Breach and attack simulation (BAS) has always had a supply chain. Somebody has to read the threat report, pull out the techniques, and turn them into something that will actually run against your controls. That somebody has always been a human red team. Up until a few months ago, turning a major new threat into working simulation content within 24 hours counted as very fast.
Frontier AI models broke the symmetry. In the post-Mythos era, the timelines have changed dramatically. The time from public disclosure to a weaponized exploit has collapsed to roughly ten hours, and there are more than 130 new CVEs appearing each day. To add to the chaos, fewer than 0.5% of disclosed vulnerabilities are ever patched upstream. A growing share of what lands in production was assembled with the same class of models that defenders are still evaluating. And when only one side of the pipeline is automated, the gap isn’t holding steady. It’s compounding.
That’s the argument for upgrading your BAS instead of running it more often.
What 338 million attack simulations found
The Picus Blue Report 2026 aggregated 338 million attack simulations executed by BAS in customer production environments in the first half of 2026. Prevention effectiveness averaged 69%, so roughly a third of attacks were getting through the controls put in place to stop them. Logging reached a four-year high, with 58% of attack actions captured in the SIEM, while the alert score sat unchanged at 14%.
The report found that detection rule failures cluster around two causes. Performance issues now lead at 49%, doubling from 24% just last year. Log collection gaps account for another 41% and are the more dangerous half because they fail silently; the behavior is never captured, so no rule can ever fire on it.
Every one of those is a configuration and operations issue. None says “bad product,” and none is fixed by buying another one.
That last sentence matters, because the industry’s reflex response to machine-speed attackers is another purchase: machine-speed defense, the AI SOC. An AI SOC’s unit of work is the alert. Point it at a pipeline where only one attack in seven produces an alert and it will handle that seventh at any speed you like, while the other six stay invisible. Autonomy cannot triage an alert that never fires. Fighting AI with AI starts upstream, in the detection engineering that creates the alert, and whether a validation program lightens that load or adds to it is where generation-one BAS starts to show its age.
Generation-one BAS runs out of road
Most enterprises running BAS today run a design that predates machine-speed adversaries. It has three structural limits, and each one is now load-bearing.
The trigger is a calendar. A scheduled program produces a point-in-time result, and between runs, the results you proved quietly expire. A firewall cleanup or an EDR agent update silently undoes last month’s pass, and drift surfaces by accident or in the incident review; never by the program. This year’s Blue Report shows the speed of the decay: average prevention slid seven points in a single year and won them back the next, and the main difference was simply who kept testing. Strong performance is rented, not owned.
It can’t answer the CVE question. “It hit the KEV overnight, would we detect it here?” now arrives daily, because patching everything is impossible. The manual answer costs four to six hours per CVE: read the advisory, grep the SIEM, and trust a coverage map that says “we have a rule for that.” So only the most critical CVEs ever get asked, and the rest of the list goes untested. The Blue Report shows where that ends: the year’s ten least-prevented vulnerabilities all sit in everyday software, a browser, archive utilities, OpenSSL, core OS components, and each was blocked less than 25% of the time. Automated pentesting cannot close this either: it needs a working exploit, and day one has none.
Everything after the test is priced in human hours. A finding lands in a queue with generic guidance and a link, and the real work, translating it into a signature your NGFW will accept or a rule your SIEM will actually fire on, falls to an engineer. Finding the exposure was never the hard part. The flat 14% alert score is what detection engineering looks like when everyone wants the program and nobody can staff it, and running validation more often just makes the queue longer.
What BAS has to be in the era of frontier AI models
Agentic BAS is breach and attack simulation run as a closed loop by agents: a signal fires the exact test it requires, every gap ships a vendor-specific fix that is deployed and re-proven, and humans sit on the loop at the decision gates rather than inside it.
The shape of the loop doesn’t change: simulate, validate, fix, verify. What changes is what feeds it, what fires it, and who runs it.
- Threats build themselves, with AI Threat Builder assembling the next campaign in minutes from your own CTI feeds and open-source intel.
- Simulations launch themselves, automatically and safely, against live production controls, so silent failures surface the day they are born.
- Fixes reach your teams, detections are deployed to the stack and prevention rules get auto-ticketed to SecOps. You oversee, agents execute, and signals decide when.
That is machine-speed response with a human on the loop: it proves the alert fires, and ships the rule when it doesn’t.
The method is behavioral: exploitation is simulated, so a threat is testable before an exploit exists. The payoff is closure: a gap that closes and gets re-proven is a different artifact from a gap that gets reported.
Autonomy stays tunable per workflow, manual, supervised, or fully autonomous, under one fixed rule: no machine accepts risk. And automated pentesting can’t run this loop at all, nor match its three guarantees: no production risk, no SOC noise, and scale that isn’t billed by headcount.
The translation problem
In the Picus approach, we ingest threat intelligence the way analysts receive it: a CISA alert, a blog URL, a PDF, a CVE ID, or simply a threat-actor name like Scattered Spider. We read the source to understand the actual attack chain rather than keyword-match it, and assemble a playable, ATT&CK-mapped simulation in roughly nine minutes.
Exploitation is simulated behaviorally, so no working exploit is needed: a KEV entry is testable the morning it lands, and the answer is no longer rationed to a few critical CVEs. Every relevant vulnerability comes back blocked, detected, or with a hidden residual risk, with a compensating rule for the tools you already run when patching must wait. Threat groups get the same treatment: the group’s exact playbook runs against your live controls the same day, every TTP is marked blocked, alerted, logged or missed, with each gap shipping its fix. And BAS should be a foundation rather than a ceiling: the same loop has to combine with autonomous penetration testing and exposure validation, so control validation can grow into a full exposure validation program with nothing repurchased or redeployed.
What runs is never raw model output: only content validated in the Picus Threat Library executes, safely, in production. The engine runs on verified frontier access under Anthropic’s Cyber Verification Program, and your own agents can drive the same workflow through our MCP API. The next attack will be AI-driven. Your defense has to be too.
What separates AI-era BAS from a faster schedule?
Five things, and none of them is cadence:
- Runs are signal-driven, not schedule-driven: the change itself fires the test.
- A new CVE is testable the day it lands, with no exploit in hand.
- A missed detection comes back diagnosed, not as a finding to triage, whether it was telemetry, rule logic, or performance.
- Every gap ships a vendor-specific fix; a human approves, the machine deploys, and the same attack re-proves it.
- Continuous stops being priced in engineer hours.
Any vendor, Picus included, should be willing to show you all five live rather than on a slide, and a contained pilot settles it in a week: a few agents on one segment, read-only SIEM access, attacks running the same day. When leadership then asks about readiness for frontier AI-enabled attacks, your answer is no longer an opinion. It’s a tested result, with a trend, on file.
If you want to understand what an actual upgrade means, and how your team shifts from a calendar to signals without starting over, we’d be happy to talk about what upgrading actually gets you.