CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA’s “A Tale of Two SOCs” assessment is one of those reports security teams should study carefully because it demonstrates something organizations routinely forget while buying yet another security product: tools do not create security by themselves. CISA conducted simultaneous red-team assessments against two U.S. critical-infrastructure organizations using broadly similar attack techniques. Both organizations ultimately had weaknesses serious enough to allow domain-level compromise and access to sensitive business systems and cloud resources. The striking difference was not that one organization possessed magical technology unavailable to the other. It was how their Security Operations Centers detected, interpreted, escalated and responded to the activity. Organization A failed to detect the compromise, while Organization B identified the initial malicious activity and isolated affected workstations within minutes. The comparison provides an unusually clear demonstration that security effectiveness depends on the combined performance of technology, people, processes, network architecture and operational discipline, not on the number of security consoles displayed across a SOC wall.

Organization A’s compromise began with something painfully ordinary: default credentials. CISA discovered a web application containing built-in accounts that still used default credentials, allowing the red team to gain access and send phishing emails from a legitimate internal address. This immediately increased the credibility of the phishing campaign because users receiving messages from an internal organizational account were far more likely to trust them than messages arriving from an unfamiliar external domain. The red team successfully compromised four workstations. The lesson here is broader than simply “change default passwords.” Any externally or internally accessible application retaining vendor-default credentials represents a potential bridge into trusted organizational communication channels. Security teams often devote considerable effort to advanced threat detection while basic credential hygiene quietly leaves doors open. Attackers, being practical creatures, generally prefer the unlocked door over demonstrating their impressive collection of zero-days.

After establishing initial access, the red team escalated privileges by abusing Active Directory configuration weaknesses. One particularly significant issue was the default Machine Account Quota setting, which allowed ordinary domain users to create machine accounts. This weakness was combined with a misconfigured Active Directory Certificate Services certificate template vulnerable to the ESC1 abuse technique. Certificate Services has become an increasingly important attack surface because certificates can effectively become alternative authentication credentials within Windows domains. Organizations may carefully control passwords and privileged accounts while overlooking certificate templates that allow users to request certificates representing identities they should never be able to impersonate. Once an attacker gains the ability to obtain authentication material for a privileged identity, many traditional password-related defenses become irrelevant.

Active Directory Certificate Services deserves particular attention because it is frequently deployed as supporting infrastructure and then receives considerably less security scrutiny than domain controllers themselves. Certificate templates should be reviewed for excessive enrollment rights, dangerous subject-name settings, authentication-enabled extended key usages and configurations that allow requesters to influence identity information. Organizations should not assume that a certificate authority is secure merely because it is functioning correctly. From an attacker's perspective, a perfectly functioning certificate authority with an insecure template can be considerably more useful than a vulnerable server because it willingly provides trusted authentication material.

The red team subsequently discovered credentials stored in cleartext, including database configuration information and cloud credentials. This illustrates another recurring weakness in enterprise environments: secrets are frequently protected carefully during interactive authentication and then stored casually inside scripts, configuration files, deployment systems or administrative utilities. An attacker who compromises a server may not need to dump credentials from memory if a configuration file politely contains everything required for further access. Organizations need systematic secrets management rather than relying on administrators to remember which files happen to contain passwords, API keys and access tokens. Credentials stored on disk should be minimized, encrypted where practical, rotated regularly and restricted so that only the specific processes requiring them can retrieve them.

Static AWS access keys discovered by the CISA red team were reportedly configured without expiration. Long-lived cloud credentials significantly increase attacker persistence because stealing the credential once may provide access long after the original endpoint has been cleaned. Cloud security architecture should increasingly favor temporary credentials issued through workload identities, roles and short-lived tokens rather than permanent access keys embedded inside application configuration. Where static credentials remain unavoidable, organizations should enforce rotation, monitor usage patterns and ensure that permissions follow least privilege. A credential that never expires and possesses broad access is essentially an organizational promise to an attacker that their stolen secret will remain useful indefinitely, which seems unnecessarily hospitable.

The red team also stole a Microsoft Entra ID Primary Refresh Token and abused highly privileged Entra applications. One particularly disturbing capability allowed access to security-team email, enabling the red team to determine whether defenders had discovered their activity. This is an important example of attackers targeting defensive visibility itself. Once an adversary reaches identity infrastructure, cloud applications or security communications, they may gain the ability not merely to continue attacking but to observe the defenders responding to them. An attacker reading incident-response email can learn which systems are under investigation, which indicators have been discovered and which remediation steps are planned. Defenders therefore need to treat security-team communication channels as high-value assets rather than assuming internal email automatically represents a trusted space.

The application-permission problem is equally significant. Modern cloud environments frequently contain service principals and applications granted organization-wide permissions because broad access simplifies integration. Over time, these permissions accumulate and may remain long after the original business requirement disappears. Security teams should conduct regular reviews of application permissions within Entra ID and other identity platforms, paying particular attention to applications capable of reading mailboxes, directory information, files or security telemetry across the organization. Application identities should receive the same scrutiny as privileged human administrators because, from an attacker's perspective, both are simply mechanisms for exercising authority.

Perhaps the most important part of Organization A’s failure was not that it lacked alerts. It apparently had enormous numbers of them. CISA found that legitimate business activity produced thousands of false-positive alerts, many assigned higher severity than the genuine red-team activity. The problem was therefore not insufficient monitoring but excessive meaningless monitoring. Alert fatigue is not simply an inconvenience for SOC analysts; it is a security vulnerability in its own right. If critical alerts are buried among thousands of noisy detections, having technically generated the correct alert provides remarkably little protection. Security teams need to continuously tune detection rules, remove persistent false positives, prioritize alerts according to organizational context and measure whether analysts can realistically investigate the volume generated.

This is also why metrics such as “number of alerts generated” or “number of security events processed” can be dangerously misleading. A SOC processing millions of events is not necessarily more secure than one processing far fewer events. The meaningful measures are whether important attacker behavior is detected, how rapidly analysts understand what occurred, how quickly containment begins and whether the organization prevents the attacker from reaching critical assets. Producing more alerts than analysts can investigate merely converts useful telemetry into background noise. Security tools should help analysts identify important anomalies, not conduct an endurance test against their attention span.

Organization A also operated multiple SOCs and endpoint-security products without effective shared visibility. This highlights another major problem in large organizations: fragmentation. One team may monitor endpoint alerts, another network security, another cloud environments and another identity systems, each seeing only part of the intrusion. Attackers benefit enormously from these organizational boundaries because their activity may appear harmless within each individual dataset. An unusual PowerShell execution may not appear critical until correlated with a suspicious authentication event, an outbound network connection and a newly issued certificate. Centralized visibility and cross-domain correlation therefore matter considerably more than simply adding additional monitoring teams.

The CISA assessment also identified weaknesses in escalation procedures and analyst authority. A genuine alert associated with red-team activity on an SCCM server was reportedly dismissed as a false positive because analysts could not determine who owned the system. This is a remarkably useful operational lesson. An alert can be technically perfect and still fail if the analyst does not know whom to contact, whether the system is important or whether they are permitted to isolate it. SOC processes therefore need clearly defined ownership information, escalation paths and authority levels established before an incident occurs. Incident response should not depend on discovering the organizational chart while the attacker is moving laterally.

Asset ownership is often discussed as an IT-management problem, but this example shows why it is directly connected to security operations. Every critical server, cloud workload and application should have a clearly identified technical and business owner. Security analysts investigating suspicious behavior should be able to determine immediately what the system does, who is responsible for it, what data it handles and whether isolation could create operational consequences. Without that context, analysts become reluctant to act, particularly in critical infrastructure environments where disabling the wrong system may disrupt essential services.

Organization B provides a fascinating comparison because it was attacked using broadly similar techniques but responded very differently. Its SOC detected each initial phishing payload as it executed and isolated compromised workstations within approximately 2 to 20 minutes. By cutting command-and-control communications quickly, defenders prevented the red team from converting those initial endpoint compromises into a broader intrusion. This is perhaps the clearest demonstration in the report of the value of rapid containment. Preventing every phishing attempt from reaching every user is unrealistic. Detecting successful execution and severing attacker communication before lateral movement begins is a considerably more achievable and operationally meaningful objective.

Because Organization B contained the initial attack so effectively, CISA's trusted personnel had to execute a red-team payload manually on a designated non-privileged system so that the remaining assessment could proceed under an assume-breach model. That is almost comically flattering for the defenders. The attackers effectively needed administrative assistance to continue the test. More importantly, it demonstrates why assume-breach exercises are valuable. Strong perimeter and endpoint detection may prevent attackers from progressing during a test, but organizations still need to understand what would happen if an adversary somehow obtained internal access. Security assessments should therefore examine both prevention and post-compromise resilience.

Once inside Organization B under the assume-breach scenario, CISA still found serious weaknesses. Cleartext credentials for a domain service account were present in an SCCM configuration file, and that account possessed rights over a domain controller. The red team used those privileges to perform a DCSync attack and retrieve the krbtgt secret. This is an extremely significant compromise because the krbtgt account underpins Kerberos authentication in Active Directory. Compromise of its secret can allow attackers to forge Kerberos tickets and maintain powerful persistence inside the domain. The finding demonstrates that excellent detection does not eliminate the need for fundamental credential and privilege hygiene.

SCCM and similar enterprise-management platforms deserve especially strong protection because they are designed to administer large numbers of endpoints. A compromised management server or service account can provide attackers with exactly the capabilities they would otherwise spend considerable effort obtaining: remote execution, software deployment, administrative access and visibility across many systems. Management infrastructure should therefore be treated similarly to domain controllers and other Tier 0 assets, with strict administrative access, isolated credentials, monitored configuration changes and limited network exposure. A system capable of controlling thousands of machines should not be secured as though it were merely another application server.

The contrast between the two organizations is therefore nuanced. Organization B was not free of vulnerabilities. In fact, CISA ultimately demonstrated domain-level compromise there as well under assume-breach conditions. The important difference was that Organization B detected and contained the real initial intrusion rapidly enough that the attacker would not have naturally reached those later weaknesses. This distinction matters because vulnerability management and detection engineering solve different parts of the security problem. Eliminating every possible misconfiguration is extraordinarily difficult, while detecting malicious behavior quickly can prevent attackers from reaching weaknesses that still exist. Conversely, detection eventually fails, so reducing exploitable weaknesses limits what attackers can achieve when they do get through. Mature security architecture needs both.

The operational-technology portion of the assessment provides another excellent example of defense in depth. CISA reached a bastion host within Organization B's OT demilitarized zone but could not establish command-and-control because that system had no outbound internet access. As a result, the red team did not proceed into the OT environment itself. This demonstrates the enormous security value of properly enforced outbound restrictions. Security teams traditionally focus on preventing inbound connections from the internet, but many modern malware frameworks rely on compromised systems initiating outbound connections to command-and-control infrastructure. Denying unnecessary internet access from critical servers can therefore break an attack even after the attacker successfully reaches the system.

This lesson is particularly important for industrial and critical-infrastructure networks. Operational technology systems generally have predictable communication requirements. PLCs, engineering workstations, historians, management servers and bastion hosts should not receive unrestricted outbound internet access merely because configuring precise policies requires additional effort. Network traffic between IT and OT environments should traverse controlled security zones with explicit allow rules, protocol validation and comprehensive logging. If malware reaches an OT-adjacent system but cannot communicate externally or freely traverse deeper into the environment, the attacker faces substantially greater difficulty maintaining control.

The CISA assessment also reinforces why application-aware firewalling matters. Traditional firewall rules based solely on IP addresses and ports may permit malicious communication because attackers deliberately disguise protocols inside commonly allowed ports such as 80 and 443. Modern network controls should identify the actual application or protocol where feasible, monitor unusual encrypted communication patterns and restrict outbound destinations according to workload requirements. A server that only needs to communicate with three known cloud services should not automatically be permitted to establish encrypted connections to the entire internet.

Another important lesson is the difference between prevention controls and detection controls. Organization A had security technologies capable of generating alerts, but its operational processes failed to convert those alerts into action. Organization B had detection capabilities integrated with rapid containment procedures. This reinforces the importance of measuring Mean Time to Detect and Mean Time to Respond rather than merely counting installed security products. A sophisticated EDR platform producing a high-fidelity alert is only useful if somebody examines the alert quickly enough to stop the attacker before the next stage of the intrusion.

Organizations should also test whether SOC analysts possess sufficient authority to take emergency action. In many enterprises, analysts can identify suspicious behavior but cannot isolate endpoints, disable accounts or block network communication without obtaining several levels of approval. That governance model may reduce accidental disruption during ordinary operations, but it can be disastrous during an active intrusion. Incident-response procedures should define circumstances under which security personnel can immediately isolate systems or revoke credentials, followed by management review afterward. Attackers generally do not submit change-control requests before moving laterally.

The report provides another strong argument for continuous purple-team exercises rather than annual compliance-driven penetration tests. A conventional penetration test often focuses on whether vulnerabilities can be exploited and produces a list of findings for remediation. A red-team assessment evaluates whether defenders can discover and respond to realistic attacker behavior. Purple-team exercises go further by allowing attackers and defenders to collaborate so detection logic can be improved immediately. Organizations should repeatedly validate whether endpoint, network, identity and cloud controls detect important attack techniques rather than assuming a product's presence guarantees coverage.

Security teams should also deliberately test complete attack chains. Phishing, credential theft, certificate abuse, lateral movement, cloud-token theft and access to sensitive resources may individually trigger different security products. The more important question is whether defenders can recognize that these events collectively represent one intrusion. Attack-path visibility is becoming increasingly important because attackers rarely depend on a single spectacular exploit. They combine configuration weaknesses, excessive permissions, forgotten credentials and ordinary administrative functionality until they reach their objective.

There is also a powerful lesson here for Zero Trust architecture. Zero Trust is sometimes reduced to an identity product or MFA deployment, but the CISA findings show why the concept must extend across identities, devices, applications, networks and workloads. An authenticated domain user should not automatically have the ability to create machine accounts. A service account should not possess domain-controller privileges unless absolutely necessary. A cloud application should not automatically read every employee's mailbox. A bastion host should not automatically access the internet. Every unnecessary privilege or communication path increases the opportunities available after initial compromise.

Credential hygiene remains another foundational control. Organizations should aggressively search for cleartext passwords, database strings, API keys and service-account credentials across scripts, configuration files, deployment repositories and management systems. Secrets should be moved into dedicated vaulting systems wherever possible, and service identities should use automatically rotated or ephemeral credentials. Security reviews should also examine where credentials can be retrieved by local administrators because attackers frequently obtain elevated endpoint privileges before searching for credentials that provide access elsewhere.

Cloud identities require the same discipline. Long-lived access keys, excessive application permissions and refresh tokens can allow an attack that begins on a workstation to move rapidly into SaaS and cloud infrastructure. SOC visibility therefore needs to span both traditional Active Directory and cloud identity platforms. Investigators should be able to correlate workstation compromise with Entra sign-ins, AWS API activity, application-consent events and suspicious token usage. Treating cloud and on-premises security as separate universes makes progressively less sense when attackers move comfortably between both.

For senior management, perhaps the most valuable lesson from CISA's assessment is that cybersecurity maturity cannot be inferred from security expenditure. An organization can operate several SOCs, deploy multiple endpoint tools and generate thousands of alerts while still failing to detect a complete domain compromise. Another organization with similar underlying technical weaknesses can significantly reduce the practical impact of an attack because its analysts detect malicious behavior quickly, understand what they are seeing and possess procedures that allow decisive containment. Security effectiveness is therefore an operational outcome, not an inventory of products.

The report also raises an uncomfortable but necessary question every SOC should ask: if CISA or another professional red team were inside the network today, would analysts recognize the activity before the attackers reached domain administration? Organizations should be able to demonstrate the answer through recurring exercises, not optimism. Detection rules need validation against realistic adversary techniques, false positives need constant tuning, critical asset ownership needs to be known, and escalation procedures need to be rehearsed. Incident-response plans that exist only as documents satisfy paperwork requirements remarkably well but have a disappointing tendency not to defend networks.

Ultimately, “A Tale of Two SOCs” demonstrates that cybersecurity is a system rather than a product. Strong endpoint detection without effective analysts fails. Skilled analysts buried beneath uncontrolled alert noise fail. Good monitoring without asset ownership and escalation procedures fails. Network segmentation without identity security leaves other attack paths available, while identity security without outbound controls may still allow persistent command-and-control. The organizations that become difficult to compromise are those that combine secure configuration, least privilege, credential protection, network segmentation, application-aware controls, cloud security, meaningful telemetry and empowered incident responders into a coherent defensive architecture.

The most important lesson is perhaps the simplest: detection has value only when it leads to action. Organization B showed that identifying and isolating compromised endpoints within minutes could stop an attack before it developed into a much larger incident, despite serious weaknesses still existing deeper in the environment. Organization A showed the opposite scenario, where security tools produced enormous amounts of information but the organization could not distinguish attacker activity from background noise. Modern cybersecurity therefore needs to focus less on whether organizations possess visibility and more on whether they can convert that visibility into timely, correct decisions. Attackers need only enough time to reach the next stage. Defenders need to make sure they do not get it.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructure organizations, using what it described as similar tradecraft while recording sharply different defensive outcomes. Both organizations were fully compromised at the domain level, and in both, the red team also

Source: CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing via The Hacker News — published 26 Aug 2026.