Why Patched Networks Still Get Breached: Inside LMG Security’s 2026 Penetration Testing Report

We break into companies every day. That is our business, and this year we decided to find out what our own data says about where risk actually lives. We went back through every penetration test LMG Security ran in 2025, inside client networks, against internet perimeters, and against web applications, and recorded every weakness we reported, every step our testers took, and how far they got. The result is Patched and Still Breached, our 2026 Penetration Testing Report, and it answers a question most security programs never ask out loud: of everything we find, what actually gets an attacker in?

The answer was rarely a missing patch. 43% of our internal tests ended in a domain takeover, and 88% of those takeover paths had no software vulnerability on them at all. Unpatched software is the weakness we report most often inside a network, in 78% of internal tests, yet it was on the path to a domain takeover in only 5%. Default SNMP community strings, fourth on the reported list at 56%, were on the path in 1%. Meanwhile, weak domain passwords sit fifth on the reported list and on more takeover paths than any other weakness. The chart in the report is sorted the way a scan report would sort it, and the gap between the two bars shows how little that order has to do with what decides the outcome.

Scanners see the problem and rate it harmless. Half of all takeovers began with poisoning: our testers answered a question the network was broadcasting to anyone who would listen, and the computer that asked sent them its login. Scans noted the protocols that poisoning abuses in 46% of the internal tests they covered, but flagged them as the poisoning weakness in only 4%. The most common path to the domain runs through certificate services, a part of Windows networks that many organizations set up years ago and have not reviewed since. Where we found it misconfigured, it was on the path to a domain takeover 93% of the time. Scanners raised it in none of the tests they scanned, because it is a configuration weakness that vulnerability scanners are not built to find.

Five changes break 94% of takeover paths. Here is the good news. Every takeover in this report ran through something a security team can change, and none of the five changes waits on a vendor’s patch. Most cost staff time, not licenses. The first one is probably already on your scan report: scanners flagged the missing signing requirement in 76% of the internal tests they scanned. Organizations are not missing this weakness; they are not acting on it. The report lists each of the five changes with an owner and a way to verify it, so you can confirm the fix without waiting for your next test.

Getting stopped short of Domain Admin is not the same as being safe. One internal test in four held a valid domain login and went no further, yet 45% of those still reached sensitive data. On the web side, 45% of the applications our testers got into never checked whether the person asking was allowed to see what they asked for, a flaw no scanner will flag. And when we tested more than twenty organizations from both sides within about five weeks, no attempt from outside succeeded, while inside, our testers took control of the domain outright in four out of five.

Also inside the report:

• Eight real attack stories, step by step, including “The Printer That Owned a University.”
• Which weaknesses sat on the path to domain takeover, and which only showed up on scan reports.
• A plan for 2027: what to keep funding, where to put the next dollar, and what to ask for in your next test’s scope.

Download the report. The full report is free, with no form to fill out: Patched and Still Breached: LMG Security’s 2026 Penetration Testing Report.

Join us for the live webinar. On Thursday, November 12 at 2:00 PM ET (11:00 AM PT), Sherri Davidoff, Founder of LMG Security, and Tom Pohl, Director of Penetration Testing, will walk through the attack paths behind the numbers and the five changes that could have prevented 94% of the domain takeovers our testers uncovered. Register for the webinar.

If one laptop on your network were compromised tomorrow, how far could it get? The report shows the paths our testers took, the owner for each fix, and how to verify every change. If you would like help putting the five changes in place, or want to see how far a tester could get in your environment, contact us about a penetration test.

Sources

1. LMG Security, Patched and Still Breached: 2026 Penetration Testing Report — https://www.lmgsecurity.com/patched-and-still-breached-lmg-2026-pen-test-report/
2. Cyberside Chats, “Why Patched Networks Still Get Breached: The 2026 Pen Test Report” — https://www.youtube.com/watch?v=DSTDXhroT84