As reported by CISA in advisory AA26-237A, the agency conducted simultaneous red team assessments at two critical infrastructure organizations with dramatically different outcomes. Both environments fell to full domain compromise, but only one SOC noticed. That asymmetry is the most important finding here — not the attack techniques, which were routine, but the defensive gap that made the difference between rapid containment and total blindness.

Key Insight: As reported by CISA in advisory AA26-237A, the agency conducted simultaneous red team assessments at two critical infrastructure organizations with dramatically different outcomes.

The advisory's headline lessons — untuned detection tools, organizational silos, and underestimated cloud risk — are not new problems. What makes this report valuable is the side-by-side evidence that these failures are not theoretical. Organization A had tooling in place. It had a SOC. It still missed full domain compromise. The gap was not capability; it was configuration, authority, and process.

Why This Matters

Shield53 has observed this pattern repeatedly in engagements: organizations invest heavily in EDR, SIEM, and cloud security platforms but underinvest in the human and procedural layer that makes those tools effective. A SIEM ingesting thousands of unprioritized alerts per hour is functionally equivalent to having no SIEM at all. Organization A demonstrates this principle in the worst possible way — full domain compromise with zero meaningful detection.

Organization B's success is instructive. By rapidly identifying initial compromise attempts and isolating affected systems, B forced the red team to shift to an assume-breach model. This is what mature detection looks like: not preventing every intrusion, but compressing the window between initial access and containment to the point where attackers cannot achieve objectives.

The Cloud Blind Spot

CISA's finding that cloud environments are routinely underestimated deserves particular emphasis. In both assessments, the red team accessed cloud resources — and in both cases, cloud detection and response capabilities were insufficient. This reflects a broader industry problem: identity-centric attack paths that traverse from on-premises Active Directory to Entra ID to SaaS applications frequently bypass traditional network monitoring entirely.

Workload identities, OAuth tokens, and refresh tokens are the new perimeter. Most SOCs are not monitoring them, and most IR plans do not cover revoking them.

Who Is Affected

The Cloud Blind Spot
Critical infrastructure operators with hybrid on-premises and cloud environments — the primary audience for this advisory
Organizations with recently deployed or immature SIEM/EDR — tooling without tuning is a false sense of security
SOC teams lacking cloud-specific IR procedures — token revocation and conditional access responses are often absent from runbooks
Federal agencies and SLTT governments explicitly named in the advisory's intended audience

Shield53 Recommendations

Immediate Actions:

  • Audit your SIEM and EDR alert rules this quarter. Suppress or aggregate low-fidelity alerts. If your analysts are acknowledging more than 50 alerts per shift without escalation, your tuning is failing.
  • Map your cloud identity attack surface. Inventory all OAuth applications, service principals, and refresh tokens. Document the revocation procedure for each.
  • Review Conditional Access policies. Identify workload identities with excessive or unused permissions. Apply least-privilege and time-bound access where possible.

Structural Actions:

  • Empower your SOC with explicit authority to isolate systems and revoke sessions during active incidents. If containment requires three levels of approval, you are Organization A.
  • Break down silos between IT operations, cloud administrators, and security. Run a tabletop exercise specifically for a cloud-originated compromise that requires token revocation across multiple SaaS platforms.
  • Establish and continuously maintain a behavioral baseline. Detection rules should be built on deviations from normal, not solely on known-bad signatures.
  • Schedule an annual red team or purple team assessment. The difference between A and B was not budget — it was preparation and process maturity.

The most uncomfortable takeaway from this advisory is that Organization A likely believed it was defended. It had tools, staff, and a SOC. The failure was invisible until someone tested it. If you have not tested your detection and response capability against a realistic adversary path in the last 12 months, you are operating on assumption, not assurance.