CISA, USCG Detail Cyber Hygiene Gaps Found in Critical Infrastructure

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Coast Guard (USCG) released a joint advisory on April 30, 2026, detailing findings from a proactive threat hunt engagement at a U.S. critical infrastructure organization. The advisory (AA25-212A) identifies systemic weaknesses in cyber hygiene — including unpatched software, weak credential policies, and inadequate network segmentation — that adversaries could exploit. The findings are intended to help other critical infrastructure defenders audit their own environments for similar gaps.

Technical Analysis

During the hunt, CISA and USCG teams observed multiple categories of security deficiencies. The advisory highlights persistent use of default or weak passwords across administrative interfaces, unpatched internet-facing services with known vulnerabilities, and lack of multi-factor authentication (MFA) on remote access points. Additionally, the teams found poor network segmentation, allowing lateral movement from less-secure operational technology (OT) environments to information technology (IT) systems. The advisory does not name the specific victim organization or disclose whether any active compromise was detected, but it notes that the observed configuration gaps are "consistent with patterns exploited by advanced persistent threat (APT) actors."

Specific technical findings include: unpatched instances of remote access software (e.g., VPN appliances, RDP gateways), credential reuse across internal and external systems, and missing endpoint detection and response (EDR) coverage on critical assets. The advisory also flags insufficient logging and monitoring, which would hinder detection of post-exploitation activity.

Mitigations & Recommendations

CISA and USCG recommend organizations implement the following controls: enforce MFA on all remote access and administrative accounts; establish a patch management program prioritizing internet-facing systems; conduct regular credential audits to eliminate reuse; segment OT and IT networks with strict firewall rules; and deploy centralized logging with a security information and event management (SIEM) solution. The advisory also urges critical infrastructure entities to participate in CISA's free vulnerability scanning and threat hunting services. Defenders should treat the advisory as a checklist for proactive hygiene review rather than a response to a specific active threat.