How CISA's Red Team Breached Two Critical Targets With Starkly Different Results

Robert Moore · 2026-08-26

Here's something that should make anyone in security sit up a little straighter. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) just dropped a report that's more revealing than most. They ran two red team assessments at the same time, targeting two different critical infrastructure organizations. The kicker? They used what they call 'similar tradecraft' for both attacks. But the defensive outcomes they recorded were night and day. Think about that for a second. Same playbook, same team, same timeframe. Yet, the results painted two completely different pictures of resilience. It's a controlled experiment that cuts through the noise and shows us what really matters when the pressure is on. ### The Core Finding: Full Compromise at the Domain Level Let's get into the uncomfortable truth first. In both cases, CISA's red team didn't just sneak in a backdoor or grab some low-level credentials. They achieved a full compromise at the domain level. That's the crown jewels. It means they gained control that could have allowed them to manipulate, disrupt, or steal from the very heart of these organizations' digital operations. And here's where it gets even more interesting. The report indicates that in both engagements, the red team also managed to move laterally. That's security-speak for 'they didn't stop at the first door they kicked in.' They kept exploring, finding connections, and escalating their access. It's a classic, and devastating, attack pattern. ### Why One Organization Saw Nothing So, if both were fully breached, what was the 'sharply different' outcome? The clue is in the original title. One of the organizations apparently detected... nothing. Zero. Zilch. Their security systems and teams were blind to an active, ongoing compromise by a skilled adversary. The other organization? They detected the activity. We don't know the full details from the snippet—whether they detected it early or late, or how effectively they responded. But the simple fact of detection creates a monumental chasm between the two scenarios. One is flying blind. The other, at the very least, has their eyes open. This disparity is the whole story. It screams a question every security pro needs to ask: Are we the organization that sees the threat, or the one that doesn't? ### What This Means for Your Defensive Strategy You can't buy your way out of this problem with just a bigger budget. This is about strategy, visibility, and human expertise. Here are a few immediate takeaways: - **Assume Breach is the Only Safe Mindset.** If CISA's team can fully compromise two critical infrastructure orgs, your organization is not immune. Building defenses that focus only on keeping attackers out is a losing game. You must have layers designed to detect and respond once they *are* inside. - **Visibility is Non-Negotiable.** You can't detect what you can't see. The 'silent' victim likely had gaps in their logging, monitoring, or threat-hunting capabilities. Comprehensive visibility across your endpoints, network, and cloud environments is the price of admission. - **Practice Under Pressure.** Red teaming and penetration testing aren't just checkboxes. They're the closest you get to a real game before the season starts. They reveal whether your tools talk to each other and if your team knows the playbook when the alerts start flashing. It's a sobering reminder. In cybersecurity, the gap between 'good' and 'good enough' isn't measured in inches—it's measured in the ability to see the enemy moving in your own house. CISA's exercise shows that gap is real, and it's decisive. As one seasoned analyst put it after reading the report, 'The difference between a costly incident and a catastrophic one often boils down to a single, timely alert.' That's the line these two organizations found themselves on opposite sides of. Which side of that line are you building on?