CISA reported contrasting defensive responses during concurrent red team assessments of two organizations, although both environments experienced complete domain compromise and access to sensitive business systems and cloud resources. Organization A neither detected nor contained the activity, while Organization B quickly detected initial intrusion attempts and isolated affected systems, requiring the assessment to proceed under an assumed-breach model.
OriginalquelleJournal · Cybersecurity and Infrastructure Security Agency
A Tale of Two SOCs: Insights From Two Red Team Assessments
<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>A Tale of Two SOCs: Insights From Two Red Team Assessments</td> </tr> <tr> <th>Original Publication </th> <td><strong>August 25, 2026</strong></td> </tr> <tr> <th>Executive Summary</th> <td> <p>The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model.</p> <p>This advisory details the red team’s activity and organizations’ defensive actions, offering lessons