The perimeter now blocks roughly two attacks out of three; inside, defenses stop barely one in three. Here too, noisy actions get caught, while quiet ones don’t. The defenses in this report already recovered the moment someone tested them. The attacks still slipping through are the quiet ones, the reconnaissance and credential reads that never trip a signature and, this year, rarely trip an alert either. Download the Blue Report 2026 to see where your defenses are likely to hold, and where the quiet gaps are most likely to be.