The U.S. Cybersecurity and Infrastructure Security Agency fully compromised two critical infrastructure organizations at the domain level during simultaneous red team assessments, yet only one of them detected the intrusion. CISA released the findings on August 25, 2026, in an advisory titled "A Tale of Two SOCs," documenting how identical attack methods produced wildly different defensive outcomes. Both targets—a government services facility and a water treatment system—allowed attackers to reach sensitive business systems and cloud resources, but their security operations centers responded in completely opposite ways.

At Organization A, a government services facility, the red team entered through a web application using default credentials for multiple built-in accounts, which let them send phishing messages from an internal email address and compromise four workstations. The attackers elevated their access by exploiting a default Machine Account Quota setting combined with a misconfigured Active Directory Certificate Services template—the same certificate vulnerability class used in a recently revealed domain-takeover exploit called Certighost. They accessed three sensitive business systems using credentials stored in cleartext, including decrypted database configuration files and static Amazon Web Services access keys that never expired. In the cloud environment, the team stole a Primary Refresh Token and abused Entra ID applications with elevated permissions to read the security team's email and monitor whether defenders had noticed the breach. Organization A detected none of it. Thousands of false-positive alerts from routine business activity, many flagged at higher severity levels, buried the alerts generated by the red team. The organization operated multiple security operations centers and endpoint tools that couldn't share visibility with one another. Analysts lacked escalation procedures and had limited authority to take action, and one genuine alert tied to red team activity on a System Center Configuration Manager server was dismissed as a false positive when defenders couldn't identify who owned the system.

Organization B, a water and wastewater facility facing the same attack approach, detected the initial phishing payloads as they executed and isolated the compromised workstations within 2 to 20 minutes, severing command-and-control communications before the intrusion could spread. Because that foothold was cut off, CISA's trusted agents at the organization executed a red team payload on a designated non-privileged host to simulate the access the team would have gained, shifting the engagement to an assume-breach model. From that point, the attackers found the same underlying security gaps, including cleartext credentials for a domain service account in an SCCM configuration file that had rights over a domain controller, which they used to run a DCSync attack and retrieve the krbtgt secret. The team also reached a bastion host in Organization B's operational technology demilitarized zone, but the host blocked outbound internet access, preventing command-and-control channel establishment, and the team never entered the OT systems themselves. According to CISA, the agency identified five critical weaknesses that enabled the compromise: Machine Account Quota left at the default setting, allowing any domain user to add machine accounts; AD CS certificate templates misconfigured to permit certificate requests for any user; cleartext credentials for service and database accounts stored on accessible systems; static cloud access keys set never to expire with no token revocation in place; and over-permissioned applications in Entra ID able to read mail across all users.

CISA attributed the stark difference between the two outcomes to the people and processes operating the security tools rather than the tools themselves. "Detection tools are only as effective as the people, processes, and procedures supporting them," the agency stated. Organization A's security program collapsed under alert fatigue and organizational fragmentation—its security operations centers couldn't communicate, analysts couldn't escalate findings, and legitimate threats drowned in a sea of false alarms that conditioned the team to dismiss warnings. Organization B's SOC demonstrated that the same vulnerabilities can be contained when defenders respond quickly and decisively, even though the underlying technical weaknesses remained exploitable once attackers established a foothold. The water facility's ability to isolate compromised systems in minutes prevented lateral movement that would have otherwise succeeded, turning what could have been a full domain compromise into a contained incident requiring manual simulation to continue the assessment. Both organizations shared identical technical flaws—default settings, misconfigured certificate templates, cleartext credentials, and excessive cloud permissions—but only one had built the operational muscle to act on the alerts those flaws generated. The lesson is that buying detection technology without investing in the teams, workflows, and authority structures to use it leaves critical infrastructure just as vulnerable as having no detection at all.