CISA conducted red team assessments on two critical infrastructure organizations, achieving full domain compromise in both. Despite using similar tradecraft, one organization failed to detect any of the red team’s activities. This stark difference in defensive outcomes highlights significant disparities in cybersecurity maturity within critical infrastructure sectors and the urgent need for improved detection capabilities.