CISAs cybersecurity advisory from late August 2026 reads like a case study you would use in a training course: “A Tale of Two SOCs”. Two critical infrastructure organizations, the same attack techniques, completely different outcomes. One organizations red team assessment ended with full domain compromise, cloud access and the attackers reading the security teams email. The other detected the intrusion in minutes and shut it down.
The difference was not the technology. It was people and process.
Organization A: wide open
Initial access was almost embarrassingly simple: a web application with default credentials on built-in accounts. Not a zero day, not a supply chain attack, just an admin password that nobody changed.. From there the red team sent phishing emails from an internal address and compromised four workstations.
Then things escalated quickly. The Machine Account Quota was set to the default value of 10, meaning any domain user could create new machine accounts. On top of that, a misconfigured Active Directory Certificate Services template (ESC1) allowed requesting certificates for any user account. Lateral movement went through SCCM servers that exposed user-device relationships.
What the team found along the way: cleartext passwords on admin workstations, decrypted database configuration files and static AWS IAM keys set to never expire. In the cloud they stole a Primary Refresh Token and abused Entra ID applications with excessive permissions like Mail.ReadWrite, Chat.Read.All and Files.Read.All. The red team added a new client secret to one of these applications to maintain access and then proceeded to read the security teams email to check whether anyone noticed their activity.
Nobody did.
The SOC was drowning in thousands of false positive alerts that buried the real ones. Multiple SOC teams operated in parallel with no communication between them. There were no standard procedures for escalation, responsibilities were unclear and the defenders lacked the authority to act on their own. This is what happens when you buy tools but do not invest in the people running them.
Organization B: detected in minutes
Same approach, three employees clicked, three workstations compromised. But here the SOC detected the phishing payloads as each one executed and isolated the affected machines within 2 to 20 minutes, cutting command and control communications before any data could leave the network. The red team had to switch to an assumed breach scenario (basically starting over with direct privileged access).
Even so, they found serious weaknesses. The MAQ was set to 1000 (worse than Org A). A service account had AllExtendedRights over a domain controller, enabling a DCSync attack. In the cloud MSOL credentials were exposed, a disabled account could be re-enabled, and Seamless SSO was exploited through the AZURESSO computer account.
On the OT side the team reached a bastion host in the operational technology DMZ using FTP credentials. But the host blocked all outbound internet traffic; no C2 channel could be established. The OT systems stayed safe. Not because of some AI powered detection tool, but because someone configured a firewall rule properly.
What Swiss companies should take from this
The report makes one thing clear: security is not about tools. Organization A had monitoring, had a SOC, had alerting. None of it mattered because the processes were missing. Organization B stopped an attack before it caused damage, even though their technical vulnerabilities were in some cases worse, because they had clear procedures and empowered their defenders to act.
For Swiss SMEs (and for operators of critical infrastructure under BACS oversight), the takeaways are practical:
- Change default passwords. It sounds obvious; apparently it is not
- Set Machine Account Quota to zero unless operationally required
- Audit AD CS certificate templates, particularly the ESC1 configuration
- Scan for cleartext passwords in config files (connections.json, XML configs on SCCM distribution points etc)
- Set expiration dates on AWS and Azure keys; rotate them regularly
- Reduce cloud application permissions to the minimum; implement Conditional Access for workload identities
- Tune your alerts: thousands of false positives are worse than no alerting at all, because at least then you know you are blind
- Define SOC procedures: who escalates when and to whom, without bureaucratic delays
- Segment OT networks from the internet (Organization B proved a simple firewall rule is enough)
Bottom line
The full CISA report is freely available (Advisory AA26-237A) and is probably the most useful thing the agency has published this year. Not because the attacks were sophisticated, but precisely because they were not. Default credentials, cleartext passwords, misconfigured AD. These are not nation state techniques; these are things every pentester finds in every second network…
So the real question every company needs to ask: would you be Organization A or Organization B?