Cybersecurity
CISA's Two-SOC Red Team Report Shows What Actually Stops a Breach
CISA ran the same red-team tools and techniques against two critical infrastructure organizations: one detected nothing, the other stopped it in minutes. This article breaks down CISA Advisory AA26-237A, the Active Directory and cloud identity gaps behind the failure, and the alert-triage and hygiene fixes commercial IT teams should check now.
CISA published one of its more unusual advisories on August 25, 2026: a side-by-side account of its own red team running the same attacker tools and techniques, though the initial foothold differed by organization, against two consenting critical infrastructure organizations, with opposite results.
According to CISA Cybersecurity Advisory AA26-237A, "A Tale of Two SOCs: Insights From Two Red Team Assessments", one organization's security team never noticed the intrusion. The other detected and isolated it within minutes. Same attacker, same tools, same techniques, two completely different outcomes.
Both organizations had endpoint detection generating alerts, so vendor tooling alone did not decide the outcome. What mattered more was what happened after the alert fired, and whether monitoring tools gave a unified view instead of fragmented noise. Separately, both organizations also had identity and Active Directory hygiene gaps that left cheap escalation paths open for the red team, worth closing on their own regardless of either organization's detection speed. For a commercial IT team weighing how much security budget goes to tools versus people and process, this advisory is a useful data point on where that balance actually pays off.
What CISA's Red Team Found
CISA identifies the two organizations only by sector: a Government Services and Facilities Sector entity (Organization A) and a Water and Wastewater Systems Sector entity (Organization B). Against Organization A, the red team used a web application with default credentials to gain a foothold, then phished internally to land on four workstations. From there it escalated by abusing a default Machine Account Quota setting and a misconfigured Active Directory Certificate Services template vulnerable to an ESC1-style request.
The red team then found cleartext credentials sitting in database configuration files and a long-lived static AWS access key that had never been rotated or retired. It also abused an over-permissioned Entra ID application to read security personnel's own email and confirm that nobody had noticed the intrusion.
The result was full domain compromise, and Organization A's security operations center caught none of it. Its tools did generate alerts, but they were buried among thousands of false positives, multiple monitoring tools lacked shared visibility, and a legitimate related alert was dismissed because no one could identify which system had triggered it.
Organization B faced the identical phishing payload and isolated it in roughly two to twenty minutes, cutting off command-and-control before the red team could do meaningful damage.
CISA then shifted to an assume-breach model to keep testing Organization B's defenses. It found the same category of cleartext credentials, this time on a domain service account with rights sufficient to pull the krbtgt secret, and reached a bastion host inside the operational technology zone before losing outbound internet access, which stopped further movement.
CISA's own summary states plainly that "detection tools are only as effective as the people, processes, and procedures supporting them."
Why This Matters for Commercial Organizations
The tools the red team used, BloodHound, AzureHound, ROADrecon, and Rubeus, are free and publicly available. None of the techniques required nation-state resources or a zero-day exploit.
They targeted the same Active Directory and Entra ID misconfigurations that show up in commercial environments of every size: quota and template settings left at defaults, credentials saved in plaintext, and long-lived cloud access keys that go unrotated and unretired. A business does not need to run critical infrastructure to have these same gaps in its own tenant right now.
CISA's account does not say how much either organization spent on tools, so it does not support a conclusion about spending either way. What it does show is that the outcome tracked whether an alert reached a person with authority to act on it in minutes rather than never. Most small and midsize businesses cannot staff a 24/7 internal security operations center, which is exactly the argument for a monitored detection service with a human triaging every alert. But this advisory shows that service is only as good as its escalation discipline and its tuning against false positives, not just its logo on the contract.
What Business Leaders and IT Teams Should Do Now
A few concrete steps come directly out of CISA's overall findings.
Ask your internal team or outsourced provider who actually watches the alerts your tools generate, and what authority that person has to isolate a device without waiting on a chain of approvals. Organization A had real alerts; nobody with authority to act saw them in time.
Have someone review Active Directory Certificate Services templates for ESC1-style misconfigurations and confirm Machine Account Quota is set to zero unless there is a documented reason otherwise. This is the same discipline behind revoking unnecessary local admin rights: close the easy escalation path before an attacker needs to find a clever one.
Search configuration files, scripts, and shared drives for cleartext credentials, the kind of exposure both organizations in CISA's assessment had, and move anything you find into an appropriate secret store or workload identity rather than just rotating the value and writing it back into the same file. Organization A's sat alongside a long-lived cloud access key that had never been rotated or retired; Organization B's was a domain service account credential with rights sufficient to pull the krbtgt secret. Either one hands an attacker a shortcut past whatever else you have in place.
Confirm phishing-resistant multi-factor authentication and conditional access apply to every interactive human login, not just a subset of accounts. Cloud workload identities such as AWS access keys and Entra service principals cannot perform interactive MFA at all, so they need their own controls instead: managed identities in place of static keys, short-lived or automatically rotated credentials, least-privilege scoping, and dedicated workload-identity policies. The static AWS key and the over-permissioned Entra ID application here were both non-human identities that received none of that scrutiny.
Check whether your organization has an accurate, current inventory of who owns each system. Organization A's own team dismissed a legitimate alert during the intrusion because nobody could identify the system owner fast enough to investigate.
Where Cyber One Solutions Can Help
Cyber One Solutions operates a 24/7 Security Operations Center with managed EDR on every endpoint as part of our managed cybersecurity services, built around the exact gap this advisory describes: an alert nobody watches or acts on is functionally the same as no alert. That includes MFA enforcement and identity monitoring, so service accounts and cloud identities get the same scrutiny as user logins.
Our managed IT services cover the ongoing server, identity, and endpoint hygiene, patching, and least-privilege access work that closes off the kind of default settings and cleartext-credential exposures CISA's red team exploited in this assessment.
The Bottom Line
Two organizations faced the same attacker and techniques, and the outcome came down to whether a person with real authority saw the alert and acted within minutes, not which security product logo was on the invoice. Both organizations also had exploitable identity and Active Directory gaps; closing those is a separate, worthwhile fix within every commercial IT team's control, whatever its detection speed looks like today.
If you want a straightforward look at whether your alerts would actually reach someone able to act on them, and whether your Active Directory and cloud identity settings would hold up against the same tradecraft CISA just tested, contact Cyber One Solutions and we will walk through it with you.
Sources
- CISA Cybersecurity Advisory AA26-237A, "A Tale of Two SOCs: Insights From Two Red Team Assessments"
- CISA Red Team Fully Compromised Two Critical Infrastructure Orgs, One Detected Nothing, The Hacker News
- SafeBreach Coverage for CISA Advisory AA26-237A: Two SOCs
Frequently Asked Questions
What is CISA Advisory AA26-237A?
It is an August 25, 2026 CISA Cybersecurity Advisory titled "A Tale of Two SOCs: Insights From Two Red Team Assessments." It describes two red team engagements CISA ran against consenting critical infrastructure organizations using the same attacker, tools, and techniques (though the initial foothold differed by organization), and compares why one organization detected the intrusion within minutes while the other never noticed it at all.
Does this advisory apply to a small or midsize commercial business, not just critical infrastructure?
Yes, in principle. The tools the red team used, BloodHound, AzureHound, ROADrecon, and Rubeus, are free and target common Active Directory and Entra ID misconfigurations found in businesses of every size and sector, not something unique to critical infrastructure. The root causes CISA identified, default Machine Account Quota settings, a misconfigured certificate template, cleartext credentials, and a static cloud access key, can occur in a typical commercial IT environment just as easily.
What was actually different between the organization that detected the intrusion and the one that did not?
Not the attacker's tools and overlapping techniques, which were shared against both, even though the initial foothold and later paths differed. Organization B isolated the initial phishing payload within roughly two to twenty minutes and cut off command-and-control. Organization A's endpoint tools also generated alerts, but they were buried among thousands of false positives, multiple monitoring tools lacked shared visibility, and a legitimate related alert was dismissed during the actual intrusion because nobody could quickly identify which system had triggered it.
What are the highest-value fixes a business can make after reading this advisory?
Two fixes, and they work together. First, confirm someone is actually watching the alerts your security tools generate and has clear authority to isolate a device within minutes, since an alert nobody acts on is functionally the same as no detection at all. Second, close the cheap privilege-escalation paths CISA called out directly: set Machine Account Quota to zero unless there is a documented reason not to, review Active Directory Certificate Services templates for ESC1-style misconfigurations, and move cleartext credentials and long-lived cloud access keys out of plaintext storage into an appropriate secret store or workload identity, rotating the exposed values as part of that move rather than rewriting them back into the same file.