"In one organization (Organization A), the team gained initial access to multiple workstations, gained elevated privileges over the domain, and moved laterally to [sensitive business systems] and cloud resources undetected," the Cybersecurity and Infrastructure Security Agency wrote.
Organization A: a government target that did not detect or halt intrusion
CISA’s red team was able to breach the government-sector target—labeled “Organization A” in the agency’s report—by sending phishing emails from an internal address to gain access to workstations. Once inside, the testers escalated privileges, moved laterally, and reached sensitive business systems and cloud resources without being stopped.
The red team observed operational breakdowns inside Organization A’s security operations center: personnel email correspondence showed alerts of low- and medium-severity endpoint detection and response (EDR) events, but defenders did not respond. The agency said false positives numbering in the thousands, including some higher-severity alerts, “obscured the alerts triggered by red team activity.” CISA also faulted “organizational silos” for hindering effective response.
Organization B: a water utility that detected and contained the attack
By contrast, the water-sector target (“Organization B”) detected initial compromise quickly after a spearphishing campaign convinced three users to click a malicious link. The security operations center triaged the resulting alerts and quarantined the affected workstations in 2, 10, and 20 minutes respectively—timeframes the agency recorded verbatim. That early action prevented the red team from freely following up on their initial foothold.
When CISA’s red team switched approaches, Organization B moved the exercise to an “assume breach” model. Trusted agents (TAs) provided the red team access to a host that replicated the level of access the red team would have had if defenders had not detected the activity. From that pivot, the red team escalated privileges and attempted lateral movement to sensitive business systems, cloud resources, and a bastion host in the operational technology (OT) demilitarized zone (DMZ). Defenders again detected the activity and isolated the system.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCommon technical shortfalls: cloud risk, Conditional Access, and token revocation
CISA’s writeup found shared weaknesses across both organizations despite the divergent outcomes. Both organizations “underestimated cloud risks,” lacked Conditional Access—a Microsoft security control—for workload identities, and did not have processes in place to revoke compromised access or refresh tokens. Those gaps mattered because the red team’s later-stage operations involved cloud resources and privilege escalation that depend on identity and token controls.
The agency’s assessment links rapid, effective detection to the ability to limit attackers’ movement even when initial access occurs; conversely, alert overload and organizational silos can allow intruders to escalate and reach sensitive systems unseen.
CISA’s testing program and the water sector context
CISA published the breakdown Tuesday in a rare public report on its red-team activities. The agency did not name either tested organization; the evaluations were conducted through a voluntary, by-request process. The public release comes as attention on the water sector has increased—CISA noted that attacks on water facilities have drawn higher profile scrutiny after revelations of targeting across the United States over the past month alongside numerous government warnings.
The agency also noted that it had first published an advisory on its red team activity in 2023 and that it had said last year it had not “laid off” its red team after media stories of contractor departures. CISA’s new report is a relatively infrequent public accounting of the outcomes from its offensive testing.
What this means for technologists, policymakers, and water utilities
- Technologists and security teams: The report highlights practical triage differences—quarantine actions in 2, 10, and 20 minutes at Organization B versus no effective response at Organization A—and underscores the operational harms of alert fatigue and siloed teams. The specific controls CISA identified—Conditional Access for workload identities and token-revocation processes—are concrete remediation items to prioritize.
- Policymakers and regulators: The tests were voluntary and by-request, and the agency published the results without naming the organizations. Policymakers may take the contrast—government target failing to detect versus water target succeeding—as a data point when considering oversight, incentives, or requirements for detection, incident response, and disclosure.
- Water utilities and similar critical infrastructure operators: The water-sector result demonstrates that fast triage and quarantine can blunt an attacker’s progress even after user compromise. The report’s notation that attackers later attempted to reach an OT DMZ bastion host underlines why defenders must link IT and OT detection and response.
CISA’s red-team exercise produced a clear, if narrow, demonstration: initial compromise is rarely the final failure; operational detection and response are. Organization B’s rapid quarantines and an “assume breach” posture limited the simulated adversary’s gains. Organization A’s overwhelmed alerts, unanswered EDR notifications, and internal silos allowed a parallel red team to reach sensitive systems and cloud resources undetected. The agency’s identification of cloud identity controls and token-revocation processes as common weak points gives organizations concrete targets for closing similar gaps.
