CISA has published the results of two parallel red team assessments at two U.S. critical infrastructure organizations. The important point is not only that both environments were taken to domain-level compromise, but that two security operations centers reacted very differently to similar attack tradecraft.
For a general audience, the case highlights a practical security lesson: buying many security tools is not the same as having strong defensive capability. The decisive gap often sits in people, escalation procedures, shared visibility between teams and the authority SOC analysts have when they detect suspicious activity.
Two organizations, similar attack tradecraft, different defensive outcomes
According to The Hacker News and CISA advisory AA26-237A, the two anonymized targets were Organization A in the Government Services and Facilities sector and Organization B in the Water and Wastewater Systems sector. CISA said the assessments used similar tradecraft, but produced very different defensive responses.
At Organization A, the red team found a web application still using default credentials for several built-in accounts. From that entry point, the team simulated phishing emails from an internal address and landed on four workstations. It then escalated privileges by abusing the default Machine Account Quota and a misconfigured Active Directory Certificate Services template.
The red team then reached sensitive business systems by using cleartext credentials, including decrypted database configuration files and static AWS access keys that never expired. In the cloud layer, it also stole a Primary Refresh Token and abused highly privileged Entra ID applications to read the security team's email and check whether defenders were aware of the activity.
Why one SOC did not see the attack
Organization A did not detect the red team activity. CISA described an environment flooded by thousands of false-positive alerts from normal business operations, many of them rated at higher severity than the real signals created by the red team. The situation was further complicated by multiple SOCs and endpoint tools without shared visibility.
A real alert tied to a System Center Configuration Manager server did appear, but it was dismissed as a false positive after analysts could not identify the system owner. This is a classic operational risk: when asset ownership is unclear, even a correct alert can lose value at the most important moment.
CISA also identified familiar technical weaknesses: Machine Account Quota left at its default value, AD CS certificate templates that allowed certificate requests on behalf of other users, passwords and access keys stored in configuration files, and insufficient limits on cloud permissions. These issues are not new, but chained together they can create a complete path from initial access to domain compromise.
Why the second organization responded better
Organization B faced a similar attack style, but its SOC detected the phishing payloads as they executed and isolated the affected workstations within 2 to 20 minutes. Cutting off command-and-control early prevented the red team from expanding through the original path.
CISA then shifted the exercise to an assume-breach model, meaning it continued testing as if the attacker already had a foothold. Even then, the red team found foundational issues such as cleartext credentials in SCCM configuration and excessive rights for a domain service account. Early detection matters, but it does not replace the need to fix identity, configuration and privilege debt.
Lessons for enterprises and operations teams
The first lesson is to reduce noise in the alerting system. If a SOC is overwhelmed by false positives, real signals sink and analysts lose confidence in the data. Organizations should tune detection rules, normalize prioritization and measure whether important alerts are investigated to conclusion rather than merely recorded.
Second, asset data must be clear enough to support response. When an alert involves an important server, the SOC needs to know who owns it, what service it runs, whether it can be isolated and who can approve emergency action. Without that context, incident response slows down exactly when speed matters.
Third, identity and configuration should be treated as core attack surfaces. Active Directory defaults, AD CS templates, service accounts, non-expiring cloud keys and secrets in configuration files all need periodic review. These issues may look like small internal hygiene problems, but they can become the foundation for privilege escalation.
Conclusion
CISA's message is direct: detection tools are only effective when supported by the right people, processes and procedures. A strong SOC is not merely a room full of dashboards; it is an operating model where alerts are understood, response authority is clear, assets are consistently managed and red team lessons become real changes.
For organizations building defensive capability, this assessment is a reminder to measure security by the ability to detect, isolate and remediate under realistic conditions, rather than by the number of tools purchased or the number of alerts generated each day.
VNCyberS compiled from The Hacker News and CISA
Tiếng Việt
English