CISA ran two red team assessments at the same time, using similar tradecraft against two different organisations, and published the comparison on 25 August 2026 as advisory AA26-237A — titled, aptly, A Tale of Two SOCs.

The organisations are not named. One is in the Government Services and Facilities sector. The other is a Water and Wastewater Systems operator.

Start with what was the same

Both were fully compromised at the domain level. In both, the red team reached sensitive business systems and cloud resources.

That matters, because the comfortable reading of this advisory is that one organisation was good and the other was bad. Neither kept the red team out. The difference is what happened after they got in, which is a different and more useful question.

How the first one fell

The entry point was a web application still using default credentials for its built-in accounts.

From there the team sent phishing emails from internal addresses — mail that passes every sender check because it genuinely is internal — and landed on four workstations.

The escalation reads like a checklist of things everybody knows about:

  • Machine Account Quota left at its default
  • Active Directory Certificate Services templates misconfigured for unrestricted certificate requests, the ESC1 pattern
  • Cleartext credentials for service and database accounts sitting in configuration files on reachable systems
  • Static AWS access keys set to never expire
  • Over-permissioned Entra ID applications

Not one of those is a vulnerability. There is no CVE here, nothing to patch, and no vendor at fault. It is configuration, all of it, and all of it long-documented.

The detail worth sitting with

Using a stolen Primary Refresh Token and those over-permissioned Entra applications, the red team read the security team's email — to monitor whether the defenders had noticed them.

Think about what that means operationally. The attacker was not merely undetected. The attacker had visibility into the detection process itself, and would have seen an investigation begin before the investigators reached anything.

We have written a great deal this month about attackers removing a defender's ability to see — an implant that unlinks EDR callbacks, malware that sets its own Defender exclusions. This is the same objective reached by reading the mail.

Why it saw nothing

Not for want of tooling. The organisation ran multiple SOCs and multiple endpoint products.

They had no shared visibility between them. Analysts had no escalation procedures and limited authority to act. And the environment produced thousands of false-positive alerts, which is the condition under which a real one becomes invisible.

One genuine alert did fire, tied to activity on an SCCM server. It was dismissed as a false positive.

That is not a failure of detection. Detection worked. The alert existed, a human saw it, and the surrounding process ensured the correct answer was discarded.

What the second one did

The water utility's SOC identified the initial phishing payloads as each one executed, and isolated the affected workstations within 2 to 20 minutes — severing command and control before the red team could spread.

Same tradecraft. Different outcome. And CISA is explicit about where the difference lay: it attributes the gap to the people, processes and procedures supporting the tools rather than to the tools themselves.

Their sentence is the one to take away: detection tools are only as effective as the people, processes, and procedures supporting them.

A water utility is not, as a rule, better funded than a government services body. It is the smaller of the two categories that usually gets described as under-resourced. It responded in minutes.

What to do

  • Count your SOCs, then check whether they can see each other's data. Two consoles with no shared view is worse than one, because each assumes the other is watching.
  • Measure your false-positive rate as a security control, not a nuisance. At thousands of alerts, dismissal becomes the default, and the SCCM alert here is what that costs.
  • Give analysts the authority to isolate a host without permission. Two to 20 minutes is only possible if nobody has to ask.
  • Audit the boring configuration: Machine Account Quota, AD CS templates, credentials in config files, non-expiring cloud keys, Entra application permissions. That is the entire attack path in the first organisation.
  • Treat mailbox-read permissions on applications as crown jewels. An attacker in the security team's inbox is watching your response.

What is not established

  • Who either organisation is. Both anonymised.
  • How long the first was compromised before CISA's engagement.
  • Any figures on scope or damage.
  • Which tools either ran. CISA names none, deliberately — the finding is that the tools were not the variable.