CISA red-team tests found two critical-infrastructure SOCs reached full domain compromise, but their detection and response differed sharply.
WASHINGTON, UNITED STATES — Two simultaneous CISA red-team assessments reached full domain compromise, but sharply different SOC responses exposed gaps in detection and cloud security.
The U.S. Cybersecurity and Infrastructure Security Agency said its red team used similar tradecraft against two critical-infrastructure organizations: one in the Government Services and Facilities Sector and another in the Water and Wastewater Systems Sector. In both environments, the team ultimately obtained full domain compromise and reached sensitive business systems and cloud resources.
The exercises were authorized security assessments, not reports of real hostile breaches. CISA anonymized the organizations and released its findings on August 25 to help critical-infrastructure operators compare detection and incident-response practices.
Organization A did not detect or contain the red-team activity as it moved from initial access into privileged Active Directory access, sensitive systems and cloud resources. Organization B, by contrast, detected the initial compromise and quarantined affected systems, forcing CISA to switch to an “assume breach” model in which trusted agents supplied access equivalent to a successful foothold so the assessment could continue.
That distinction matters when interpreting the finding that both exercises eventually reached full domain compromise. In Organization B, part of the later attack path was enabled artificially after defenders disrupted CISA's original intrusion path; the outcome therefore should not be read as evidence that its security operations center failed in the same manner as Organization A.
A 100-fold configuration gap did not predict the better response
CISA's technical findings provide an unusually direct comparison. Organization A had a Machine Account Quota, or MAQ, of 10 on a compromised workstation. Organization B allowed domain users to create as many as 1,000 machine accounts.
The second figure is 100 times the first. Yet Organization B was the environment that detected the initial access and isolated affected systems. The comparison does not establish that a high MAQ is harmless — CISA treated the configurations as weaknesses — but it shows that this one risky Active Directory setting did not determine which organization mounted the stronger initial defensive response.
Microsoft defines ms-DS-MachineAccountQuota as the number of computer accounts a user is allowed to create in an Active Directory domain. More significantly, current Microsoft Defender for Identity testing guidance deliberately uses an MAQ value of 10 to create a noncompliant domain configuration and zero to return that test configuration to compliance.
CISA also described misconfigured Active Directory Certificate Services templates, excessive service-account permissions and exposed credentials among weaknesses encountered during the exercises. The red team used phishing during initial access; MITRE ATT&CK classifies phishing as technique T1566.
Why Organization B reacted differently
CISA's principal lessons focused less on acquiring additional security products than on making defensive systems operationally useful. The agency said untuned detection tools can bury meaningful signals among false positives and routine alerts. It also identified organizational silos, unclear responsibilities and limited defender authority as barriers to effective incident response.
Organization B's defenders detected the initial compromise and quarantined affected systems. Later in the assessment, after the assume-breach phase began, defenders again detected activity involving a bastion host in the operational-technology demilitarized zone and isolated that system.
Organization A's weaknesses produced a different outcome. CISA reported that its team moved laterally and reached sensitive business systems and cloud resources without effective defensive intervention. The comparison suggests that alert volume and fragmented processes can reduce the usefulness of security tooling when analysts cannot confidently distinguish ordinary activity from malicious behavior or lack the authority to respond quickly.
Cloud identity emerged as another area of concern. CISA recommended Conditional Access policies for workload identities, monitoring excessive or unused permissions, and maintaining procedures for detecting, remediating and revoking access and refresh tokens after cloud compromise.
Microsoft's documentation independently supports the technical basis for that recommendation. It says workload identities differ from conventional user accounts because they cannot perform multifactor authentication, often lack formal lifecycle processes and require credentials or secrets to be stored somewhere — characteristics Microsoft says make them harder to manage and place them at higher risk of compromise.
What CRN Times verified
CRN Times checked CISA's August 25 advisory and accompanying agency announcement against Microsoft and MITRE technical documentation.
The comparison produces one independent quantitative finding: Organization B's stated Machine Account Quota of 1,000 was 100 times Organization A's value of 10. Despite the larger configuration exposure, Organization B detected and isolated initial compromise activity while Organization A did not. This does not establish causation or rank the organizations' overall security maturity because CISA anonymized the environments and did not publish enough information to control for staffing, architecture, tooling and other differences.
CRN Times also confirmed that Microsoft's current Defender for Identity documentation treats an MAQ of 10 as a deliberately noncompliant state in a testing example and uses zero when returning the domain to compliance. Microsoft separately documents Conditional Access controls for workload identities, matching one of CISA's cloud-security recommendations.
For critical-infrastructure operators, the practical lesson is narrower than declaring one SOC “good” and another “bad.” CISA's two assessments show that similar attacker techniques can produce different operational responses depending on whether alerts are tuned, defenders can isolate systems promptly, teams share context across organizational boundaries and cloud identities are governed alongside human accounts.
CISA did not identify the assessed organizations or provide the exercise dates in the material reviewed. Its published mitigation guidance instead gives operators concrete next steps: establish behavioral baselines, reduce alert noise, empower defenders, tighten Active Directory permissions and create explicit procedures for cloud-token compromise.
COMMENTS