The Cybersecurity and Infrastructure Security Agency (CISA) conducted two simultaneous red team assessments using similar threat actor tradecraft. In both environments, the red team achieved full domain compromise and accessed sensitive business systems and cloud resources. However, Organization A failed to detect or contain the activity, whereas Organization B quickly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. The advisory details the red team's activity and offers lessons learned for improving IT, cloud, and operational technology (OT) security postures.

What should defenders do?

Organizations should establish and maintain baselines to reduce alert noise, fine-tune detection tools, and break down silos to empower network defenders. Implement Conditional Access policies for workload identities and monitor for excessive permissions. Develop and regularly review procedures for detecting, remediating, and revoking access and refresh tokens following a cloud compromise. These steps improve detection, response, and protections across IT, cloud, and OT environments.

highIncident Response

CISA Reports Divergent Outcomes in Simultaneous Red Team Assessments of Critical Infrastructure Organizations

Organization A suffered undetected full domain compromise while Organization B rapidly contained the threat, highlighting critical gaps in detection and response.

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Key Takeaways

Untuned detection tools and lack of baselines lead to missed threats, as false positives and routine alerts overwhelm defenders.
Organizational silos and bureaucratic hurdles impede effective incident response, as fragmented communication and unclear responsibilities hinder containment.
Cloud environments are often an underestimated risk, with organizations lacking adequate security controls and response processes for cloud compromise.
Establishing and maintaining baselines, reducing alert noise, and fine-tuning detection tools are essential for improving threat visibility.

Related Security News

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read