Research: Security Control Effectiveness

The question

Most security reporting counts controls: how many endpoints have an agent, how many systems have MFA, how many rules are in the SIEM. Counts show presence. They do not show whether the control stops, detects or contains an attack. This paper asks what published evidence says about that gap.

Scope and method

This is a secondary analysis of published data. Cybrilliant did not run simulations or collect its own control data, and no figure here is a Cybrilliant benchmark. We reviewed four sources, kept to findings that measure outcomes rather than deployment, and recorded each source’s population and limits.

1. Prevention is lower than coverage suggests

Picus reports average prevention effectiveness of 69% in its 2026 Blue Report, up from 62% in the prior edition and level with the 2024 peak. The recovery is uneven. Post-compromise prevention was 37%. Prevention of known-malicious downloads by indicator matching fell to 50%, from 60% in 2025 and 71% in 2024. Stopping service-execution lateral movement (about 90%), UAC-bypass privilege escalation (about 85%) and LSASS credential dumping (94%) worked well. Reading credentials from memory (about 22%), registry credential extraction (under 1%) and hiding command history (1%) did not.

The threats that matter most fared worst. Prevention fell against 9 of the 10 hardest-to-stop threat groups. Every top ransomware family was blocked less than 38% of the time, and Play fell from 50% to 13%. Education lost 30 points and is now the least protected industry.

Our reading: controls do best against techniques that look like malware and worst against techniques that look like normal use. A stolen valid credential, a legitimate admin tool, a bulk file copy: each resembles ordinary work, and each is where prevention falls away.

2. Detection is the weakest layer

Fewer than one in seven simulated attacks triggered an alert. Picus puts the alert score at 14%, unchanged from the prior edition. The log score rose to 58%, a four-year high. Logging is improving. Alerting is not.

Our reading: a log score far above the alert score means the data exists and nothing is reading it. That is a detection engineering gap, not a tooling gap. Buying more telemetry will not close it.

Mandiant’s incident data shows the cost of that gap. Just over half of organizations (52%) found malicious activity themselves. Global median dwell time was 14 days, up from 11.

3. The controls that protect the controls fail quietly

Mandiant describes attackers going after the infrastructure that holds defenses and recovery in place. Reported tactics include abusing misconfigured Active Directory Certificate Services templates to create admin accounts exempt from MFA, extracting credentials in bulk from vaults, copying virtual hard disks on hypervisors, and wiping large numbers of cloud backup objects. Prior compromise was the top confirmed initial vector for ransomware incidents, at 30%.

Our reading: an MFA policy with an exemption path is not an MFA policy. A backup that shares an identity plane with production is not an independent backup. These are configuration and design failures, and they will not show up in a count of controls deployed.

4. Remediation speed is a control outcome

Verizon found 26% of KEV-listed vulnerabilities fully remediated, down from 38%. Median time to full resolution rose to 43 days from 32, and the median organization faced 50% more critical vulnerabilities. Supplier remediation was slower still. Only 23% of third parties fully fixed missing or improperly secured cloud MFA, and for weak passwords and permission misconfigurations the median time to close half of the findings was well beyond two quarters.

5. People determine whether a control works

ISC2 reports that 59% of respondents have critical (23%) or significant (36%) skills needs, up from 44%. The top needs were AI (41%), cloud security (36%), risk assessment (29%), application security (28%), security engineering (27%) and governance, risk and compliance (27%). 88% had experienced at least one significant consequence of a skills deficiency. 36% reported budget cuts, and 72% agreed that cutting security staff significantly raises breach risk.

Our reading: detection rules need tuning, MFA exemptions need review, recovery needs testing. All three are skilled, repetitive work. Where capacity falls, effectiveness decays first in exactly the places the data above shows.

A working model: four tests for every control

The pattern across these sources suggests four questions, asked in order. A control that fails an early test makes the later tests meaningless. This is our analytical framing, not a published standard.

What to measure instead of control counts

• Technique-level prevention and detection rates for the ten or so techniques most relevant to your sector and threat profile, validated by testing rather than assumed.

• Telemetry with a use case. The share of log sources that feed at least one working detection.

• Exemption count. Conditional access exclusions, MFA bypass groups and service accounts outside policy, reviewed on a fixed cycle.

• Time to mitigate exploited vulnerabilities on internet-facing systems, separate from time to patch.

• Recovery independence. Whether backups and recovery tooling can be reached with production credentials, tested rather than documented.

• Internal detection share. How often you find intrusions before someone tells you.

Limitations

• No dataset in this paper is Cybrilliant’s own. Figures are quoted as published and attributed to their source.

• The sources differ in population, method and commercial interest. Their figures are not directly comparable and should not be combined into a single score.

• Simulation results measure how controls respond to simulated techniques in participating environments. Real adversaries adapt.

• Several technique-level figures reach us through trade press coverage of vendor reports, so detail on selection and definitions is limited.

• ISC2 data is self-reported. Respondents’ views of their own controls and skills may differ from measured performance.

• Trend comparisons are between consecutive editions of each source.

Next step

Pick your five most important controls and run the four tests on each. The control that fails earliest, and matters most, is where improvement effort pays back first.

Sources

1. Picus Security. Blue Report 2026, as reported by Help Net Security (helpnetsecurity.com/2026/08/12/picus-security-blue-report-2026/) and The Hacker News (thehackernews.com/2026/08/enterprise-defenses-recovered-at-edge.html). Prevention, alert and log scores; technique-level and threat-group results. helpnetsecurity.com

2. Verizon. Data Breach Investigations Report, latest edition and executive summary. KEV remediation, supplier remediation, dataset scope. verizon.com/business/resources/reports/dbir verizon.com

3. Mandiant (Google Threat Intelligence Group). M-Trends, latest edition, as reported by Help Net Security. Detection source, dwell time, attacker tactics. helpnetsecurity.com

4. ISC2. Cybersecurity Workforce Study, latest edition. Skills needs, budget and staffing findings; 16,029 respondents. isc2.org