CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

The US Cybersecurity and Infrastructure Security Agency conducted simultaneous red team assessments against two critical infrastructure organizations, using similar tactics. Both organizations were fully compromised at the domain level, with the red team achieving the same level of access in each. The assessments resulted in sharply different defensive outcomes, with one organization detecting no malicious activity. The red team was able to compromise both organizations, highlighting vulnerabilities in their defenses. The assessments demonstrate the importance of robust defensive measures in preventing or detecting breaches. The differing outcomes suggest that one organization's security measures were more effective than the other's.