Identity · 46 days ago
CISA compared two simultaneous red team assessments and saw the same tradecraft produce two very different outcomes. In one organization, the team reached multiple workstations, gained domain-level privileges, and moved laterally into sensitive business systems and cloud resources without being detected. In the other, defenders spotted the initial compromise quickly and quarantined the affected systems.
The difference was not attacker skill. Once the second organization caught the first foothold, the red team had to operate under an assume-breach model; even then, defenders later detected activity again when the team reached a bastion host in the OT demilitarized zone, or OT DMZ, and isolated it. That makes telemetry coverage and triage speed the deciding factors, not the initial access technique.
For organizations that rely on SOC alerts and quarantine workflows, the exposure sits in the gap between first compromise and containment. If that gap is invisible or slow, ordinary user-like access can turn into reach across business systems, cloud environments, and OT-adjacent infrastructure before anyone notices.
4 sources covering this story
CISA identifies security hurdles that led to very different results in two red-team engagements
The agency said its recent simulated cyberattacks offered several key lessons for many organizations.
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
CISA red teams reach domain-level compromise at two critical infrastructure organizations, but only one SOC detects and contains initial intrusion.
New CISA advisory addresses red-team assessments that expose critical infrastructure gaps in threat detection, response and OT security.
A Tale of Two SOCs: Insights From Two Red Team Assessments | CISA
This advisory compares defensive outcomes from two red team assessments.
Part of the PlainSec briefing for 2026-08-31