Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CISA publicly summarized two red-team engagements: in one (a government organization) testers gained initial access via phishing, escalated privileges, and moved laterally into sensitive systems and cloud resources without detection; in the other (a water-sector organization) defenders detected and quarantined compromised workstations quickly, limiting the simulated attack. CISA noted common deficiencies in both organizations — underestimated cloud risks, lack of Conditional Access for workload identities, and missing processes to revoke compromised access/refresh tokens — and highlighted alert fatigue and organizational silos as contributors to detection failures.