CISA published advisory AA26-237A, “A Tale of Two SOCs: Insights From Two Red Team Assessments,” on August 25, 2026. It is the most useful document the agency has released this year, and not because of the vulnerabilities it describes.

CISA ran two assessments using substantially the same tradecraft against two critical infrastructure organizations: Organization A, in the Government Services and Facilities Sector, and Organization B, in the Water and Wastewater Systems Sector. The technical outcome was the same in both cases — full domain compromise. The defensive outcome was not remotely the same, and the difference had almost nothing to do with which tools each organization had bought.

The identical opening move

Against both targets, the red team started the same way: it found an internet-facing web application still running default credentials, took it over, and used it to send phishing email from an internal address.

That last detail is the whole trick. Phishing from a legitimate internal sender defeats SPF, DKIM and DMARC — because the mail genuinely originates from the domain — and defeats the “external sender” banner that most organizations rely on as their last line of user-facing defense. Recipients see a colleague’s address. Security tooling sees authenticated internal mail.

At Organization A, the payload landed on four workstations.

Organization B: two to twenty minutes

Organization B’s SOC detected the phishing payload’s execution and isolated the affected workstations within two to twenty minutes, before the red team could establish command and control.

This forced CISA to abandon the intrusion path entirely and restart under an assumed breach model — the assessor is simply granted a foothold, because earning one has been demonstrated to be impractical. Even then, portions of the red team’s follow-on activity were detected and quarantined.

Organization B still ended the assessment with a compromised domain. But every stage of that compromise cost the attacker something: alerts fired, hosts were pulled off the network, and the operators had to change plans. Against a real adversary operating under time pressure and OPSEC constraints, that friction is frequently the difference between an incident and a catastrophe.

Organization A: nothing

Organization A detected none of it. The red team gained initial access to multiple workstations, escalated to domain-level privileges, and moved laterally into sensitive business systems and cloud resources without generating a single investigated alert.

The advisory’s explanation is the most quotable finding in the document: the red team’s activity was obscured by thousands of false positive alerts. The tooling was not blind. The tooling was screaming continuously about nothing, which is operationally identical to blindness and considerably more expensive.

CISA’s summary line: “Detection tools are only as effective as the people, processes, and procedures supporting them.”

The advisory identifies two further organizational failures behind the miss — lack of SOC visibility across multiple tools, meaning analysts had to pivot between consoles that did not correlate, and limited analyst escalation authority, meaning that even a suspicious analyst lacked the standing to act.

The Active Directory path

The escalation route at Organization A will be familiar to anyone who has run an AD assessment in the last three years, which is exactly why it is damning:

Default Machine Account Quota. Active Directory ships with ms-DS-MachineAccountQuota set to 10, permitting any authenticated domain user to join up to ten computer accounts to the domain. That default exists for 1999-era desktop deployment convenience and today functions as a privilege escalation primitive underpinning several well-known attack chains. Almost no organization needs it above zero.

Misconfigured ADCS templates (ESC1). Active Directory Certificate Services templates that allow a requester to supply an arbitrary Subject Alternative Name, combined with a client authentication EKU and no manager approval, let any domain user request a certificate authenticating them as Domain Administrator. The certificate is issued by the organization’s own CA and is cryptographically valid. This is the same class of domain-takeover technique as the recently disclosed Certighost work.

Neither is a vulnerability in the sense of something with a CVE and a patch. Both are configuration defaults and administrative conveniences. Both have been publicly documented for years.

Then the cloud fell over too

Once inside, the red team collected credentials the way credentials are actually collected — by reading them off disk:

  • Cleartext credentials stored in files reached three sensitive business systems at Organization A
  • Database configuration files containing embedded secrets
  • Static AWS access keys that never expire
  • Primary Refresh Tokens stolen from compromised endpoints, replayed to reach cloud infrastructure
  • Entra ID applications with excessive permissions, including one granting mail access across all users in the tenant

That last item is the on-premises-to-cloud bridge in a single line. An over-privileged Entra application with tenant-wide mail permissions converts one compromised workstation into read access to every mailbox in the organization, and it does so through a legitimate, consented application that will not look anomalous in any sign-in log.

What this advisory is actually arguing

The industry’s default response to a breach is procurement. AA26-237A is an argument that procurement is not the variable.

Both organizations fell to the same techniques. The one that responded well did so because its analysts saw a real alert in a manageable alert stream and had the authority to isolate a host without seeking permission. The one that failed had tools that were generating thousands of false positives nobody had tuned, split across consoles nobody had correlated, watched by analysts nobody had empowered.

The remediation list that follows from this is unglamorous and mostly free:

  1. Set Machine Account Quota to 0.
  2. Audit ADCS templates for ESC1 through ESC8 conditions. Certipy and Locksmith will find them in an afternoon.
  3. Hunt for cleartext credentials in config files, scripts and shares.
  4. Eliminate static cloud access keys in favor of short-lived, federated credentials.
  5. Review Entra application consent grants, especially anything holding Mail.Read at tenant scope.
  6. Tune your alerts. An alert stream nobody can triage is not a control.
  7. Give analysts authority to isolate. Two-to-twenty-minute containment is impossible if it requires a manager’s approval.
  8. Kill default credentials on internet-facing applications. Both intrusions started there.

This advisory pairs directly with the NSA and FBI advisory on AI-assisted exploitation of PLCs and SCADA systems we covered last week. Both point at the water sector. Both describe adversaries who do not need novel capability, because default configurations keep supplying it.

Sources