[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKdagkQQMEhTXeYRR8hMrvcVfJVHrU_PnEgnmjAKru8s":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"89fac473-1967-41a6-aa9a-48a8f3d63e52","Your Controls Block Known Attacks. What About the Behavior?","your-controls-block-known-attacks-what-about-the-behavior-a83ffd","Security controls can block a familiar attack method while missing quieter ways to achieve the same objective. Picus Security's Blue Report 2026 shows how prevention rates can vary dramatically by technique and why behavioral testing is needed to uncover those gaps. [...]","Picus Security's Blue Report 2026 reveals that while overall prevention effectiveness has risen to 69%, this average masks significant gaps. Security controls are adept at blocking well-known attack tools but frequently miss less conspicuous methods achieving the same objectives. The report emphasizes the need for behavioral (TTP-based) testing over solely IOC-based testing to uncover these vulnerabilities, as artifacts are easily changed while core behaviors are more persistent.","Picus Security's Blue Report 2026 highlights that security controls often miss quieter attack variants despite blocking","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fyour-controls-block-known-attacks-what-about-the-behavior\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F08\u002F12\u002FBleepingComputer-OrganicArticle-BlueReport2026-1600x900px.jpg","2026-08-18T14:01:11+00:00","2026-08-18T16:00:15.5782+00:00",8,[17,20,23],{"name":18,"type":19},"Picus Security","vendor",{"name":21,"type":22},"Blue Report 2026","product",{"name":24,"type":25},"OS Credential Dumping","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[50],{"type":51,"value":52,"context":53},"malware","Mimikatz","Tool used for credential dumping, with prevention rates varying significantly based on the method employed.",[18,21],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":87,"name":88,"problem":89,"products":90},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png","nodezero","NodeZero","https:\u002F\u002Fhorizon3.ai\u002Fnodezero\u002F","Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-enterprise","AttackIQ Enterprise","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fenterprise\u002F","Continuous, automated adversary emulation across the environment, with full control over scenarios and schedules.",{"vendor_slug":108,"vendor_name":18,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"picus-security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[144],{"slug":108,"name":18,"logo_path":109,"roles":145},[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":161},"prevention-rates-hit-69-but-behavioral-blind-spots-leave-orgs-exposed","Prevention Rates Hit 69%, But Behavioral Blind Spots Leave Orgs Exposed","Organizations have become proficient at blocking known attack tools and indicators of compromise (IOCs), but adversaries routinely achieve the same objectives using lesser-known or custom methods that bypass signature-based controls. Picus Security's Blue Report 2026 highlights that a 69% average prevention rate masks critical gaps where TTPs (Tactics, Techniques, and Procedures) go undetected simply because the artifact — not the behavior — changed. This matters because attackers can trivially swap out tools and IOCs, while the underlying behavior remains consistent and persistent. Relying solely on IOC-based detection creates a false sense of security, leaving organizations vulnerable to the majority of real-world intrusions that use stealthy or novel variations of well-known attack patterns. Shifting to behavioral, TTP-based testing and detection is essential to closing this gap.",[152,153,154,155,156,157,158,159,160],"MITRE ATT&CK Framework (TTP-based threat modeling)","CIS Control 17 – Incident Response Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SI-4 (System Monitoring)","NIST CSF DE.CM-1 (Network Monitoring)","NIST CSF ID.RA-3 (Threat Intelligence Integration)","NIST SP 800-115 (Technical Guide to Information Security Testing)","ITIL Continual Service Improvement – Control Validation",{}]