BLUE REPORT 2025

The Picus Blue Report 2025 is an annual research study that analyzes the real-world effectiveness of cybersecurity controls across organizations. Based on over 160 million attack simulations conducted via the Picus Security Validation Platform, the report offers data-driven insights into how well enterprises are able to prevent and detect adversary behaviors across vectors, industries, and regions.

Averaging 14 per sample, with 11,984,156 mapped to the MITRE ATT&CK framework. Out of those techniques, we observed the following top 10 techniques being used in the corresponding order: Process Injection, Command and Scripting Interpreter, Credentials from Password Stores, Application Layer Protocol, Impair Defenses, Data Encrypted for Impact, System Information Discovery, Input Capture, Boot or Logon Autostart Execution, and Data from Local System.

The Blue Report 2025 serves as a practical guide for operationalizing Continuous Threat Exposure Management (CTEM). It helps security teams identify exposure blind spots, assess control effectiveness, and prioritize mitigation based on real-world adversary behaviors. By leveraging Adversarial Exposure Validation (AEV), teams can move beyond theoretical risks to validate which exposures are truly exploitable. This evidence-based approach supports more accurate risk quantification, informed investment decisions, and measurable progress across CTEM stages.

The Picus Platform uses curated adversary behavior chains drawn from real APT and malware campaigns, simulating tactics like credential theft, lateral movement, command and control, and data exfiltration. These simulations are non-disruptive and allow organizations to test whether their current defenses can stop threats as they unfold in production environments.

The key is to validate detection rules through simulated attacks and prioritize quality over quantity. By testing whether specific attacker behaviors are triggering alerts and tuning rules to reduce noise, security teams can ensure alerts are meaningful, reducing fatigue and increasing response speed.

The Blue Report provides objective, simulation-based evidence of which threats are succeeding, which controls are failing, and where security teams should focus next. It’s a valuable benchmark for risk-based decision-making and for tracking progress in exposure reduction year over year.