CISA ran the same attack against two organizations. One of them never responded. On Aug 25 CISA published advisory AA26-237A, titled “A Tale of Two SOCs.” Two red team assessments, run simultaneously with similar tradecraft, against two critical-infrastructure targets. Both ended in domain-level compromise, and in both the team reached sensitive business systems and cloud. Everything after that diverged. Organization B — a water and wastewater entity — caught the phishing payload on each of three workstations, quarantined and reimaged them, and severed command-and-control. CISA’s own framing: because those defenders removed the foothold, the red team had to switch to an assume-breach model to continue. Organization A — government services — did not respond. And here is the part worth sitting with: its SOC did receive alerts. The advisory records medium- and low-severity EDR alerts tied to red team activity that the SOC “did not respond to.” Thousands of false positive alerts from normal business operations, many at higher severity, obscured them. That is not a detection failure. It is a response failure — a different problem, with a much cheaper fix.

One alert was real, and it was closed because nobody could name the server’s owner. Same advisory, and it is the detail I cannot stop thinking about. Red team members observed defenders’ chat about an alert on an SCCM box: they tried to identify who owned that system, what it did, and how it was normally used. They could not. The SOC eventually flagged it a false positive. The detection worked. The alert was true. The asset inventory is what failed. CISA also found Organization A running multiple SOCs and multiple EDR products whose staff neither communicated nor had visibility into each other’s detection tools — and SOC staff and system owners did not communicate either. The advisory’s closing line, verbatim: “Detection tools are only as effective as the people, processes, and procedures supporting them.”

Attackers minted admin tokens, then went shopping — four days after disclosure. On Sep 2 CISA added seven flaws to the Known Exploited Vulnerabilities catalog. Among them CVE-2026-82329, a JFrog Artifactory improper-authentication issue (CVSS 9.8) that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges. watchTowr reported in-the-wild exploitation on Sep 1 — roughly four days after disclosure — with attackers minting admin tokens and enumerating users, groups, credential sets and federated access topologies. Two SonicWall SMA 1000 flaws landed in the same batch (CVE-2026-83548, CVSS 10.0, pre-auth SSRF). Patch, obviously. But the question this week asks is the other one: if someone minted a new admin token in your environment tonight, what fires?

THE ALERT COVERAGE REVIEW — ONE AFTERNOON

1  PICK      5 events that must NEVER happen quietly.
              New global admin. Log source goes dark.
              Impossible-travel login. Mass export.
              New mailbox forwarding rule.
2  ASK       three questions, per event:
              Is it LOGGED?  (usually yes)
              Does it ALERT? (now you’re guessing)
              Who RECEIVES it at 2am? (the real one)
3  GENERATE  stop guessing — make the event happen.
              With approval, in a window you control.
4  WATCH     did anything fire? how long? did it reach
              a human, or a channel nobody reads?
5  RECORD    what happened — AND what didn’t. A silent
              event is the most valuable line in the log.

⚠️ Step 3 creates real events in a real environment. Get approval, work inside a change window, and tell the people who would otherwise respond that it is you — then remove what you created and log the removal. The kit is a review format and a starting point, not managed security services, and not legal, compliance, or audit advice. If a test turns up evidence that the event already happened for real, follow your incident-response plan and engage counsel and your insurer per its terms.

“We spend real money on detection tooling and I can tell you it is deployed. What I can’t currently tell you is which specific events would actually reach a human at two in the morning — because we have never made one happen on purpose and watched. I want one afternoon to test five. Best case, I hand you a signed record that our five worst scenarios all alert, with times. Worst case, we find out on our own schedule instead of during an incident — and we fix it before it is the thing we are explaining to a client.”

Pick the honest one, not the aspirational one. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.