The Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory based on red team exercises that expose glaring weaknesses in security operations centers (SOCs) and cloud security practices across critical infrastructure organizations. The findings caution that high budgets and sophisticated tools mean little without strong human processes and clear lines of authority. August 25, 2026.
Two Organizations, Similar Attacks, Very Different Outcomes
Lessons emerged from two red team engagements: one involving an organization in the Government Services and Facilities Sector (Organization A), the other in the Water and Wastewater Systems Sector (Organization B). Attackers used nearly identical techniques—starting with phishing to gain initial access, then exploiting Active Directory misconfigurations like default Machine Account Quota settings and loosely configured Certificate Services templates to escalate privileges and move laterally. Yet detection and response diverged significantly.
In Organization A, red team operators fully evaded detection. They escalated to domain-level privileges, accessed sensitive business and cloud systems, read emails of SOC staff, and even deployed keyloggers on defenders’ machines—without raising an alarm. In contrast, Organization B contained the compromise rapidly: workstations were isolated within 2 to 20 minutes after the phishing payload executed, and command-and-control channels were disrupted before the intrusion spread further.
Assume Breach: When Fast Response Matters
Once the breach was underway in Organization B, defenders shifted into an “assume breach” mindset—treating the incident as if infiltrations had already succeeded. Even under these conditions, that team experienced privilege escalation via the same Machine Account Quota gap, harvested cleartext credentials from a Systems Center Configuration Manager (SCCM) file, and used DCSync attacks to access domain controller credentials, including the krbtgt account used for Golden Ticket attacks. But thanks to layered detection and alerting—such as a suspicious Azure sign-in flagged by automated tools—Organization B was able to isolate a key host in its OT DMZ and prevent further damage.
The report points to flaws in Organization A that go beyond missing tools. Multiple SOCs operating without coordination, several endpoint detection and response (EDR) systems producing overwhelming numbers of false positives, and the absence of role clarity inhibited timely threat escalation. Analysts often dismissed real alerts as misidentified, lacking authority and clear procedures to act. One red team operation on an SCCM server was ignored after defenders couldn’t determine which system owner to contact.
CISA recommends that critical infrastructure operators remediate common Active Directory weaknesses—limit Machine Account Quotas, harden certificate templates vulnerable to ESC1 exploits, enforce credential rotation on service and cloud accounts, and leverage Conditional Access for workload identities. Equally important: formalize escalation protocols, foster cross-team visibility, and empower analysts to make decisions quickly. The stark difference between Organizations A and B underscores that detection is only useful when paired with swift decision-making and precise response.
These findings stress that defense in depth isn’t just technical: People, process, and authority are equally crucial. Critical sectors relying solely on tools without building out operational resilience leave themselves exposed to sophisticated adversaries.
