A Tale of Two SOCs: CISA Ran the Same Red Team at Two Critical-Infrastructure Orgs — One Detected It, One Never Did
CISA's red team hit two critical-infrastructure orgs with similar tradecraft at the same time. Both ended up full-domain-compromised. The difference: one org's defenders saw the first hits in minutes, the other's thousands of false positives drowned them out.