A Tale of Two SOCs: Insights From Two Red Team Assessments

On August 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) released Cybersecurity Advisory AA26-237A detailing findings from two simultaneous red team assessments conducted at separate organizations.

Full domain compromise in both environments

The red team achieved full domain compromise in both cases, gaining access to sensitive business systems and cloud resources. The advisory does not state whether the techniques have been exploited in the wild outside these controlled assessments. Organization A failed to detect or contain the red team activity. Organization B successfully detected initial compromise attempts, isolated affected systems, and compelled the red team to operate under an assume-breach posture.

Lessons from contrasting defensive outcomes

The advisory contrasts the detection and response capabilities of the two organizations rather than naming specific vulnerable products or versions. It examines the red team’s tactics, techniques, and procedures alongside the defensive actions taken by each SOC. No specific software vendors, product versions, or sectors are singled out as uniquely affected. The findings apply to any organization operating a Security Operations Center responsible for detecting and responding to advanced intrusion activity.

What to do

• Review the full set of red team techniques and defensive observations in AA26-237A
• Assess whether your SOC’s current detection and response capabilities align with Organization B’s successful controls
• Implement or strengthen the mitigations and detection methods highlighted in the advisory for initial access and post-compromise activity
• Conduct internal red team or purple team exercises that test both detection and containment under realistic conditions
• Ensure your incident response playbooks include rapid isolation procedures for compromised systems and assume-breach scenarios

Organizations should treat the advisory as a benchmark for measuring detection engineering and response effectiveness against sophisticated adversaries.