The Cybersecurity and Infrastructure Security Agency (CISA) has released a sobering report detailing the results of recent "red team" exercises conducted against two critical infrastructure organizations. By simulating the sophisticated tradecraft of modern state-sponsored and criminal threat actors, CISA’s cybersecurity experts exposed fundamental gaps in detection, response, and containment protocols.
The findings, which underscore the persistent fragility of essential services, serve as a vital wake-up call for the private sector and government entities alike. As the digital and physical worlds become increasingly intertwined, the ability of a Security Operations Center (SOC) to identify an adversary before they move laterally through a network is no longer a luxury—it is a matter of national security.
Main Facts: The Nature of the Engagement
At the core of these assessments was a mandate to move beyond theoretical risk assessments. CISA’s red teams did not merely review policy documents; they actively sought to compromise systems, escalate privileges, and exfiltrate data, mimicking the behavior of advanced persistent threats (APTs).
The goal was to evaluate the "detection-to-response" cycle. In cybersecurity, the "time to detect" (TTD) and "time to remediate" (TTR) are the two most critical metrics. If a red team can operate within a network for weeks without triggering an alert, the organization has effectively lost the "high ground" of its own infrastructure.
These exercises focused specifically on two organizations operating within the critical infrastructure sector—a broad designation that includes energy, water, communications, and healthcare systems. The results provide a comparative look at two distinct levels of organizational maturity: one that struggled to see the intruder entirely, and another that demonstrated the efficacy of a proactive, responsive security posture.
Chronology: The Anatomy of the Attacks
The methodology employed by CISA followed a standard kill chain, modified to test specific organizational blind spots.
The First Assessment: The Ghost in the Machine
In the first engagement, the red team targeted the organization’s initial access vectors—typically phishing or exploited software vulnerabilities. Once inside, the team moved with surgical precision.
- Initial Access: The red team successfully established a foothold on several end-user workstations.
- Privilege Escalation: By exploiting misconfigured local permissions and harvesting cached credentials, the team elevated their access to domain administrator levels.
- Lateral Movement: Once they possessed administrative control, they navigated throughout the domain, accessing sensitive servers and database environments.
Throughout this entire lifecycle, the organization’s Security Operations Center (SOC) remained entirely oblivious. There were no sirens, no blocked connections, and no suspicious activity reports. The red team effectively "lived off the land," using legitimate administrative tools in a way that blended seamlessly with standard network traffic.
The Second Assessment: The Defensive Wall
The second engagement followed a different trajectory, illustrating the importance of robust detection engineering.
- Detection and Quarantine: Upon gaining initial access, the red team triggered a high-fidelity alert. The SOC recognized the anomaly immediately and successfully quarantined the infected workstations.
- The "Assumed Breach" Pivot: Undeterred, the red team shifted their strategy. They adopted an "assumed breach" model, simulating an actor who already has a foothold and is looking to expand.
- Iterative Containment: Even as the red team adjusted their tactics to evade detection, the SOC proved resilient. While some subsequent activities by the red team were sophisticated enough to bypass initial automated filters, the human-in-the-loop analysis at the SOC eventually identified the secondary patterns, leading to further containment.
Supporting Data: Why Detection Fails
The discrepancy between these two organizations points to a systemic issue within the broader industry: the "visibility gap."
Data suggests that organizations often fail to detect breaches for an average of over 200 days. CISA’s findings align with industry benchmarks regarding the primary failure points:
- Log Ingestion: In many cases, organizations collect massive amounts of log data but lack the correlation rules to turn that data into actionable intelligence.
- Alert Fatigue: SOC analysts are often bombarded with thousands of low-level alerts, causing them to overlook the "low and slow" signals that characterize sophisticated intrusions.
- Credential Hygiene: The ease with which the red team escalated privileges in the first organization suggests that many organizations still lack robust Multi-Factor Authentication (MFA) or Least Privilege Access (LPA) models.
Official Responses and Strategic Guidance
CISA’s report does not merely highlight failure; it provides a roadmap for remediation. The agency emphasizes that security is a process, not a product.
The CISA Perspective
CISA officials have stressed that the "assumed breach" mindset is the only way to operate in the modern threat landscape. "Organizations must stop assuming their perimeter is impenetrable," a senior CISA official noted. "The focus must shift from ‘keeping them out’ to ‘how fast can we find them once they are in.’"
The Role of Human Analysts
Despite the rise of AI and automated security orchestration (SOAR), CISA underscores that the human element remains irreplaceable. AI can flag an anomaly, but a skilled human analyst is required to determine whether that anomaly is a malfunctioning printer or a sophisticated state-sponsored actor attempting to pivot into a production environment.
Implications: The High Cost of Inaction
The implications of these red team exercises for the broader critical infrastructure community are profound. When an entity like a utility provider or a healthcare facility is compromised, the impact is not confined to the digital realm.
Operational Resilience
If an adversary gains domain-wide control, they can potentially manipulate physical controls—such as valve pressures in a water treatment plant or patient records in a hospital. The lack of detection demonstrated in the first assessment implies that such an actor could have remained in the system long enough to cause physical damage or disrupt essential services.
Compliance and Liability
With the regulatory landscape shifting, organizations that fail to perform regular red teaming may find themselves in violation of emerging cybersecurity standards. Insurance providers are increasingly requiring evidence of "red team" exercises as a prerequisite for cyber-liability coverage.
The Path Forward
To bridge the gap, CISA recommends three key pillars for organizational security:
- Continuous Adversarial Testing: Periodic penetration tests are insufficient. Organizations must implement "purple teaming," where red and blue teams work together to refine detection logic based on real-time testing.
- Zero Trust Architecture (ZTA): By enforcing strict identity verification for every person and device attempting to access resources, organizations can contain attackers even if they gain initial access.
- SOC Maturity Modeling: Organizations must regularly audit their SOC performance. If the SOC cannot detect a simulated attack, they are not ready for a real one.
Conclusion: A Call for Vigilance
The CISA report is a stark reminder that the digital battlefield is constantly evolving. The red team exercises conducted against these two critical infrastructure organizations demonstrate that while some entities are building effective defenses, others remain dangerously exposed.
The divide between the two organizations highlighted in the report is not necessarily one of budget, but of culture. The second organization’s success was rooted in a willingness to be tested, a commitment to human-led analysis, and the agility to adapt when initial defenses were bypassed.
As we look toward the future of infrastructure security, the lesson is clear: The goal is not to be invulnerable, but to be resilient. Through rigorous testing, constant vigilance, and a culture that prioritizes detection, organizations can transform from easy targets into formidable opponents against the rising tide of cyber threats. The era of the "unhackable" perimeter is over; the era of the "detect-and-respond" mandate has begun.
