CISA Reveals the Need for Continuous Offensive Security Testing by Lucie Cardiet

This article highlights lessons from a CISA red team assessment showing over-reliance on EDR, weak network-layer protections, and missed detections of techniques like Kerberoasting, golden tickets, DCSync, lateral movement, and covert C2, and advocates continuous offensive security testing and adoption of NDR. It promotes Vectra AI’s capabilities—such as detecting hidden tunnels, monitoring anomalous Active Directory activity, and identifying privilege misuse—and introduces their Offensive Security Hub and tools (e.g., MAAD-AF and Halberd) to emulate attacks, expose gaps, and strengthen SOC detection and response.