Here is the uncomfortable truth every security leader already suspects: the agencies found these weaknesses even in organizations “with mature cyber postures.” Not because those teams are careless, but because modern hybrid environments have grown too large, too interconnected, and too fast-changing for any human or any spreadsheet, or any static Visio diagram to fully reason about. Extend that complexity into operational technology (OT), where a single misconfigured path can reach a controller running a physical process, and the stakes stop being about data and start being about safety, uptime, and public welfare.
This is precisely the problem RedSeal was built to solve. Below, we walk through all ten misconfigurations and show how RedSeal helps you preemptively avoid, proactively identify, and rapidly remediate each one across IT, cloud, IoT, and OT, in a single continuously updated model.
The Core Idea: You Can’t Protect What You Can’t See — or Reason About
Most of the NSA/CISA top ten share a common root cause. They aren’t really about one bad password or one missing patch; they’re about exposure no one can see because no one has a complete, connected picture of the environment. A default credential only matters if an attacker can reach the device that carries it. A missing patch becomes a crisis only when the vulnerable host sits on an attack path to something valuable. A segmentation policy is only as good as your ability to prove, continuously, that it actually holds.
RedSeal builds a continuously updated digital twin of your entire hybrid environment. Drawing on 2,000+ integrations across firewalls, routers, switches, load balancers, wireless controllers, cloud platforms, and importantly OT/IoT systems from vendors like Claroty, Nozomi, Tenable OT, Siemens RUGGEDCOM, Hirschmann, and Phoenix Contact, RedSeal computes every possible access path through your network. It does this without touching production, using configuration and connectivity data rather than active probing that could disrupt fragile OT devices. The result is a single source of truth showing not just what’s connected, but what can actually reach what and how an attacker would move after a foothold.
That model maps naturally to a Continuous Threat Exposure Management (CTEM) motion: Scope the assets that matter, Discover every connection (including the ones nobody remembers creating), Prioritize by real reachability and business impact, Validate that defenses work as intended, and Mobilize teams with clear remediation guidance.
Mapping RedSeal to the NSA/CISA Top Ten
1 Default Configurations of Software and Applications
Default credentials and insecure defaults are everywhere routers, printers, cameras, VoIP phones, IoT sensors, and, alarmingly often, OT gear shipped with a shared password. RedSeal’s comprehensive discovery surfaces the very devices most likely to carry defaults, including the unknown and unmanaged assets that every deployment tends to uncover. More powerfully, RedSeal shows which of those devices are actually reachable from untrusted zones so you fix the exposed ones first and prove they’ve been isolated.
2 Improper Separation of User/Administrator Privilege
Privilege sprawl lives in identity systems, but its blast radius is a network problem: a compromised over-privileged account is only as dangerous as where it can go. RedSeal’s attack-path analysis makes that blast radius visible, helping you design narrower admin zones, jump hosts, and segmentation that limit lateral movement even when an account is misused.
3 Insufficient Internal Network Monitoring
The advisory describes teams maintaining deep, undetected access. RedSeal complements your SIEM (Splunk, QRadar, Sentinel) and EDR (CrowdStrike, Defender) by telling you where to look identifying critical choke points and the paths that matter most, and flagging areas missed by scanners and endpoint coverage gaps.
4 Lack of Network Segmentation
This is RedSeal’s signature strength and where the IT/OT story becomes essential. Segmentation is the modern replacement for the air gap, but it’s error-prone: humans are poor at maintaining complex multi-vendor rules, and the dangerous errors are the silent ones that leave something open. Define a policy e.g., “no path from the corporate user VLAN into the OT process network except through the designated broker” and RedSeal continuously validates that it actually holds across your real configurations, catching drift and “temporary” exceptions before an attacker does.
5 Poor Patch Management
Nobody can patch everything, and in OT you frequently can’t patch at all. RedSeal reframes patching into a prioritized, risk-based exercise by overlaying vulnerability data (Tenable, Qualys, Rapid7) onto the connectivity model showing which CVEs sit on a genuine attack path to a critical asset. Where you can’t patch, RedSeal helps you prove the device is segmented and unreachable, mitigating risk without touching it.
6 Bypass of System Access Controls
Pass-the-hash and similar techniques succeed by moving laterally through a network that permits it. RedSeal exposes the workstation-to-workstation and workstation-to-server paths that make lateral movement easy so you can enforce and verify constraints like funneling communications through servers and denying broad local-admin reach.
7 Weak or Misconfigured MFA Methods
MFA’s effectiveness depends on removing the alternate paths that bypass it legacy protocols, unprotected remote access, forgotten VPN routes. RedSeal continuously maps internet-facing resources and remote-access paths, including the “temporary” vendor-support tunnels into OT that our field teams routinely discover, ensuring MFA is the front door rather than one of several unlocked side doors.
8 Insufficient ACLs on Network Shares and Services
Over-permissive access is a reachability question: who can get to this resource, and should they? RedSeal computes end-to-end access to sensitive systems and highlights where ACLs and infrastructure permissions are broader than intended letting you apply least privilege at the network layer and confirm only authorized zones can reach protected data.
9 Poor Credential Hygiene
Credential storage is a host concern, but credential exploitation is a network-movement problem a cracked credential is only valuable if it opens a path. RedSeal’s contribution is containment: by minimizing unnecessary connectivity and validating segmentation, it ensures a compromised credential yields a small, contained blast radius rather than a clear run to domain dominance.
10 Unrestricted Code Execution
Restricting what can execute is an endpoint discipline; limiting what a payload can do once it runs is network architecture. If malicious code lands on a host, RedSeal’s attack-path analysis defines and helps you constrain how far it can spread ensuring a phishing payload on a corporate laptop can’t pivot into a process-control network.
At a Glance: The Ten Mistakes → RedSeal in Action
| # | NSA/CISA Misconfiguration | How RedSeal Helps (IT & OT) |
| 1 | Default configurations & credentials | Discovers unknown/unmanaged devices; shows which defaults are reachable from untrusted zones |
| 2 | Improper privilege separation | Attack-path analysis reveals a compromised account’s true blast radius |
| 3 | Insufficient internal monitoring | Pinpoints choke points & scanner/EDR coverage gaps to focus sensors |
| 4 | Lack of segmentation | Continuously validates IT↔OT segmentation policy; catches silent drift |
| 5 | Poor patch management | Prioritizes CVEs on real attack paths; proves isolation when patching is impossible |
| 6 | Bypass of access controls | Maps lateral-movement paths so you can enforce & verify constraints |
| 7 | Weak/misconfigured MFA | Surfaces internet-facing & remote-access paths (incl. vendor OT tunnels) |
| 8 | Insufficient ACLs on shares | Computes end-to-end reachability to enforce least privilege at the network layer |
| 9 | Poor credential hygiene | Contains blast radius via minimized connectivity & validated segmentation |
| 10 | Unrestricted code execution | Constrains payload spread; blocks IT→OT pivot paths |
Why This Matters Doubly in OT
Everything above applies to IT. But in OT, the consequences of these same ten mistakes escalate from data loss to physical disruption halted production lines, tampered safety systems, interrupted fuel or power delivery. Recent joint advisories from the Department of Energy, CISA, and the FBI confirm that state-sponsored actors are actively probing ICS and SCADA systems exploiting the same basic gaps on the NSA/CISA list: default credentials, exposed remote access, and neglected IT/OT segmentation.
OT environments make these mistakes harder to fix by hand: the gear is old by design, patching is often impossible, active scanning is risky, and the people who understand the process differ from those who understand the network. RedSeal is built for this reality. Because it derives its model from configuration and connectivity data rather than intrusive probing, it maps OT reachability safely. Because it integrates OT-native platforms alongside IT infrastructure, it produces one picture of a converged environment. And because it continuously validates segmentation, it keeps the IT/OT boundary honest long after the initial architecture review.
From Reactive to Preemptive
The common thread running through the NSA/CISA advisory is that these intrusions are preventable. And the common thread running through RedSeal is that prevention requires seeing your environment the way an attacker does as a web of reachable paths and continuously proving your defenses hold. RedSeal helps you avoid these mistakes by revealing exposures and unknown assets before they’re exploited, identify them by continuously validating segmentation and access against policy, and remediate them by prioritizing the exposures that sit on real attack paths and handing IT and OT teams clear, actionable guidance. Ten mistakes, one connected picture, across every corner of your hybrid enterprise.
See What Others Miss
Discover the attack paths, unknown assets, and IT/OT segmeenation gaps hiding in your own envirnment. Schedule a demo today!
