[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fErd06X0V_NtuUccpMZBfKNbc5qSFpVqxxV6BicG14OU":3},{"article":4,"iocs":53,"watch_terms":70,"solutions":71,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f3b270d9-8ca4-4e64-8282-707c7b0c1f0a","Enterprise Defenses Recovered at the Edge and Collapsed Inside","enterprise-defenses-recovered-at-the-edge-and-collapsed-inside-45d8ea","Enterprise defenses are tuned to catch the attacks that make noise. This year's data shows attackers winning by making none. According to Picus Labs' new Blue Report 2026, which measured more than 338 million real attack simulations across actual client production environments in the first half of 2026, defenses are having one of their strongest years yet. Average prevention effectiveness","Picus Labs' Blue Report 2026, analyzing 338 million attack simulations, shows enterprise perimeter defenses improved to 69% prevention effectiveness, but post-compromise detection inside networks collapsed to just 37%. Attackers bypass internal controls by using quiet techniques like reconnaissance and credential theft that generate minimal noise, while noisy lateral movement is caught 90% of the time, exposing a critical gap between edge and interior security postures.","Picus Labs Blue Report 2026 reveals perimeter defenses strong but internal post-compromise detection rates critically","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fenterprise-defenses-recovered-at-edge.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjoBNKr6YWBC4uPzzXNZNX_sduYkalrtPSfiT01s6R6tq9uRzAs8TRoyv0DSwM-Wy_RmiGv923yzsB1DK3mgg5vudYdTwIk7wubUJYB0f-6AADquodryt0KofkU5aKxKaKBLirP1A0PuaBC_lfWEYJKlthyphenhyphencmmT2WBQkIRLLFLI5kWKZcJWY5rxrN-qa2M\u002Fs1600\u002Fpicuss.jpg","2026-08-12T11:41:34+00:00","2026-08-12T14:00:16.090881+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Picus Labs","vendor",{"name":21,"type":22},"Mimikatz","product",{"name":24,"type":25},"EDR (Endpoint Detection and Response)","technology",{"name":27,"type":25},"LSASS process memory",{"name":29,"type":25},"SMBExec",{"name":31,"type":25},"Sharp-ServiceExec","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[54,57,61,64,67],{"type":55,"value":21,"context":56},"malware","Credential theft tool used in attack simulations; demonstrates signature evasion when executed via registry versus LSASS process memory",{"type":58,"value":59,"context":60},"mitre_attack","T1087","Account enumeration \u002F reconnaissance techniques barely blocked (10% prevention rate)",{"type":58,"value":62,"context":63},"T1110","Credential access via memory dumping and registry reading with \u003C1% prevention for registry variant",{"type":58,"value":65,"context":66},"T1021.002","Lateral movement via service execution (Sharp-ServiceExec, SMBExec) blocked ~90% of the time",{"type":58,"value":68,"context":69},"T1548.002","UAC bypass privilege escalation blocked ~85% of the time",[18,21],{"controls":72,"vendors":160},[73,102,131],{"slug":74,"name":75,"problem":76,"products":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":103,"name":104,"problem":105,"products":106},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":132,"name":133,"problem":134,"products":135},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",[161],{"slug":162,"name":163,"logo_path":164,"roles":165},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png",[166],"reported_by",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":182},"perimeter-strength-masks-catastrophic-internal-detection-failures","Perimeter Strength Masks Catastrophic Internal Detection Failures","Organizations have invested heavily in edge defenses, pushing perimeter prevention to 69%, but internal detection has collapsed to just 37% — meaning attackers who breach the perimeter operate largely undetected inside the network. Adversaries deliberately exploit this gap by using low-noise techniques such as passive reconnaissance and credential theft, which generate insufficient telemetry to trigger alerts. This creates a dangerous false sense of security where strong perimeter metrics obscure a critically weak interior posture. The asymmetry matters enormously: a single perimeter bypass grants attackers a vast, undermonitored internal environment in which to operate freely.",[172,173,174,175,176,177,178,179,180,181],"CIS Control 13 – Network Monitoring and Defense","CIS Control 8 – Audit Log Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 AC-4 – Information Flow Enforcement","NIST SP 800-207 – Zero Trust Architecture","MITRE ATT&CK – Discovery Tactic (TA0007)","MITRE ATT&CK – Credential Access Tactic (TA0006)","NIST Cybersecurity Framework DE.CM – Continuous Monitoring","ITIL – Event Management & Continual Service Improvement",{}]