Picus Security's Blue Report 2025 finds orgs detected only 1 in 7 of 160M simulated attacks; 50% of detection failures traced to log collection issues; Valid Accounts technique succeeded in 98% of tests.