TL;DR: Underserved U.S. utilities often cannot turn cyber risk awareness into action because staffing, hardware, and approval bottlenecks block deployment, according to Dragos, even where threats are already active. The limiting factor is not threat visibility but the operating model that leaves small critical-infrastructure operators without the means to act.
At a glance
What this is: This is Dragos’s analysis of why many small U.S. utilities cannot operationalise cyber defence even when they understand the risk, with adoption barriers spanning staffing, hardware, and governance.
Why it matters: It matters because identity, access, and security governance all fail if small operators cannot implement the controls, sustain them, or staff them, especially in critical infrastructure where the consequences reach beyond the local utility.
Context
Small utilities often sit in a governance gap: they are expected to secure critical infrastructure, but they lack the staff, budget, and internal approval paths to translate risk into action. In operational technology, that means detection and response capabilities are not just a technical decision, but a resourcing and accountability problem.
The article’s core argument is that the barrier is no longer awareness. For many utilities, the real failure point is adoption, because they cannot install, maintain, or continuously operate the controls they need. That is a structural resilience problem, not a tooling problem.
Key questions
Q: What breaks when small utilities cannot staff cyber defence themselves?
A: The control stack breaks at the point of adoption. Even when risk is understood, tools remain uninstalled, unmaintained, or underused if no one can deploy them, sustain them, or secure funding for them. In critical infrastructure, that turns cyber resilience into a capacity problem as much as a technical one.
Q: When should utilities prioritise outside support over building internal security teams?
A: When the utility is too small to sustain dedicated security staff, the priority should be external support that delivers assessment, deployment, and training together. For many under-resourced operators, the immediate problem is not choosing a perfect internal model, but getting any durable security capability into production.
Q: What are the signs that a utility cyber programme is not operational?
A: Common signs include controls that were purchased but never deployed, hardware that was never provisioned, assessments that were never completed, and staff who cannot keep the tools running after installation. In practice, the programme exists on paper but not in operations.
Q: Who is accountable for small utility cyber resilience when local governance slows action?
A: Accountability is shared across utility leadership, local public officials, and the external partners who can provide technical support. If the approval chain cannot move fast enough, the security gap becomes a governance failure. The practical test is whether authority and resources can be activated before the next incident, not after it.
Technical breakdown
Why adoption collapses in under-resourced utility environments
Under-resourced utilities face a layered implementation failure. They may understand the threat, but they still need hardware, deployment support, internal time, and sometimes initial assessment before any control can be operationalised. In OT environments, the practical failure is often not detection quality but the inability to place and sustain the technology in the first place. When a utility lacks staff, even a free control can remain unused. Practical implication: design for installability, sustainment, and support capacity, not just product capability. See the OT Security Guide.
Practical implication: treat deployment support as a security control, not a nice-to-have service.
Why critical infrastructure risk becomes a community governance issue
Critical infrastructure security in small utilities is governed by more than technical controls. Spending approvals can involve town votes, public utility commissions, mayors, and administrators who are not close to the threat. That creates a governance lag between knowing a risk exists and authorising the response. In OT, this lag can be as damaging as the weakness itself because attackers operate on a much shorter timeline than public budgeting cycles. Practical implication: map approval bottlenecks as part of the security architecture, not as an externality.
Practical implication: build governance workflows for rapid security funding decisions before a crisis forces them.
Why active threats change the baseline for utility resilience
The article describes a world where smaller utilities are already being targeted, including campaigns against water, electric, and gas environments. That means resilience is no longer about preparing for hypothetical exposure. It is about reducing the time between threat recognition and control deployment in environments that adversaries actively scan and probe. The inclusion of AI in the threat narrative matters because it lowers attacker effort and speeds target discovery. Practical implication: treat small-utility OT defence as an ongoing operational service, not a one-time project.
Practical implication: align OT defence with continuous operational support, not periodic remediation.
Threat narrative
Attacker objective: The attacker seeks access to operational technology that can be used for disruption, reconnaissance, or future sabotage of critical infrastructure.
- Entry begins when adversaries target internet-connected or otherwise reachable OT environments in small utilities, including water, electric, gas, and supermarket-linked control systems.
- Escalation follows when weakly supported environments lack the staffing, hardware, or operational maturity needed to deploy detection, containment, and recovery controls at speed.
- Impact appears as compromise of critical utility operations, with the article citing active intrusions, attempted preparation for future disruption, and the potential for spillover to larger utilities and national security.
Breaches seen in the wild
- Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Underserved utility cyber resilience is a deployment problem before it is a detection problem. The article makes clear that free software does not equal usable security when the operator lacks hardware, staff, or time to stand it up. That is the governance gap in small critical infrastructure: controls may exist in theory, but not in the operating environment. Practitioners should treat deployment support and sustainment as part of the control objective.
Critical infrastructure resilience fails when approval chains are slower than adversary movement. Utility security is often mediated by boards, public commissions, and local officials who are removed from the threat. That creates an execution lag that attackers do not have to respect. For critical services, the deciding variable is no longer whether risk is understood, but whether authority can be mobilised fast enough to act.
Small utilities are not a peripheral use case; they are the last mile of national resilience. The article’s argument is that compromise in a small operator can create downstream problems for larger utilities and public safety. That makes community-scale OT security a systems issue, not a niche sector issue. A resilience programme that ignores the smallest operators leaves the most fragile part of the infrastructure chain exposed.
Community cyber resilience: the practical model is shared capability, shared support, and shared execution capacity for organisations that cannot staff security alone. The foundation structure is notable because it combines technology, training, and operational support instead of assuming any one of those is sufficient. That model recognises that identity, access, and OT governance only work when the operator can actually consume them. Practitioners should design programmes around adoption capacity, not just control selection.
AI changes the economics of finding and targeting weak utilities, which means old resilience assumptions age quickly. The article frames AI as an accelerator for adversaries, not a standalone threat. That is important because it raises the cost of delay for under-resourced defenders. In practice, AI compresses the time available for discovery and response, so security programmes must favour simpler, faster-to-operationalise controls over complex designs that never leave the planning stage.
What this signals
Operational resilience for small utilities now depends on service delivery, not just security tooling. A programme that cannot be installed, supported, and maintained by the recipient will not protect critical infrastructure, no matter how capable the product is in principle. For practitioners, the next maturity step is to measure whether controls are actually consumable by the smallest operators in the supply chain.
Community cyber resilience will increasingly become the model for low-capacity operators. The article points toward a blended approach in which funding, deployment help, and workforce development arrive together. That matters for any critical-sector programme that has historically assumed a staffed security team exists at the edge; for many utilities, that assumption is no longer valid.
Resilience programmes need to be built for adversaries who can move faster with AI and scale their targeting across exposed infrastructure. In that environment, long approval cycles and partial deployments create unnecessary exposure windows. Security leaders should expect more pressure to deliver controls that are simple to consume, quick to operationalise, and supportable without specialist headcount.
For practitioners
- Build a deployment-ready support model Treat onboarding, hardware provisioning, and initial assessment as part of the security programme rather than as optional services that the utility must self-fund and self-staff.
- Map the approval chain for security funding Identify who can authorise cyber spend in a utility, how long that path takes, and where a security decision can stall before any technology is installed.
- Prioritise OT controls that can be sustained locally Select controls that a small utility can operate after deployment, including clear maintenance, training, and escalation paths that do not depend on dedicated in-house security staff.
- Use community partnerships to close the staffing gap Pair technology with external assessments, peer guidance, and workforce development so that utilities without security personnel can still maintain a basic security posture.
Key takeaways
- Underserved utilities do not fail because the risk is invisible; they fail because they cannot reliably operationalise the controls they need.
- The article links active targeting of water, electric, and gas environments to a broader resilience gap in small critical-infrastructure operators.
- A workable response combines technology, deployment support, training, and funding so the control can be sustained after installation.
Related NHI Mgmt Group resources: OT Security Guide · OT and ICS Identity and Access Guide · Cyber Resilience Guide · OT Security Platform Buyer's Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Utility deployment and sustainment depend on governed access and operating permissions for OT tooling. |
| Recommendation — Apply PR.AA-05 to ensure OT tools are deployed with least-privilege access and clear authorization boundaries. | ||
| CIS Controls v8 | CIS-5 — Account Management | Small utilities need account governance to operate security tools safely after deployment. |
| Recommendation — Use CIS-5 to define who can administer OT security systems and how access is reviewed and removed. | ||
| MITRE ATT&CK | TA0001; TA0040 — Initial Access; Impact | The article describes active targeting of utility OT and the operational consequences of compromise. |
| Recommendation — Map utility threat reporting to TA0001 and TA0040 to prioritise exposed infrastructure and likely impact paths. | ||
| NIST SP 800-53 Rev 5 | PE-3 — Physical Access Control | The post notes hardware, deployment, and site-level constraints that shape OT security execution. |
| Recommendation — Apply PE-3 where physical installation and control of OT security hardware are part of the risk boundary. | ||
| ISO/IEC 27001:2022 | A.5.23 — Information security for use of cloud services | The article emphasises managed support and external services, which require governed supplier relationships. |
| Recommendation — Use A.5.23 to govern external support arrangements that carry utility security tooling and operational data. | ||
Key terms
- Cybersecurity Poverty Line: A threshold where an organization lacks the staff, time, tooling, or operational maturity to maintain adequate security coverage. The concept describes a structural gap, not just a budget problem. Teams below this line often struggle to investigate alerts, keep pace with change, and consistently apply basic security controls.
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- Deployment Barrier: The set of non-technical obstacles that prevent a security control from reaching production, including hardware shortages, lack of staff, weak governance, and limited operating time. It matters because many programmes fail at implementation rather than at design.
- Cyber Resilience: Cyber resilience is the ability to continue operating, recover, and make safe decisions during and after a cyber incident. It goes beyond backup availability by combining visibility, prioritisation, and restoration discipline so the organisation can restore what matters without amplifying harm.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives identity and security practitioners a shared baseline for governing access in complex environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org