CISA advisory spotlights red-team findings to help organizations assess risk, detect threats and strengthen incident response

The Cybersecurity and Infrastructure Security Agency has issued an advisory drawing lessons from two recent red team assessments at critical infrastructure organizations, offering guidance to bolster detection, response, and protections across information technology, cloud, and operational technology environments.

The advisory, A Tale of Two SOCs: Insights From Two Red Team Assessments (AA26-237A), contrasts how each organization’s security operations center handled simulated intrusions. In one case, CISA’s red team gained initial access to multiple workstations, escalated privileges to domain level, and moved laterally across systems without being detected. In the other, the SOC detected and quarantined the team’s initial access, forcing a pivot to an assumed-breach approach; some subsequent activity was also spotted and contained.

CISA said the lessons underscore that outcomes hinge on more than tooling alone. The agency urges organizations to establish baselines, improve monitoring, and break down silos and bureaucratic barriers that can slow or obscure effective detection and response.

“This advisory demonstrates CISA’s commitment to empowering critical infrastructure organizations with the tools and insights they need to outpace sophisticated cyber threats. By sharpening their detection, response, and threat hunting capabilities, organizations can better defend their networks against evolving attacks. CISA encourages organizations to review this advisory, assess their cybersecurity posture and act on our recommended measures to enhance their security and resilience,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “CISA’s Red Team is among the best in the world and is laser focused on helping our federal and critical infrastructure partners identify and mitigate their most significant vulnerabilities and weaknesses.”

The document was developed in coordination with the assessed organizations. At the end of each engagement, CISA provided tailored reports of findings and recommendations aimed at strengthening cybersecurity posture and incident resilience.

CISA routinely conducts red team exercises at the request of federal and critical infrastructure partners to emulate real-world adversary tradecraft and evaluate defenders’ ability to detect, investigate, and respond. The new advisory is available on the agency’s website.