Published Wednesday, August 26, 2026 at 04:39 AM PT
BLUF: CISA completed red team assessments at two U.S. critical infrastructure organizations and published findings identifying systemic gaps in threat detection, incident response procedures, and operational technology (OT) security posture. No active compromises were detected during assessments. Organizations should immediately review CISA’s published advisory (“A Tale of Two SOCs”) and critical infrastructure isolation guidance.
DETAILS:
CISA conducted red team assessments at two critical infrastructure operators and published advisory “A Tale of Two SOCs: Insights From Two Red Team Assessments” documenting findings.
Assessments identified failures in threat detection effectiveness, with detection tools rendered ineffective due to organizational silos and gaps in their deployment or configuration.
Incident response procedures were found severely hampered by organizational silos and bureaucratic processes that slow threat coordination and decision-making between security teams and operational units.
Operational Technology (OT) environments showed cyber hygiene deficiencies; CISA and USCG jointly conducted proactive threat hunts revealing hygiene gaps at assessed infrastructure organizations.
No evidence of active compromise or ongoing exploitation was identified during assessments—findings are architectural and procedural, not post-breach forensics.
IMPACT:
Who: U.S. critical infrastructure operators (energy, water, manufacturing, transportation sectors likely in scope based on CISA’s mandate; specific organizations remain unpublished).
What: Systemic weaknesses in the ability to detect, respond to, and defend against cyber threats in operational environments. These gaps directly degrade mean-time-to-detection (MTTD) and mean-time-to-response (MTTR) in active incident scenarios.
Scope: The findings are industry-wide patterns, not isolated failures. CISA published this as advisory guidance precisely because the gaps are endemic across multiple operators.
RECOMMENDED ACTIONS:
Immediate: Security leadership should obtain CISA’s “A Tale of Two SOCs” advisory and map findings against your organization’s detection tooling, incident response chain of command, and OT network architecture.
Short-term (30 days): Conduct cross-functional tabletop exercises between IT security, OT teams, and incident response to identify and remove decision-making bottlenecks in your response procedures.
Medium-term: Review CISA’s published “Critical Infrastructure Isolation Blueprint” and assess segmentation between IT and OT networks; implement isolation controls where feasible.
Ongoing: Engage CISA’s voluntary critical infrastructure assessment programs if your organization qualifies; red team findings are confidential and unclassified.
SOURCES:
- CISA Advisory: “A Tale of Two SOCs: Insights From Two Red Team Assessments”
- CISA/USCG: “Proactive Threat Hunt Identifies Critical Cyber Hygiene Gaps at US Critical Infrastructure Organization”
- CISA Guidance: “Critical Infrastructure Isolation Blueprint”
Recent high-severity events at publish time:
