CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA published results of two red team assessments against two critical infrastructure organizations, using similar tradecraft but recording sharply different defensive outcomes. Both organizations were fully compromised at the domain level, and in one case, the organization detected nothing. The assessments highlight varying security preparedness.