A Tale of Two SOCs: Insights From Two Red Team Assessments
TL;DR
Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments
Original Publication August 25, 2026
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments. Lessons Learned
Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders. Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response. Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise. Key Actions
Establish and continuously maintain a baseline and reduce alert noise by fine tuning. Break down silos and empower network defenders. Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions. Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise. In
What Happened
A Tale of Two SOCs: Insights From Two Red Team Assessments, reported by CISA.
Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments
Original Publication August 25, 2026
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments. Lessons Learned
Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders. Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response. Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise. Key Actions
Establish and continuously maintain a baseline and reduce alert noise by fine tuning. Break down silos and empower network defenders. Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions. Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise. In
For the full technical details, see the original report.
Why It Matters for Businesses
This development could affect organizations that rely on the impacted technologies or services. Unpatched systems, misconfigured infrastructure, or lack of monitoring can leave businesses exposed to exploitation, data breaches, and regulatory penalties.
How to Check Your Exposure
Run a free scan on NEL Professional's Cyber Risk Scanner to check whether your domain is affected. The scan covers SSL/TLS, security headers, DNS configuration, email authentication, and more across 16 modules.
Mitigation Steps
- Patch immediately, Apply vendor patches or updates as soon as they are available.
- Review configurations, Check firewall rules, access controls, and security headers.
- Monitor logs, Watch for indicators of compromise (IOCs) related to this threat.
- Update security policies, Ensure incident response plans cover this type of threat.
- Run a security scan, Use automated tools to verify your exposure.
Need Expert Help?
If your organization needs help assessing or remediating this issue, hire a verified cybersecurity specialist through NEL Professionals.
Get up to 100 scans or unlimited lifetime access starting at $15.
View Plans →Comments (0)
No comments yet. Be the first to comment!