Would Your Organisation Detect a Cyber Attack?

02 Nov 2026

Why Realistic Cyber-attack Testing Shows whether an Organisation Can Detect and Respond under Pressure

When two organisations faced the same attack but achieved radically different outcomes, the lesson was clear: cybersecurity is not just about technology. It is about detection, response, and operational readiness.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently published a particularly valuable red team advisory, “A Tale of Two SOCs”. It describes two simultaneous assessments against critical infrastructure organisations, conducted using near-identical attack paths. Both resulted in full domain compromise, but only one organisation detected the intrusion. That contrast is the advisory’s central lesson: compromise matters, but the ability to detect and respond determines the outcome.

In simple terms, a red team is a group of authorised security specialists who simulate real-world attackers to test how well an organisation can prevent, detect and respond to an intrusion. A Security Operations Centre (SOC) monitors an organisation’s systems for cyber threats and coordinates the response when suspicious activity is detected.

A Common Point of Entry

Both intrusions began in the same way: the red team identified an internet-facing application configured with default credentials, used it to gain an initial foothold, and then sent phishing emails from a genuine internal address. This made the attack harder to detect because messages sent from within the organisation’s own domain can bypass common email authentication controls such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). They also avoid the “external sender” banners that many organisations rely on as a user-facing warning. To recipients, the email appeared to come from a colleague; to security tooling, it appeared to be valid authenticated internal mail. From this shared starting point, the two organisations’ outcomes differed significantly.

Organisation A: Warnings Were Missed

The red team gained access to multiple workstations before escalating privileges through a familiar Active Directory attack path. This was enabled by two factors: an unmodified default setting that allowed any domain user to register machine accounts, and a misconfigured certificate template that allowed the team to obtain a certificate authenticating as a Domain Administrator. Neither issue was a software vulnerability in the conventional sense. Instead, both reflected long-standing default configurations and administrative conveniences that are still common across many enterprise environments.

Once inside, the red team found cleartext credentials stored in configuration files, a static Amazon Web Services (AWS) access key with no expiry, and stolen refresh tokens. Together, these provided access to cloud infrastructure and to an over-permissioned Microsoft Entra ID application with tenant-wide mail access. In practice, this meant the team could read users’ inboxes without needing to compromise each mailbox individually.

None of this activity was detected. The issue was not an absence of monitoring tools, but an inability to separate meaningful signals from routine noise. Existing tooling generated such a high volume of false positives that genuine malicious activity was difficult to identify. Analysts also lacked shared visibility across the security tools in use and did not have the authority to isolate affected hosts independently. As a result, even when suspicious activity was flagged, it did not lead to timely or effective escalation.

Organisation B: Fast Detection Slowed the Attack

The SOC detected execution of the phishing payload and isolated the affected systems within minutes, preventing the red team from establishing command and control. This forced the red team to abandon its initial approach and continue the assessment on an assumed-breach basis. Later stages of the engagement were also detected: egress filtering blocked a command-and-control callback, and use of a compromised sync account to access the Azure portal triggered an automated alert, leading to the account being disabled within minutes.

Organisation B’s domain was ultimately compromised, but the path to that outcome was very different. At each stage, effective defences imposed a measurable cost on the red team, forcing them to lose time, abandon techniques and revise their approach. For real-world threat actors operating under practical constraints, this kind of defensive friction can be decisive: it may determine whether an intrusion is contained early or escalates into a significant incident.

Three Lessons for Security Leaders

1. Detection Noise is a Security Risk in Itself

Organisation A’s SOC received alerts linked to the red team’s activity, but those alerts were lost in routine operational noise and were not acted on. Investment in security information and event management (SIEM) and endpoint detection and response (EDR) platforms counts for little if analysts cannot distinguish genuine threats from background activity. Detection tools need continuous tuning, sensible baselines and alerting that helps teams focus on what matters most.

2. Clear Ownership Can Matter More than Technology

The red team found SOC teams operating in silos, with limited visibility of each other’s tools and, in some cases, no clear understanding of who owned an affected system. That slows response when speed matters most. In a live incident, containment often depends less on the sophistication of the platform generating the alert and more on clear ownership, escalation paths and authority to act.

3. Cloud Security Remains an Underestimated Risk

The red team abused application permissions and compromised Microsoft Entra ID applications to obtain access tokens and reach sensitive data. This exposed weaknesses in workload identity management and conditional access controls. As organisations continue moving critical business functions to the cloud, security teams need to test whether they can detect and respond to compromises beyond traditional on-premises environments.

Testing Security against Realistic Attack Scenarios

Regulators and critical infrastructure operators increasingly recognise that compliance is not the same as security. Financial services have been ahead of the curve, with frameworks such as CBEST and TIBER-EU built on a common principle: organisations need evidence that their defences can withstand realistic adversary behaviour, not simply assurance that controls exist on paper.

CISA’s findings reinforce this point. Both organisations experienced compromise, but the better-prepared organisation was able to detect suspicious activity quickly, investigate it effectively and contain parts of the intrusion before it could progress unchecked.

Questions Security Leaders Should Ask Now

CISA’s assessment leaves security leaders with several practical questions:

• Would our SOC detect and contain a phishing-led compromise within minutes, rather than hours?
• Are our detection tools producing actionable alerts, or simply adding to operational noise?
• Could we quickly identify system owners and decision-makers during a live incident?
• Have we tested our cloud identity and access controls against realistic attacker techniques?
• Does our incident response team have the authority and confidence to contain an active breach?
• Have we validated our processes through adversary simulation, or only through compliance exercises?

If the honest answer to any of these questions is “we’re not sure”, that uncertainty is exactly the kind of gap a red team exercise is designed to expose, ideally before a real adversary finds it first.

What this Means for Cyber Resilience

Neither organisation prevented the initial compromise. That point matters: a failure of prevention controls is not, by itself, a failure of security. It is precisely the scenario that detection and response capabilities are designed to address. The difference between the two outcomes was not explained by budget, staffing levels or the specific third parties in use. It depended on whether analysts could identify genuine threats within a manageable volume of alerts and had the authority to act quickly.

The fixes identified in the advisory are, for the most part, procedural rather than costly. They include closing default settings that allowed accounts to be created and certificates to be issued too freely, removing stored passwords and access keys from files across the network, reviewing applications with excessive permissions, and tuning alerts so that genuine threats are not obscured by routine noise.

That is why red teaming remains one of the most valuable investments organisations can make in understanding their real-world cyber resilience. This advisory illustrates a broader and more consequential question: once an intrusion is underway, will the organisation detect it quickly, understand its significance and respond effectively?

How Intertek Can Help

Intertek’s Red Teaming service helps organisations answer that question through realistic, intelligence-led attack simulations. Engagements assess people, including security awareness, service desk resilience and resistance to social engineering; processes, including escalation procedures, incident response workflows and crisis management readiness; and technology, including detection capability, monitoring effectiveness and control validation. Each engagement is mapped against recognised frameworks such as MITRE ATT&CK, giving clear visibility of strengths, gaps and practical improvement opportunities. The result is not simply another vulnerability report, but a practical understanding of how an organisation performs when facing a determined adversary. Learn more about Intertek Red Teaming

Intertek also supports businesses and government bodies in validating the security of emerging technologies through threat-led penetration testing and specialist consultancy. From assessing artificial intelligence (AI) implementations to securing Internet of Things (IoT) and operational technology (OT) environments in manufacturing and critical sectors, our experts help identify weaknesses before they can be exploited. This enables organisations to strengthen their security posture while continuing to innovate with confidence. Explore Intertek Cybersecurity services

Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a