55
30
55
42
30
42
30
55
60
55
55
30
55
60
55
42
55
42
30
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.
72
55
30
60
30
60
30
30
55
30
55
55
30
30
55
55
30
55
42
55
30