Two SOCs, Same Attack: CISA Red Team Walks Through One Network, Gets Caught in the Other

Key points

• The Cybersecurity and Infrastructure Security Agency (CISA) ran two simultaneous red team drills in 2026, one at a government services agency and one at a water and wastewater utility.
• Both organisations were fully taken over at the domain level, but only the water utility detected and contained the initial break-in.
• The government agency missed a phishing attack that gave the red team access to four staff workstations, then let attackers reach sensitive business systems and cloud resources undetected.
• CISA blamed untuned alerts, siloed teams, and weak cloud security controls for the government agency's failure.
• The advisory urges critical infrastructure operators to baseline their alerts, empower defenders to act, and write real playbooks for cloud break-ins.

CISA sent its red team, a group of friendly hackers paid to break in the way real criminals would, into two organisations at the same time. Same tradecraft. Wildly different results.

One target was a federal government services agency. The other was a water and wastewater utility. Both ended up fully compromised at the top level of their Windows networks. Only one noticed.

The advisory from CISA, published 25 August 2026, calls the pair "A Tale of Two SOCs." A SOC is a security operations centre, the team of analysts watching alerts and hunting for intruders. The story it tells is uncomfortable reading for anyone running one.

How did the red team get in?

Through a web application with default usernames and passwords that nobody had changed. The red team used those built-in accounts to send phishing emails, where criminals send fake messages that look internal to trick staff into clicking, from a real internal address. Four staff at the government agency clicked. That was enough.

From those four workstations, the attackers ran a modified version of BloodHound, a tool that maps out who has access to what inside a Windows network. They had tweaked it to slip past the agency's endpoint detection and response software, the security tool watching each computer for suspicious behaviour.

Then they found two more gifts. The network let ordinary users add up to ten new computer accounts to the domain. And the certificate service, which hands out digital IDs, was misconfigured in a way (known as ESC1) that let any user request a certificate impersonating anyone else, including administrators.

Game over. The red team created a machine account, requested a certificate as a privileged user, and had the keys to the kingdom.

What did Organisation A miss?

Everything. The agency's tools were generating alerts, but nobody had tuned them, so real attacks blended into a wall of false positives. Analysts did not know who owned which system. Defenders lacked the authority to isolate machines without approval from other teams. By the time anyone might have looked, the red team was already inside sensitive business systems and cloud accounts.

Why did Organisation B do better?

The water utility's defenders spotted the initial break-in and quarantined the affected machines within hours. The red team had to switch to what CISA calls an "assume breach" model: the utility handed them access to a test host so the drill could continue, mimicking what the attackers would have reached had they not been caught.

Even then, when the red team pivoted toward the operational technology network (the systems that actually run pumps and treatment processes) through a bastion host in the DMZ, defenders caught them again and isolated the system.

What does CISA want organisations to do?

The lesson underneath the technical detail is blunt. Detection tools only work if humans behind them are trained, empowered, and organised to act. The water utility did not have better software. It had a better team.