Company
Security validation vendor whose platform runs breach and attack simulation against customers' production defences and recommends control changes.
Picus Security's Blue Report 2026 puts prevention at 69% across 338 million simulated attacks. The vendor says prevention falls to 37% once an attacker has authenticated access, while the alert score has not moved from 14%.
Reality
A post at The Hacker News puts published CVEs up roughly 49 percent year over year and observed exploitation at 495. For operators the figure that changes triage is the 116 attacked on the day they went public.
Reality
PaperCut told NG and MF customers on August 27 that servers were already being exploited, with no CVE and no fix available. A patch that held arrived on September 1, and Picus Security says that gap is now the normal shape of a zero-day.
Reality
Picus's Blue Report blames performance issues and log-collection gaps for the misses, both of them configuration work, which is why an AI SOC pointed at that pipeline would only get faster at the one action in seven that already alerts.
Reality
Two years of SIEM ingestion cuts left the data layer that agentic detection will run on, and 24% of security leaders now rank visibility above staffing as their top barrier.
Reality
Picus says its 338-million-simulation dataset shows prevention recovering. The same dataset shows one credential-dumping tool blocked 94% of the time by one route and 3% by another.
Reality