Security research almost never gives you a controlled comparison. Every incident report describes one organization, one adversary, one outcome, and the counterfactual is unavailable. You can never quite say what would have happened if the defense had been different, because there is no second organization running the same experiment.

CISA advisory AA26-237A, released August 25, 2026 under the title “A Tale of Two SOCs: Insights From Two Red Team Assessments,” is as close as this field gets. CISA ran two red team assessments simultaneously, using similar tradecraft, against two critical infrastructure organizations — and recorded sharply different results.

Organization A was in the Government Services and Facilities Sector. The red team phished in, established access on multiple workstations, escalated to elevated privileges over the domain, and moved laterally into sensitive business systems and cloud resources. It was not detected.

Organization B was a Water and Wastewater Systems Sector entity — a category not known for large security budgets. The SOC detected and quarantined the red team’s initial access. That forced the assessment into an assumed-breach model, and some of the follow-on activity was detected and quarantined as well.

Two organizations, comparable attack surface, the same operators using the same techniques, opposite results. This is the rare piece of public research where the variable that mattered is actually isolated.

The Tradecraft Was Not Exotic

It is worth being specific about what the red team did, because the mundanity is the finding.

Initial access was phishing. Both engagements. Not a zero-day, not a supply chain compromise, not an exploit against an edge appliance. An email.

Escalation abused Active Directory defaults and misconfigurations. Two named in the advisory:

The default Machine Account Quota — a setting that permits any authenticated domain user to join up to ten computers to the domain. It ships enabled at ten, it exists for reasons that made sense in 2000, and it enables well-documented attack paths including resource-based constrained delegation abuse. Setting it to zero takes about a minute and breaks essentially nothing in an environment where computer objects are provisioned by IT rather than by users.

Misconfigured Active Directory Certificate Services templates. ADCS misconfigurations have been a reliable domain escalation path since the ESC1-ESC8 research was published in 2021. Half a decade later they remain widespread, because ADCS is typically owned by a Windows infrastructure team, is rarely reviewed by security, and produces no symptoms when misconfigured — right up until it produces total compromise.

Neither of these is unknown. Both are documented in every Active Directory hardening guide. The red team did not need to invent anything; it needed only to check whether the defaults had been changed.

What Separated the Two Organizations

The advisory’s framing is that organizations with similar attack surface can have vastly different defensive capability. The differentiator was not attack surface reduction — both were phishable, both had exploitable AD. The differentiator was detection and response.

Organization B caught the initial access. That is endpoint detection that was deployed, tuned, monitored, and — critically — acted upon. The quarantine is the tell. Detection that generates an alert nobody triages is indistinguishable from no detection. Organization B had a SOC with the authority and the practice to isolate a host quickly, without a three-hour approval chain.

Then, under assumed-breach conditions with the red team already inside, Organization B caught follow-on activity too. That indicates detection depth beyond the initial vector — coverage of lateral movement and credential abuse, not just the front door.

Organization A had none of that visible, through domain compromise and into cloud resources.

The lesson that survives generalization: prevention is a coin flip and detection is a capability. Both organizations were breached at the perimeter. Only one had the second layer that turns a breach into an incident instead of a compromise.

It is also worth noting which organization did better. The water utility — a sector chronically cited for underfunding, small teams, and legacy environments — outperformed a government services organization. Whatever produced that outcome, it was not budget. It was the decision to invest what budget existed in detection and response rather than in additional preventive tooling.

What This Means for Security Leaders

Set the Machine Account Quota to zero today. It is one attribute. It costs nothing. It closes a well-trodden escalation path. If your organization has not done it, that fact is itself the finding — it means AD hardening guidance is arriving somewhere and stopping.

Audit your ADCS templates, and treat it as a security review rather than an infrastructure task. Enrollment permissions, subject alternative name supply, enrollment agent rights, manager approval requirements. Tooling for this is free and mature. The obstacle is organizational: certificate services usually sit outside the security team’s remit, and nobody has asked.

Measure your SOC on mean time to detect and contain, not on alert volume or coverage percentages. Organization B’s advantage was expressed in minutes, not in a control matrix. If you cannot state your median time from initial endpoint compromise to host isolation, you cannot know which of these two organizations you are.

Give your SOC pre-authorized containment authority. The quarantine is what stopped the engagement. If your analysts must escalate to a manager, who escalates to a system owner, who convenes a call, before a host can be isolated, your detection capability is decoupled from your response capability and the detection does not matter. Define the conditions under which an analyst isolates first and explains after, and put a named executive’s signature on it.

Run assumed-breach exercises, not just perimeter tests. The most valuable half of this comparison came after the red team was already inside. A penetration test that ends at initial access tells you about prevention. An assumed-breach exercise tells you about the thing that actually determines outcomes. This is the same argument for realistic, live-fire evaluation that we have made about the 2026 cyber exercise cycle.

If you are a small team in a resource-constrained sector, take the encouraging reading seriously. The water utility won this comparison. Detection and response maturity is achievable without a large budget, because it is primarily about process, tuning, and authority rather than about tooling spend. That is genuinely good news and it is rare to have public evidence for it.

The Careers Angle

Detection engineering is the differentiating role, and this advisory is the proof. Not more tools — better detections, tuned to the environment, tested against real tradecraft. Practitioners who can convert an attack technique into reliable, low-false-positive detection logic are the reason Organization B is a case study in the good column. This skill is measurable, demonstrable in a portfolio, and in demand at every organization that has finished buying tools and started asking whether they work.

Active Directory security expertise remains a stable, valuable niche. AD has been “on its way out” for a decade and continues to underpin authentication at the overwhelming majority of large enterprises. Deep knowledge of AD attack paths, ADCS, delegation, and Kerberos abuse is directly applicable at nearly every employer, transfers cleanly between them, and is unusually resistant to automation because the exploitation depends on environment-specific configuration.

Purple teaming is the highest-leverage way to spend an offensive skill set. The gap between the two organizations is exactly what purple team work closes: running real techniques against your own environment and building detection for what you find. It is more valuable to most employers than pure red teaming and it is a role that barely existed as a title five years ago. For anyone in offensive security wondering where the demand is heading, it is here.

Small-team security leadership is a legitimate and underrated career track. Running security for a water utility, a hospital system, or a school district means making resourcing decisions with real consequences and no cover. It builds prioritization judgment faster than a large program where budget masks poor choices. Practitioners who cut their teeth in constrained environments are frequently better leaders later, and the work is more visibly consequential — a point we have made about the path from SOC analyst to CISO more than once.

The Bottom Line

CISA published this advisory as a case study and the framing is correct, but the most useful thing about it is the experimental design. Two organizations, one attack, two outcomes, and the difference was not budget, sector prestige, or attack surface. It was whether somebody was watching and whether they were allowed to act.

Every organization reading this is one of these two. The uncomfortable part is that Organization A did not know which one it was either — that is what “undetected” means. The only way to find out is to have someone run the experiment on you.

Sources: CISA Cybersecurity Advisory AA26-237A — “A Tale of Two SOCs: Insights From Two Red Team Assessments” (August 25, 2026); CISA — “CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response”; The Hacker News — “CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing”; HSToday — “CISA Details Red Team Findings to Help Critical Infrastructure Organizations Improve Resilience”; Cyberpress — “CISA Red Team Compromises Active Directory and Critical Business Systems.”

This article is provided for informational purposes only and reflects the advisory as published on August 25, 2026. Organizations should consult the full CISA advisory for complete technical findings, detection guidance, and recommended mitigations.