h","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-controls-block-known-attacks-what-about-the-behavior--eto0tdjdu#faq","mainEntity":[{"@type":"Question","name":"Why does Mimikatz get blocked 94% of the time when dumping LSASS memory but only 3% when reading LSA Secrets from the registry?","acceptedAnswer":{"@type":"Answer","text":"Prevention controls are built around specific detectable events, not the underlying behavior. Dumping LSASS memory triggers a well-instrumented event (a process opening a handle to lsass.exe), which is blocked in about 94% of attempts. Reading LSA Secrets from the registry runs as SYSTEM and looks like ordinary privileged activity, with no matching signature, so it is blocked only 3% of the time despite achieving the same credential theft goal under MITRE technique T1003. Teams weighing signature versus behavioral detection coverage can track findings like this on daily.dev."}},{"@type":"Question","name":"What percentage of post-compromise attacker actions do enterprise security controls actually block once an attacker is already inside as an authenticated user?","acceptedAnswer":{"@type":"Answer","text":"Only 37% of post-compromise actions were blocked across customer environments tested with autonomous penetration testing between January and June 2026. Loud actions like lateral movement (about 90%) and UAC bypass (about 85%) were caught reliably, but quieter actions like passive credential reads from memory and registry (22%) and discovery/collection activity such as SharpHound enumeration (10%) went almost entirely unopposed. Security engineers benchmarking internal detection coverage can follow findings like these on daily.dev."}},{"@type":"Question","name":"How much did IOC-based malware download prevention rates decline for enterprise security controls between 2024 and now?","acceptedAnswer":{"@type":"Answer","text":"IOC-based prevention of malware downloads fell to 50% across customer environments, down from 60% the prior year and 71% in 2024, a 21-point drop over two years. This decline occurred even though overall stack-wide prevention effectiveness recovered from 62% to 69% in the same period, showing perimeter signature-based defenses eroding even as aggregate scores improved. Anyone tracking how perimeter defenses hold up over time can follow security benchmarks like this on daily.dev."}}]} ```