Picus Blue Report 2025

The Picus Blue Report 2025 analyzes over 160 million simulated attacks to assess real-world prevention and detection effectiveness, revealing a drop in average prevention (69% -> 62%), very low data exfiltration prevention (3%), high password cracking success (46%) and near-universal success for Valid Accounts abuse (98% failure to prevent). The report documents uneven product performance in production, persistent SIEM/logging and detection pipeline gaps (log score 54%, alert score 14%), weak prevention of key MITRE techniques (Valid Accounts 2%, Data Encoding 3%), low prevention rates for many 2024–2025 CVEs, and continuing challenges defending against ransomware (BlackByte, BabLock) and diverse threat groups, concluding that continuous adversarial exposure validation and behavioral detection are required to close these critical gaps.