- The Cybersecurity and Infrastructure Security Agency has released its findings on cybersecurity assessments of two critical infrastructure organizations
- The agency released its advisory to share lessons learned from the assessments
- CISA emphasized the importance of effective processes and communication in early cyber threat detection
The Cybersecurity and Infrastructure Security Agency on Monday issued new guidance drawn from two of its own red team engagements, offering organizations a roadmap for tightening detection and response capabilities across IT, cloud and operational technology networks.
“This advisory demonstrates CISA’s commitment to empowering critical infrastructure organizations with the tools and insights they need to outpace sophisticated cyber threats. By sharpening their detection, response, and threat hunting capabilities, organizations can better defend their networks against evolving attacks. CISA encourages organizations to review this advisory, assess their cybersecurity posture and act on our recommended measures to enhance their security and resilience,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera.
Explore counter-UAS coordination, AI-driven investigative intelligence, edge tech for border security, and cyber talent development with DHS leaders and industry experts on November 10. Register early for the 2026 Homeland Security Summit for keynotes panels, and networking that put you at the center of the agency’s fastest-growing priorities.
What Are CISA’s Findings in Its Red Team Assessments?
The advisory walks through how CISA’s red team operators — acting as simulated adversaries — tested the defenses of two critical infrastructure organizations that had requested the assessments.
The two assessments produced starkly different results. At the first organization, CISA’s team was able to breach several workstations, escalate its privileges across the domain and pivot to additional systems without ever being flagged by the security operations center. At the second organization, the SOC caught and isolated the initial intrusion attempt, pushing the red team to pivot to an assumed-breach approach — and even then, the SOC intercepted a portion of the follow-on activity.
What Are the Core Lessons Cited by the CISA From the Assessments?
CISA distilled three main lessons from the two engagements for network defenders, IT administrators and other technical personnel looking to gauge and improve their own security posture:
- Build strong monitoring baselines and refine alert filtering
- Break down internal silos and administrative friction that slow detection and response
- Apply the right security controls and operational practices tailored to cloud environments
The agency emphasized that strong cybersecurity outcomes hinge on more than the tools an organization deploys — effective processes, communication and organizational structure play just as large a role in whether a breach is caught early or missed entirely.
CISA worked directly with both assessed organizations in producing the advisory. Following each engagement, the agency delivered a detailed findings report to help the organization shore up its defenses and improve its readiness for a future incident.
