- › CISA advisory AA26-237A documents two red team assessments run against critical infrastructure organizations at the same time with similar methods.
- › One SOC isolated each phishing payload within 2 to 20 minutes. The other never detected a full domain compromise that ended with the red team reading the security team's email.
- › CISA attributes the gap to people, processes, and procedures, not to the detection products in use.
- › Every finding at the organization that saw nothing was an inventory or hygiene problem: a default credential, an unreviewed certificate template, cloud keys set never to expire.
- › You cannot tell which of the two you are from a product list, an audit, or a dashboard, and the only way to find out is an unannounced test.
Two organizations, two security operations centers, roughly the same attack, run at roughly the same time by the same red team. One of them isolated the intrusion inside twenty minutes. The other never noticed it at all, right up to the point where the operators were reading the security team’s own email.
CISA published that comparison this week as advisory AA26-237A, and titled it a tale of two SOCs. It is the closest thing our field gets to a controlled experiment, and the conclusion is uncomfortable enough that it deserves more attention than a normal advisory.
What Happened at Each One
Organization B is a water and wastewater utility. The red team sent phishing payloads, and the SOC detected each one as it executed, isolating the affected workstations within 2 to 20 minutes and preventing lateral movement. The team eventually reached a domain service account through SCCM and got as far as an OT bastion host, and there they stalled, because outbound internet blocking meant they could not establish command and control from it.
Organization A is in government services and facilities. Initial access came through a web application with default credentials, followed by phishing. From there the team escalated privileges using Machine Account Quota settings and a misconfigured Active Directory Certificate Services template, pulled cleartext credentials out of database configuration files, found static AWS keys set never to expire, stole Primary Refresh Tokens, ran DCSync, and finished by abusing Entra ID applications with elevated permissions to read the security team’s mailbox. The assessment ended with full domain compromise and access to sensitive business systems and cloud resources.
Nothing was detected. Not the default credential, not the phishing, not the privilege escalation, not the token theft, not the mailbox access.
The Part Everyone Will Want to Skip
The obvious question is which products each one was running, and CISA’s answer is that this is the wrong question. The agency’s stated conclusion is that detection tools are only as effective as the people, processes, and procedures supporting them, and it attributes the divergent outcomes to human factors instead of a difference in tooling.
I have sat in enough vendor conversations to know how unwelcome that is. A tooling gap is a purchase order, and a process gap is eighteen months of unglamorous work that no one gets promoted for. The advisory is telling you the expensive answer.
Look at what actually let the red team into Organization A. A web application with default credentials, which is an inventory failure. A certificate template misconfigured in a way that has been publicly documented and named for years, which is a review failure. Cleartext credentials sitting in database configuration files, which is a hygiene failure. Cloud access keys set never to expire, which is a lifecycle failure. Not one of those is exotic, and not one of them would have been fixed by a better product, because every one of them describes something nobody was looking at.
Why Your Dashboard Cannot Tell You Which One You Are
Here is the problem that earns this advisory an afternoon of your time. Organization A’s security team had no idea. They were not ignoring alerts, because there were no alerts. Every dashboard they looked at was green, and it was green for the entirely correct reason that nothing in their stack had produced a finding. A detection stack that sees nothing and a detection stack that has nothing to see are indistinguishable from the inside.
That means the ordinary instruments do not help you here. Your alert volume looks healthy either way. Your mean time to respond looks excellent, because it is calculated over the alerts you received. Your compliance audit passes, because the controls are present and documented. Your coverage matrix shows the techniques you have rules for, which is not the same as the techniques those rules would actually catch in your environment on a Tuesday.
The only instrument that distinguishes the two is somebody attacking you without warning and telling you afterwards what you saw. Everything else you own measures the alerts you got, and the whole problem is the ones you did not.
What Organization B Did Right
It is worth being specific about the good outcome, because it was not luck. Somebody had tuned detection to fire on payload execution instead of on delivery, which is why each phishing attempt was caught as it ran and not filtered on the way in or missed entirely. Somebody had built a response path that could isolate a workstation in single-digit minutes, which means the authority to do it existed before the incident and did not require waking a manager. And somebody had blocked outbound internet from an OT bastion host, which is the control that turned a successful intrusion into a dead end.
That last one is the converged security lesson, and it is why a water utility is the organization that comes out of this well. Blocking egress from a bastion host into a control environment is a decision that costs someone convenience every single day and pays off once. Our guide to operational technology security covers the surrounding program, and the case for running these functions together instead of separately is in the converged security operations center business case.
Four Things to Check This Week
None of these requires budget, and all four are things Organization A would have found on its own if anybody had gone looking. Work them in order, because the first one is how the red team got in.
Search for default credentials on anything internet-facing
Start with the applications nobody owns: the appliance web interface, the monitoring tool a team installed years ago, the vendor portal that came with a system. Initial access at Organization A was a web application with a default credential, which is the least sophisticated finding in the entire advisory and the one that started everything else.
Review your certificate templates
Active Directory Certificate Services misconfigurations are well documented, publicly named, and still everywhere, because certificate services are usually set up once by somebody who has since left. If nobody in your organization can tell you when the templates were last reviewed, the answer is that they have not been.
Find your non-expiring credentials
Static cloud access keys set never to expire, service accounts with passwords older than the person who set them, and API tokens in configuration files. The specific phrase in the advisory is “set never to expire,” and that is a query you can run against your cloud accounts this afternoon.
Ask what would happen if a workstation needed isolating right now
Organization B isolated hosts in 2 to 20 minutes. Ask your team who has the authority to pull a machine off the network at three in the morning, whether they need permission, and how long it takes. If the answer involves a manager and a phone call, you have found a process gap that no product will close, and this is the one that most directly separated the two organizations.
The Assessment Is the Point
The reason to read AA26-237A rather than a summary of it is that Organization A is not a badly run organization in any way you would notice from outside. It had a security team, a SOC, and detection tooling. It had, presumably, an audit that passed.
What it did not have was evidence that any of it worked, and it did not have that evidence because nobody had ever tested it under conditions the defenders did not control. Our piece on why the operator’s screen agrees with the attacker makes a related point about trusting an instrument that an attacker can influence, and when the only control is the audit log covers what happens when the record is the last thing standing.
If you take one thing from the advisory, make it this. You do not currently know whether you are Organization A or Organization B, and neither did they.
Want to know which one you are? Contact Grab The Axe for a security assessment, or start with our free Human Attack Surface Score.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
