CISA’s red team has reached the cloud environments of two organizations despite sharply different security operations center performance, exposing a gap between endpoint detection maturity and cloud identity controls.
In an advisory published Aug. 25, 2026, CISA said neither organization had Conditional Access policies for workload identities, which extend access controls to applications and service principals. CISA said its red team has never observed an organization using the feature during its assessments.
The same weaknesses got the red team into both clouds despite the difference in detection. CISA said the team compromised Microsoft Entra ID environments at both organizations, with excessive application permissions and weak controls around non-human identities contributing to the access. In both environments, the red team achieved full domain compromise and reached sensitive business systems and cloud resources, with no defensive intervention at Organization A.
On the endpoint, the two responses diverged sharply. CISA said one organization quickly identified and contained three compromised workstations, isolating them in 10, two and 20 minutes respectively. The other received alerts tied to the red team’s activity but failed to act on them, with false positives and organizational silos obscuring the signals.
Both organizations also lacked mature procedures for detecting, remediating and revoking compromised access and refresh tokens. That left cloud access available even after defenders had removed or contained access elsewhere in the environment.
What Each SOC Did
CISA said the assessment at Organization B, a Water and Wastewater Systems Sector organization, switched to an assume-breach model after defenders contained the initial phishing compromise, with the organization’s own staff providing the red team a replacement foothold. The domain compromise that followed came from that restored access.
Those defenders also detected later activity on a bastion host in the operational technology demilitarized zone and blocked a suspicious Entra ID login through an automated alert.
But CISA said the red team still found excessive permissions and misconfigurations in Organization B’s Active Directory and service accounts. In the cloud, it reached the tenant through a Seamless SSO computer account that had no MFA, then used an application with broad permissions to gain the ability to retrieve the emails of every user in the tenant from the public internet.
Organization A, a Government Services and Facilities Sector organization, failed to detect or contain the activity. CISA said its SOC received medium- and low-severity endpoint alerts linked to the red team but did not action them, while multiple SOCs and disconnected system owners made escalation harder.
CISA said Organization A also used long-lived static AWS identity and access management credentials set never to expire, which the red team used to reach one of its sensitive business systems. The agency noted the techniques it used are not unique to any one identity provider or cloud environment.
Better Detection Did Not Close the Cloud Gap
“One SOC caught the intrusion early and contained it. The other had security controls in place too, but weak detection tuning and disconnected processes gave the red team much more room to move,” Nick Tausek, Lead Security Automation Architect at Swimlane, told Expert Insights.
“A team may detect suspicious activity quickly, but that advantage disappears if it takes too long to revoke access or contain a compromised identity,” Tausek added.
The advisory said the two organizations demonstrated a broader problem: cloud environments were often underestimated even where traditional detection and response controls were more mature.
CISA recommended implementing Conditional Access for workload identities, regularly reviewing application permissions, monitoring service-principal activity and establishing automated processes to revoke compromised tokens. It also recommended continuously testing security controls against the techniques described in the advisory.
The findings come from CISA’s own red team assessments, not a criminal intrusion, and the agency did not name a real-world actor.
