Water utility attacks turn blind spots into dwell-time risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Crytica Security's blog post: Water utilities are being probed through weak credentials, remote access exposure and aging OT systems, and external-only monitoring cannot reliably catch unauthorized change.

Why it matters: For IAM, PAM and OT security teams, the key issue is not just access prevention but how to detect abuse quickly when legacy devices cannot host normal controls.

Context

Water utility environments are a visibility problem before they are a tooling problem. PLCs, SCADA systems and remote sensors often run with limited memory, intermittent connectivity and little room for inline security instrumentation, so defenders rely on indirect signals that can miss the moment a device changes state.

That creates a detection gap in which an attacker can move from access to persistence before operators see anything unusual. In water infrastructure, the governance challenge is to secure constrained OT security environments without assuming that external monitoring can substitute for device-level visibility.

This starting position is typical for distributed critical infrastructure, not an edge case. The same constraints that preserve uptime also make old detection assumptions unreliable.

Key questions

Q: How should teams detect compromise in constrained OT devices?

A: Use device-level integrity checks, because constrained OT devices often lack rich endpoint telemetry. Compare firmware, configuration, boot state, and signed baselines, then alert on unauthorised changes, unexpected reboots, missing logs, or failed attestation. Where agentless monitoring is the only option, pair it with change control and maintenance-window validation.

Q: Why do weak credentials expose water utilities so quickly?

A: Weak credentials let attackers authenticate through remote access services, VPNs, web portals, and vendor channels, often without exploiting a software flaw. Water utilities are exposed quickly because shared passwords, default accounts, and stale tokens can be reused against exposed operators, remote maintenance systems, and control interfaces. Strong unique credentials, MFA, and rapid revocation reduce that path.

Q: How does change-based detection work on industrial controllers?

A: Change-based detection compares the current device instruction set with a trusted baseline and alerts on unauthorised edits, new logic blocks, or altered control parameters. On industrial controllers, it works by monitoring program uploads, configuration writes, and command sequences so operators can spot tampering, logic drift, or unsafe maintenance changes.

Q: What should critical infrastructure teams prioritise over perimeter monitoring?

A: Critical infrastructure teams should prioritise device-state integrity, which verifies that controllers, hosts, and field devices are in the expected configuration and running trusted firmware or logic. Perimeter monitoring sees traffic leaving or entering a network, but integrity checks detect altered binaries, changed PLC code, disabled services, and unauthorised configuration drift.

Technical breakdown

Why external monitoring misses unauthorized change in OT devices

External monitoring watches traffic, logs and perimeter events, but it does not see the internal instruction state of a PLC, sensor or controller. In constrained OT devices, that matters because malware can keep communications and logs looking ordinary while altering device logic underneath. Health checks can also be manipulated, which makes a compromised asset appear stable even when its behavior has changed. The result is a blind spot between compromise and observable symptoms. See the OT Security Guide.

Practical implication: Place detection where the device state changes, not only at the network edge.

How dwell time grows when systems cannot host security controls

Dwell time is the period between initial access and discovery. In legacy OT and IoT environments, that window expands because the device cannot support heavy monitoring, continuous scanning or frequent agent updates. Attackers exploit that gap by establishing persistence, mapping adjacent systems and waiting for operational conditions that increase the impact of disruption. The technical issue is not only stealth but asymmetry: the defender sees late, while the attacker acts early. See the Device and IoT Identity Guide.

Practical implication: Treat short dwell time as a design requirement for operational technology, not a post-incident metric.

Why change-based detection beats signature matching in utility operations

Signature detection looks for known malware, while behavior analytics waits for suspicious patterns to emerge. In water utilities, both approaches are limited by sparse telemetry and fragile endpoints. Change-based detection shifts the control objective: instead of asking whether activity resembles a known threat, it asks whether an instruction set has been altered without authorization. That is a narrower and faster signal, and it fits the operational reality of constrained devices better than post hoc analysis.

Practical implication: Use unauthorized change as the primary alert condition when devices cannot sustain richer inspection.

Threat narrative

Attacker objective: The objective is to maintain hidden access long enough to position a utility for disruption, operational leverage or wider strategic pressure.

1. Entry commonly begins with weak credentials, remote access exposure or outdated infrastructure that gives an attacker a foothold into the utility environment.
2. Once inside, the attacker can alter device instructions while keeping traffic and logs looking normal, which hides the compromise from external monitoring.
3. The attacker then establishes persistence and maps the environment while defenders remain unaware, extending dwell time until conditions for coordinated disruption are ready.
4. Impact follows when the altered device state affects operations, safety or trust in essential services.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blind spots, not just weak perimeter controls, are the defining governance failure in water utilities. Water utilities can have firewalls, logging and remote monitoring in place and still miss the moment a device changes state. The issue is that those controls were never designed to observe internal instruction changes inside constrained OT assets. Practitioners should treat visibility as an inside-the-device requirement, not an afterthought.

Unauthorised change detection is the right control concept for constrained OT. In environments where continuous inspection is too heavy and connectivity is uneven, defenders need a control that answers a binary question fast: did the instruction set change without approval? That reframes detection from pattern matching to state integrity, which is a better fit for legacy controllers and remote sensors. Practitioners should anchor their OT strategy on integrity of device state, not just traffic analysis.

Operational resilience in water infrastructure depends on shrinking dwell time, not assuming prevention will hold. The article's risk model is consistent with what critical infrastructure identity security programmes already see in distributed environments: attackers exploit the gap between access and discovery. When dwell time stretches into weeks or months, operational teams lose the chance to intervene before persistence and staging are complete. Practitioners should design for fast discovery and containment under constrained telemetry.

The sector's attack surface is amplified by resource asymmetry. More than 150,000 public water systems means wide distribution, uneven standardisation and many small teams protecting essential services. That combination does not eliminate advanced threats, but it makes simple intrusion paths more successful because they can be repeated at scale. Practitioners should prioritise control patterns that work even where staffing and device capacity are thin.

Water utilities need a governance model that assumes the device may be compromised while still appearing healthy. That is the central operational assumption shift this topic demands. If a control only works after compromise becomes visible, it is too late for a sector where delayed discovery creates public health and continuity risk. Practitioners should move from reactive monitoring to integrity-based assurance at the device layer.

What this signals

Integrity-first monitoring will become the more realistic control model for constrained water systems. When devices cannot host full security tooling, the programme has to shift from watching for suspicious traffic to watching for unauthorised state change. That changes how SOC and OT teams set alert thresholds, because the useful signal is now internal integrity rather than external behavior.

Dwell-time reduction becomes a resilience objective, not only a detection metric. In water utilities, the practical measure of control quality is how quickly a hidden change is surfaced and contained. Teams that still depend on after-the-fact discovery will continue to lose the window in which an incident can be isolated before operational impact spreads.

For practitioners

• Implement device-level unauthorized change detection Instrument PLCs, sensors and controllers so that instruction-set modifications trigger immediate alerts, even when traffic and logs remain normal.
• Reduce reliance on external-only monitoring Use network and log monitoring as supporting evidence, not as the primary proof of device integrity, because constrained OT systems can mask compromise.
• Prioritise remote access and credential hardening Review exposed remote access paths, weak credential practices and stale accounts first, since these are common entry points in utility environments.
• Segment legacy OT assets by criticality Isolate high-consequence water treatment and distribution devices so that a single compromised controller cannot move laterally into adjacent operational zones.
• Build response around dwell-time reduction Define thresholds for containment that assume attackers may remain hidden for extended periods, and rehearse actions that can stop an incident before operational impact.

Key takeaways

• Water utility environments fail when security assumes that external monitoring can see enough inside constrained OT devices to prove integrity.
• The article describes thousands of attempted intrusions and a large, fragmented attack surface, which helps explain why simple entry paths continue to work.
• The control that matters most here is rapid detection of unauthorised device change, because reducing dwell time is what keeps compromise from becoming disruption.

Related NHI Mgmt Group resources: OT Security Guide · Critical Infrastructure Identity Security Guide · Device and IoT Identity Guide

Key terms

• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• OT Security: OT security is the discipline of protecting industrial environments from compromise, disruption, and unsafe behaviour. It includes segmentation, asset discovery, intrusion detection, and vulnerability handling, but all of those controls depend on receiving reliable telemetry from the plant floor.
• SCADA: Supervisory Control and Data Acquisition systems collect operational data and let operators control industrial processes in real time. In connected environments, SCADA is no longer just control software. It becomes an identity and access surface where credentials, remote sessions, and network paths can affect physical production.
• PLC: A Programmable Logic Controller is an industrial device that executes control logic for physical equipment and processes. PLCs are often deeply trusted inside OT environments, so compromise or misuse can quickly affect how machinery behaves in the real world.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs stronger control over identities, secrets and privileged access across modern systems.