What happened
On August 25, 2026, CISA published AA26-237A after conducting simultaneous authorised red-team assessments at a government-services organisation and a water and wastewater organisation. Operators achieved full domain compromise and accessed sensitive business systems and cloud resources in both environments. Organisation A did not detect or contain the activity, while Organisation B rapidly detected the initial payloads, isolated affected hosts and forced CISA to continue under an assume-breach model provided by trusted assessment staff.
Organization A’s default Machine Account Quota was 10, allowing an unprivileged user to add up to 10 computer accounts to the domain. CISA also found Active Directory Certificate Services templates with the ESC1 misconfiguration, cleartext credentials, long-lived AWS IAM credentials and excessive Entra application permissions. The red team found connections.json and product-preferences.xml files for a SQL Developer tool and decrypted them to recover a cleartext database password. Alert noise and disconnected SOC teams prevented effective escalation.
Organization B isolated three compromised workstations within 10, 2 and 20 minutes, terminating the red team’s command-and-control sessions. Nevertheless, Organization B’s service account held AllExtendedRights over a domain controller, enabling a DCSync path to domain credentials. The team later reached an OT-DMZ bastion host using FTP credentials over SSH, although outbound controls blocked the callback and defenders quarantined the host. Attribution posture: CISA describes an authorised red-team exercise and names no malicious actor because the activity was simulated. No victim names, IP addresses, hashes or red-team payload filenames were published.
Why this matters now
The contrast is not a product comparison. Similar red-team activity produced different early outcomes because one organisation had useful baselines, manageable alert volume and responders empowered to isolate systems. The other allowed medium- and low-severity signals to disappear beneath false positives, fragmented SOC visibility and uncertainty over who could authorise containment.
Endpoint containment did not eliminate downstream identity risk. CISA’s operators still found excessive Active Directory rights, certificate-template weaknesses, cleartext credentials, long-lived AWS credentials and Entra application permissions that enabled access to sensitive systems or tenant-wide email. A mature endpoint response therefore needs a cloud-token and workload-identity playbook behind it.
The water-sector assessment also shows that segmentation can limit consequence without proving the access path is acceptable. The bastion host blocked outbound command-and-control traffic and was quarantined, yet the red team reached it using credentials stored for a different protocol. Security leadership must test credential boundaries, not merely network reachability.
The decision for security leaders
Make response authority measurable. Define which alerts permit immediate isolation, which team owns cross-SOC coordination and how responders identify a system owner without delaying containment. Validate the operating model with an adversary simulation that includes medium-severity alerts, cloud pivots and a business-critical system.
Treat endpoint, Active Directory, cloud applications and OT access as one identity chain. Require a combined review of Machine Account Quota, ADCS ESC1 exposure, DCSync-capable rights, workload-identity Conditional Access, tenant-wide Graph permissions, static cloud credentials and credentials stored on bastion hosts.
Require proof that token revocation works during an incident. Disabling an account or reimaging a workstation is insufficient if application secrets, access tokens, refresh tokens or Kerberos-derived access remain usable from another host.
Evidence of closure
- A signed audit records approved Machine Account Quota and ADCS template configurations.
- A permissions report shows no unjustified workload identity can access all tenant mail.
- A completed exercise proves access and refresh tokens can be revoked within the approved objective.
- A response test proves authorised staff can isolate a high-risk host within the approved service level.Jump-host validation confirms protocol-specific credentials and outbound-deny controls.
The Security.io assessment
Organisation B demonstrated that tuned detection, baselining, egress restrictions and rapid host isolation materially reduce attacker freedom. It did not demonstrate immunity from compromise: CISA’s assume-breach continuation still exposed domain, cloud and OT-access weaknesses. The useful benchmark is therefore reduced dwell time and constrained consequence, not a claim that one SOC prevented every stage.
Organisation A’s failure was organisational as well as technical. Multiple SOCs, multiple endpoint tools, limited visibility and unclear authority converted generated alerts into unowned information. The control lesson is to measure decision latency, false-positive burden and cross-team authority alongside tool coverage. No victim names, IP addresses, hashes or red-team payload filenames were published.
Questions for the morning meeting
- Can SOC staff isolate a host without waiting to identify its business owner?
- Which workload identities can read or send mail across the tenant?
- Has the organisation tested revocation of compromised access and refresh tokens?
- Are OT bastion hosts treated as Tier 0 assets with outbound-deny controls?