CISA red team assessments fully breached two critical infrastructure organizations, and only the water utility noticed.