CISA Red Team Reveals Shocking Security Gap: Two Critical Infrastructure Orgs, Vastly Different Outcomes
In August 2026, CISA published results from simultaneous red team assessments against two critical infrastructure organizations in the Government Services and Water/Wastewater sectors. Both organizations were fully compromised at the domain level using similar attack techniques including web application exploitation with default credentials, Active Directory Certificate Services misconfigurations, and privilege escalation through cleartext stored credentials. Organization A detected nothing despite thousands of security alerts, while Organization B's SOC detected and isolated affected workstations within 2-20 minutes, demonstrating the critical importance of security operations maturity over tool sophistication. This assessment highlights the growing focus on defensive capabilities amid increasing nation-state threats against critical infrastructure, particularly following recent campaigns like Salt Typhoon that exposed fundamental gaps in network security and detection capabilities across sectors.
Kill Chain
