CISA ran the same tradecraft at two organisations; only the water utility caught it

The assume-breach pivot is the measurement. Once Organization B's defenders quarantined the systems compromised at initial access, CISA could not proceed on its own footing, so trusted agents inside the organisation handed the team a host built to replicate the access it would have held had nobody noticed ^[4]. Everything the advisory then records at Organization B, up to and including the bastion host in the OT demilitarized zone, ran on access the team was given rather than access it took ^[5][16]. That is the honest accounting of what one early catch bought: the earned portion of the intrusion ended at the first hop ^[16].

What it did not buy was an interior that held. Seated on an equivalent host, the same tradecraft arrived at the same classes of target in both organisations, sensitive business systems and cloud resources alike ^[13]. Organization B's second detection came at the OT DMZ, after that reach had already been demonstrated ^[5], and CISA notes it showed the ability to touch OT systems without actually doing so ^[11].

Organization A's entry is the part worth reading twice. Reconnaissance turned up a web application whose built-in accounts still carried default credentials, which let the team send mail from an internal address; phishing from that address put them on four workstations ^[8]. From there they ran a BloodHound collector modified to slip static EDR signatures while scraping users, computers, groups, access control lists, organisational units and group policy objects ^[9]. The customisation is the tell: endpoint detection and response was present enough at Organization A to be worth engineering around, and it produced nothing across initial access, domain-level privilege escalation and lateral movement to sensitive business systems and cloud ^[3][9][17]. One compromised workstation also sat at the default Machine Account Quota of 10, meaning unprivileged users could add computer accounts ^[10].

Set the two counts side by side. Organization B's defenders acted twice; Organization A's recorded nothing at all ^[17]. In the advisory's own framing of the divergence, the variable is defender action, detection followed by quarantine and later isolation, and not any stated difference in product inventory, headcount or spend ^[14]. The organisation that caught it was the water and wastewater one, and the one that did not was in government services and facilities ^[2][7].

CISA published the comparison with both assessed organisations' agreement, describing the activity, the defensive responses and the lessons for critical infrastructure ^[6]. The pairing is what makes it useful. Two engagements, similar tradecraft, one difference in outcome ^[1], and the difference lands on whether anyone was watching the first phished host rather than on how deep the intrusion could eventually go. Depth was available in both cases ^[13].