46% of Enterprise Passwords Are Vulnerable to Cracking
Picus Security recently released The Blue Report™ 2025, based on more than 160 million real-world attack simulations. Now in its third year, the report provides a data-driven assessment of how well security controls perform against today’s threats — and this year’s findings are the most concerning to date.
While cyberattacks grow in both volume and sophistication, defensive effectiveness is declining. This year’s data paints a particularly grim picture: in 46% of environments, at least one password hash was successfully cracked, and data exfiltration attempts were only stopped 3% of the time, down from 9% in 2024. Combined, these trends show how quickly a single compromised credential can open the door to lateral movement and large-scale data theft. With infostealer malware tripling in prevalence and attackers increasingly bypassing defenses using valid logins, organizations face escalating risk from persistent and nearly invisible threats.
“We must operate under the assumption that adversaries already have access,” said Dr. Süleyman Ozarslan, co-founder of Picus Security and VP of Picus Labs. “An ‘assume breach’ mindset pushes organizations to detect the misuse of valid credentials faster, contain threats quickly and limit lateral movement — which requires continuous validation of identity controls and stronger behavioral detection.”
Key Findings:
Passwords cracked in nearly half of environments: In 46% of tested environments, at least one password hash was cracked — up from 25% in 2024 — highlighting continued reliance on weak or outdated password policies.
Stolen credentials are practically unstoppable: Attacks using valid credentials were successful 98% of the time, making techniques like Valid Accounts (MITRE ATT&CK T1078) one of the most reliable ways to bypass defenses undetected.
Data exfiltration prevention is near zero: Only 3% of data theft attempts were blocked — down 3x from 2024 — even as ransomware operators and infostealers ramp up double-extortion attacks.
Ransomware remains a top concern. BlackByte continues to be the hardest strain to prevent, with a prevention effectiveness rate of just 26%. BabLock and Maori followed at 34% and 41%, respectively.
Early detection is a significant blind spot. Discovery techniques like System Network Configuration Discovery and Process Discovery scored below 12% in prevention effectiveness, exposing gaps in detection efforts.
The Blue Report 2025 also reveals that prevention effectiveness declined from 69% in 2024 to 62% in 2025, reversing last year’s gains. And while logging coverage held steady at 54%, only 14% of attacks generated alerts, meaning most malicious activity still goes unnoticed. Failures in detection rule configuration, logging gaps and system integration continue to undermine visibility across security operations. The decline highlights how quickly defenses can degrade without continuous oversight and validation of security controls.