Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations within the Government Services and Water/Wastewater sectors. In both cases, the red team achieved full domain compromise, accessing sensitive business systems (SBSs) and cloud resources. While Organization B demonstrated mature response by rapidly isolating initial footholds, Organization A failed to detect activity due to untuned detection tools and organizational silos that created 'noise' and bureaucratic delays.
The assessments revealed critical weaknesses in cloud environments, specifically concerning excessive Microsoft Entra ID application permissions and the lack of workload identity conditional access. Furthermore, misconfigurations in Active Directory Certificate Services (ADCS) and the default Machine Account Quota (MAQ) were primary drivers for privilege escalation. These findings underscore that technical detection tools are only effective when integrated into clear, empowered incident response workflows and properly tuned to reduce false positives.
Organizations must prioritize securing identity infrastructure, particularly hybrid cloud synchronization accounts and ADCS templates. The ability of the red team to move laterally into OT DMZ bastion hosts further highlights the persistent risk of IT-to-OT convergence if egress filtering and monitoring are not strictly enforced.