CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA's simultaneous red team assessments revealed that default credentials, misconfigured Active Directory Certificate Services, and overpermissioned cloud applications allowed full domain takeover of Organization A — which detected nothing throughout the entire engagement. Organization B's swift detection and containment within 2–20 minutes demonstrated that the same attack techniques can be effectively neutralized when mature monitoring and response capabilities are in place. The core failure in Organization A was not a lack of patches alone, but a compounding of poor configuration hygiene with zero visibility into attacker activity. This matters because critical infrastructure organizations face nation-state and sophisticated threat actors who actively exploit exactly these misconfigurations, and undetected compromise can persist for months. The contrast between the two organizations is a stark reminder that security controls are only as effective as the organization's ability to detect when they fail.