CISA Red Team Exercise Exposes Critical Infrastructure Vulnerabilities: One Organization Failed to Detect Compromise

Key Findings

• CISA red teams fully compromised two critical infrastructure organizations using comparable techniques, but outcomes diverged dramatically based on detection and response capabilities

• Organization A (Government Services and Facilities Sector) never detected the breach; Organization B (Water and Wastewater Systems Sector) isolated affected systems within 2-20 minutes

• Both organizations suffered full domain compromise and cloud environment access, but only Organization A remained unaware until CISA briefed them

• Detection failures at Organization A stemmed from thousands of false positive alerts, siloed SOCs with no cross-team visibility, and lack of clear escalation procedures

• Common vulnerabilities across both organizations included misconfigured Active Directory Certificate Services, cleartext credentials, static cloud access keys, and lack of Conditional Access for workload identities

Background

CISA conducted two simultaneous red team assessments against critical infrastructure organizations and published the results in advisory AA26-237A in August 2026. The assessments revealed starkly different defensive capabilities despite similar attack tradecraft. While both organizations failed to prevent full compromise, the differences in detection speed and response procedures created entirely different outcomes. Organization A represents the Government Services and Facilities Sector, while Organization B operates Water and Wastewater Systems. The comparison illustrates that defensive strength depends far more on people, processes, and procedures than on the sophistication of tools alone.

Organization A's Complete Failure to Detect

The red team gained initial access to Organization A through a web application using default credentials. From there, they sent phishing emails from a trusted internal address, landing on four workstations. They escalated privileges by exploiting a misconfigured Active Directory Certificate Services template with the ESC1 flaw, allowing low-privileged users to request certificates for administrators.

The intrusion extended to sensitive business systems using cleartext credentials stored in database configuration files and AWS access keys set never to expire. The red team moved into the cloud environment and read SOC staff emails to confirm nobody had detected them. They found nothing. They even deployed keyloggers and screenshot capture on SOC workstations to monitor if detection was occurring. It never was.

Alert Fatigue and Visibility Failures

Organization A's SOC was drowning in false positives, with thousands of alerts arriving daily. Many routine alerts carried higher severity ratings than the actual intrusion activity the red team generated. When analysts reviewed SCCM-related alerts from real red team activity, they couldn't identify the system's owner or function and dismissed it as a false positive.

The organization operated multiple separate SOCs with different endpoint detection and response solutions and no visibility between teams. Even if one SOC noticed something suspicious, there was no mechanism to act on it across relevant systems. Analysts lacked written escalation procedures and clear authority to contain incidents, so their default response to ambiguity was to wait rather than act.

Organization B's Rapid Response

Organization B detected the initial phishing payloads immediately as they executed and isolated affected workstations within 2 to 20 minutes, severing command-and-control communications before the intrusion spread. Because that initial foothold was eliminated, the engagement shifted to an assume-breach model where CISA's red team executed payloads on designated non-privileged hosts.

Even from that compromised position, Organization B's team found the same underlying weaknesses. The red team discovered a password stored in plaintext in an SCCM XML file and used the associated service account to perform a DCSync attack, obtaining the krbtgt hash to create Golden Tickets. They also identified a path into the operational technology network through RDP files pointing to a bastion host, but the bastion blocked outbound internet access and was quarantined before establishing command-and-control.

Organization B's SOC staff triaged alerts, investigated findings, coordinated with engineering teams, and reimaged compromised machines before returning them to users. The speed and coordination prevented lateral movement despite similar initial vulnerabilities.

Shared Cloud Security Gaps

Both organizations left Conditional Access disabled for workload identities, a Microsoft feature that applies access controls to applications and service accounts. Without this protection, applications with broad Microsoft Graph permissions could bypass normal Conditional Access rules designed for human users.

The red team exploited this gap in both organizations to access email systems across the companies. Organization A compounded the problem by storing AWS IAM credentials in users' home directories with no expiration dates, creating permanent backdoor access. Organization B had similar issues but contained damage faster through superior detection and response procedures.

The Human Factor

CISA emphasized that the difference in outcomes had nothing to do with attack sophistication or tool capabilities. Both organizations possessed similar security tools, but Organization B's people, processes, and procedures dramatically outperformed Organization A's. Effective detection requires well-tuned alerts that highlight genuine anomalies while filtering routine business activity. Organization A's analysts operated in silos without clear authority to act, while Organization B's teams had defined procedures and the autonomy to contain incidents rapidly.

Sources

• https://securityaffairs.com/197901/hacking/cisa-red-team-fully-compromised-two-critical-infrastructure-orgs.html

• https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html

• https://www.facebook.com/thehackernews/posts/-cisa-red-teams-compromised-two-critical-infrastructure-organizations-one-soc-de/1458411349656777

• https://www.reddit.com/r/SecOpsDaily/comments/1vyzqdc/cisa_red_team_compromised_two_critical