CISA red teams reach domain-level compromise at two critical infrastructure organizations, but only one SOC detects and contains initial intrusion.