water · digital · infrastructure · family: designed for a world that doesn’t exist here
the water plantruns on outdated software
Water utilities run legacy control systems that are vulnerable to modern cyber threats
Problem statement
Water utilities and other critical infrastructure operators depend on operational technology (OT) — the control systems that run treatment and distribution — and, in the words of the WEF Global Cybersecurity Outlook 2025, on "networks of interconnected devices and legacy systems." Citing a CISA toolkit, the report names remote access points and outdated software as vulnerabilities in the OT systems used in water facilities, and says cybercriminals can exploit these weaknesses to disrupt water-treatment processes. In October 2024, a cyberattack targeted the largest water utility in the United States, disrupting operations and raising alarms about the security of critical infrastructure.
Why this matters
Over 80 percent of the U.S. population receives its drinking water from public water systems (CISA); the WEF report says an attack that disrupts water treatment could cause contamination, loss of service or other hazardous consequences. The WEF Global Cybersecurity Outlook 2025 found that 38% of public-sector respondents report insufficient cyber resilience, and it cites estimates of the cybersecurity workforce shortfall ranging from 2.8 million to 4.8 million professionals. The U.S. has approximately 152,000 public drinking water systems, including 50,000 community water systems (CISA). For small organizations in general, the WEF report finds that 35% believe their cyber resilience is inadequate. In the same survey, 72% of respondents reported that cyber risks had risen over the past year, and 54% of large organizations identify supply chain challenges as their biggest barrier to resilience.
What’s been tried and why it hasn’t worked
Free help exists. CISA's water sector page points to a CISA and EPA toolkit covering vulnerability scanning, cybersecurity training and cybersecurity assessments, to EPA's no-cost assessment tools and technical assistance, and to American Water Works Association guidance written for small and rural utilities. The WEF report describes why OT security stays hard anyway. IT and OT teams "tend to approach, prioritize and govern cybersecurity differently," and a lack of collaboration on a formal IT/OT convergence strategy hinders the secure digitalization of industrial environments. Strategic planning for OT security typically runs on long timelines and often depends on highly specialized suppliers, so it lacks the agility common in IT. The report's one OT case study describes an industrial vendor (Schneider Electric) that scans the internet for exposed, unsecured OT protocols and works with customers and authorities to mitigate the risks. The sources named here do not say how many small water utilities have taken up the free resources, or why the gap persists for them.
What would unlock progress
A low-cost, passive OT network monitoring tool designed specifically for small and mid-size water utilities could improve visibility into OT security posture without disrupting operations. This would require protocol-aware packet inspection for common OT protocols (Modbus TCP, DNP3, EtherNet/IP), anomaly detection baselined against normal operational patterns, and output designed for operators who are water engineers, not cybersecurity specialists. A "security assessment in a box" approach — hardware that passively monitors OT network traffic and generates actionable reports without requiring deep cybersecurity expertise — would be aimed at the workforce gap. Open-source approaches would enable adoption at utilities that can't afford commercial OT security platforms.
Entry points for student teams
A student team could build a passive OT network monitor using a Raspberry Pi or similar device that sniffs Modbus TCP traffic, identifies connected devices, maps communication patterns, and flags anomalies against a learned baseline. For testing, the team would need Modbus traffic captures — a public dataset if they can find one, or traffic they generate themselves on a lab bench — and the open-source network monitor Zeek (formerly Bro) ships with Modbus and DNP3 analysis scripts. The team would test their tool against simulated attack scenarios in a lab environment. This is a feasible prototype project for students with networking and embedded systems skills. A complementary approach would be designing a cybersecurity assessment workflow specifically tailored for small water utility operators with no IT staff.
Genes
Structural cousins: stuck the same way, in other fields
Sources
"Global Cybersecurity Outlook 2025," World Economic Forum with Accenture, January 2025. (accessed 2026-02-12). Supplemented with "Global Risks Report 2025," WEF, January 2025. (accessed 2026-02-12). go to source 1 ↗ go to source 2 ↗
Working notes
Notes made while writing and checking this brief, shown as written. They use working shorthand.
- The WEF Global Cybersecurity Outlook 2025 is based on a survey with 321 qualified participants (409 responses from 57 countries) plus 43 one-on-one interviews; the full report is a free PDF. The Global Risks Report 2025 rests on a separate perception survey of over 900 experts.
- CISA's water sector page gives the size of the sector and links to toolkits, infographics and assessment resources: https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector
- The October 2024 attack on American Water (the largest U.S. water utility) is a concrete reference case.
- Cross-domain connection: this problem shares deep structure with the `infrastructure-cascading-failure-modeling` brief — OT compromise in water systems can trigger cascade failures across infrastructure networks. Also related to `digital-autonomous-system-runtime-resilience` in that both involve maintaining system integrity under adversarial conditions.
- The WEF report's finding that 35% of small organizations believe their cyber resilience is inadequate (a sevenfold increase since 2022) suggests the problem is accelerating, not stabilizing.
- The WEF report lists energy alongside water among the critical sectors repeatedly targeted in the Ukraine conflict, and describes power grids as "highly attractive targets for cybercriminals."
Reconciliation 2026-10-01: Fact repair after reading the whole write-up against every source it names. Fetched on 2026-10-01: the Global Cybersecurity Outlook 2025 (the page on the Source line refuses automated requests, so the report itself was read in full from the World Economic Forum's own PDF, https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2025.pdf, 49 pages); the Global Risks Report 2025 (same situation; full text searched from https://reports.weforum.org/docs/WEF_Global_Risks_Report_2025.pdf, 104 pages); and CISA's water and wastewater sector page (read in full at the link above). Zeek's own code repository (github.com/zeek/zeek) was opened only to check what the entry point says about that tool. (1) The text said the WEF reports that "control system manipulation risks in water infrastructure increased 46% in a single year." Neither WEF report contains this figure; it was removed. (2) The text said "state-sponsored attacks on critical infrastructure OT systems have increased 72%," and the notes above repeated it for power distribution systems. Neither report says this. In the Cybersecurity Outlook, 72% is the share of survey respondents who said cyber risks had risen over the past year; the body now says that, and the note about energy now says what the report says: energy and water are among the critical sectors repeatedly targeted in the Ukraine conflict, and power grids are "highly attractive targets for cybercriminals." The claim that water is more exposed than energy because of smaller operator budgets is not in the sources and was removed. (3) The description of the control systems as designed decades ago for isolated networks, with "no authentication, no encryption, no logging" and no way to be patched without a shutdown, is not in any source named here. The report speaks of "legacy systems" and, citing a CISA toolkit, of remote access points and outdated software as vulnerabilities; the paragraph now says that. The report does not call remote access points "the primary attack vector," and that phrase was removed. (4) The October 2024 attack was said to have exposed "how vulnerable these systems are"; the report says it disrupted operations and raised alarms about the security of critical infrastructure, and the sentence now follows it. (5) "Over 50,000 community water systems, the majority serving fewer than 10,000 people," and the statement that small utilities lack budget and expertise, are not in the sources. CISA's page gives approximately 152,000 public drinking water systems, including 50,000 community water systems; the text now gives those figures, and the report's finding about small organizations in general (35% believe their cyber resilience is inadequate) replaces the unsupported sentence. "Water systems serve every person in a community" became CISA's figure of over 80 percent of the U.S. population. (6) The whole of "What's Been Tried" rested on claims that none of the three sources makes: that IT security tools crash legacy controllers, that network segmentation fails for lack of documentation, that IT vulnerability assessments produce false positives on OT protocols, that small utilities lack staff to use CISA's material, and that a SCADA upgrade for a mid-size utility costs $5–20M. The section now reports what the sources do say: the free resources listed on CISA's page, and the Cybersecurity Outlook's account of why IT and OT security are hard to join up, including its one OT case study (Schneider Electric). (7) Smaller corrections: "38% of public-sector organizations" became 38% of public-sector respondents; the workforce gap is now given as the report gives it, a range of estimates; "supply chain and third-party vulnerabilities" became "supply chain challenges," the report's wording for the 54% figure; "dramatically improve" became "improve" and "would address the workforce gap" became "would be aimed at," since the proposal is this write-up's own and not the report's. (8) The notes said the Cybersecurity Outlook is "based on surveys of 900+ executives." Its methodology gives 409 responses from 57 countries, 321 qualified participants and 43 interviews; "over 900 experts" is the Global Risks Report's survey. The note now gives both. The report's own reference calls the utility "American Water," not "American Water Works"; corrected. CISA's page is a sector overview with links to resources, not a set of technical advisories; the note now describes it that way. (9) Entry points: "the most common water utility protocol" (said of Modbus) is not in the sources and was removed. "Publicly available Modbus traffic datasets exist" named no dataset and could not be checked; the sentence now tells the team to find a public capture or generate traffic on their own bench. Zeek's repository does contain Modbus and DNP3 analysis scripts, and its release notes record the rename from Bro, so that pointer stays. Titles changed, because neither "decades-old," "cannot be secured" nor "the Nineties" is in the sources (the report says "legacy systems" and "outdated software"): the long title was "Water Utilities Run Decades-Old Control Systems That Cannot Be Secured Against Modern Cyber Threats" and is now "Water Utilities Run Legacy Control Systems That Are Vulnerable to Modern Cyber Threats"; the display title was "The Water Plant Runs on Software from the Nineties" and is now "The Water Plant Runs on Outdated Software." Confirmed in the sources and left as written: the Source line (the Cybersecurity Outlook is an Insight Report dated January 2025, in collaboration with Accenture; the Global Risks Report is dated January 2025); the October 2024 attack on the largest U.S. water utility; 38% for the public sector; 2.8 to 4.8 million; 54% of large organizations; 35% of small organizations and the sevenfold increase since 2022. Nothing in the write-up turned out to rest on the Global Risks Report. Not checked, because the sources do not cover them and no new sources were brought in: the protocol names in "What Would Unlock Progress" (Modbus TCP, DNP3, EtherNet/IP) and the feasibility of a Raspberry Pi monitor, which are this write-up's own proposal. Genome tags untouched. A second reader went over these repairs on the same day, opened the same three sources plus Zeek's documentation and the Internet Archive copies of the two Source-line pages, confirmed every change, and tightened four sentences to the sources' own wording (the small-organizations sentence, "a lack of collaboration on a formal IT/OT convergence strategy," the case-study sentence, and the energy note).