More Than 160 Million Attack Simulations in Live Production Environments Reveal Valid Credentials Are Easy to Steal and Nearly Impossible to Stop
Picus Security, the leading security validation company, today released the Blue Report™ 2025, based on more than 160 million real-world attack simulations in live production environments. Now in its third year, the report provides a data-driven assessment of how well security controls perform against today’s threats — and this year’s findings are the most concerning to date.
While cyberattacks grow in both volume and sophistication, defensive effectiveness is declining. This year’s data paints a particularly grim picture: In 46% of environments, at least one password hash was successfully cracked, and data exfiltration attempts were only stopped 3% of the time, down from 9% in 2024. Combined, these trends show how quickly a single compromised credential can open the door to lateral movement and large-scale data theft. With infostealer malware tripling in prevalence and attackers increasingly bypassing defenses using valid logins, organizations face escalating risk from persistent and nearly invisible threats.
“We must operate under the assumption that adversaries already have access,” said Dr. Süleyman Ozarslan, co-founder of Picus Security and VP of Picus Labs. “An ‘assume breach’ mindset pushes organizations to detect the misuse of valid credentials faster, contain threats quickly, and limit lateral movement — which requires continuous validation of identity controls and stronger behavioral detection.”
Key Findings:
- Passwords cracked in nearly half of environments: In 46% of tested environments, at least one password hash was cracked — up from 25% in 2024 — highlighting continued reliance on weak or outdated password policies.
- Stolen credentials are practically unstoppable: Attacks using valid credentials were successful 98% of the time, making techniques like Valid Accounts (MITRE ATT&CK T1078) one of the most reliable ways to bypass defenses undetected.
- Data exfiltration prevention is near zero: Only 3% of data theft attempts were blocked — down 3x from 2024 — even as ransomware operators and infostealers ramped up double-extortion attacks.
- Ransomware remains a top concern. BlackByte continues to be the hardest strain to prevent, with a prevention effectiveness rate of just 26%. BabLock and Maori followed at 34% and 41%, respectively.
- Early detection is a significant blind spot. Discovery techniques like System Network Configuration Discovery and Process Discovery scored below 12% in prevention effectiveness, exposing gaps in detection efforts.
The Blue Report 2025 also reveals that prevention effectiveness declined from 69% in 2024 to 62% in 2025, reversing last year’s gains. And while logging coverage held steady at 54%, only 14% of attacks generated alerts, meaning that most malicious activity still goes unnoticed. Failures in detection rule configuration, logging gaps, and system integration continue to undermine visibility across security operations. The decline highlights how quickly defenses can degrade without continuous oversight and validation of security controls.
Methodology
The Blue Report offers empirical evidence of how well security controls perform in real-world conditions. Findings are based on millions of simulated attacks executed by Picus Security customers from January to June 2025. The simulations were conducted safely in live production environments using Picus’ Security Validation Platform and analyzed by the Picus Labs and Picus Data Science teams. The report also includes ecosystem and industry-specific findings and recommendations that can help companies reduce exposure and improve threat readiness.
To read the full findings and recommendations, download the Blue Report 2025.