TL;DR: Water and wastewater utilities face rising cyber risk because IT/OT convergence expands the attack surface, internet-exposed devices and weak remote access remain common, and less than 25% of U.S. utilities undergo an annual cyber risk assessment, according to Nozomi Networks. OT resilience now depends on visibility, dynamic risk prioritisation and response readiness, not patching alone.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Nozomi Networks's blog post: Water and wastewater utilities need operational resilience programmes built around asset visibility, dynamic risk prioritisation and incident response, because connected OT environments now face attack paths that can affect service continuity and safety.
Why it matters: It matters to IAM and security practitioners because remote access, default credentials, privileged HMI use and third-party connectivity all turn identity governance into an OT resilience problem, not just an access-control problem.
By the numbers:
- Less than 25% of water and wastewater utilities in the U.S. undergo an annual cyber risk assessment, according to Nozomi Networks.
- Water and wastewater utilities are one of 16 critical national infrastructure segments, according to Nozomi Networks.
Context
Water and wastewater utilities are now operating in a blended IT/OT environment where business systems, remote access and field equipment are more connected than traditional industrial networks. That shift improves visibility and efficiency, but it also creates more paths for attackers to reach HMIs, PLCs and other operational assets.
The governance gap is straightforward: many utilities still rely on spreadsheets, institutional knowledge and periodic reviews instead of continuous asset inventory and behavioural baselines. In a sector where availability and safety come before everything else, that leaves identity, remote access and segmentation controls exposed to operational drift.
Key questions
A: Security teams lose the ability to prioritise risk against current exposure. New devices, changed contractor connections and temporary workarounds can persist unnoticed, which means remediation decisions are made on stale information rather than operational reality. In OT, that often leads to missed high-risk paths and wasted effort on low-impact findings.
Q: Why do weak segmentation and insecure remote access increase risk in water utilities?
A: They collapse the boundary between ordinary administrative connectivity and control-system access. Once an attacker or unauthorised user can move through that path, HMIs, PLCs and related operational systems become reachable, and even small changes can affect safety, service continuity or equipment integrity.
Q: How should water utilities prioritise OT remediation when patching is limited?
A: Prioritise by exploitability, exposure, asset criticality and process impact rather than by vulnerability count alone. A weakness on an isolated system is not the same as one on a controller that supports a vital treatment process. The goal is to reduce operational risk first, then address lower-value issues as maintenance windows allow.
Q: When should an OT security programme move from detection to recovery planning?
A: It should do both from the start, but recovery planning becomes essential as soon as critical systems cannot be freely patched or rebooted. In water and wastewater, response and restoration must be rehearsed before an incident because availability and safety constraints limit real-time improvisation. Teams need tested backups, role clarity and evidence-handling procedures.
Technical breakdown
Why IT/OT convergence changes the attack surface
IT/OT convergence means corporate systems, vendor access paths and operational networks are now more tightly connected than they were when many control environments were designed. That increases the number of entry points an attacker can probe, especially where remote access, shared credentials or weak segmentation bridge administrative and control functions. In water and wastewater environments, the risk is not just data loss. Manipulating an HMI, PLC or alarm path can change physical processes and disrupt service. Security teams need to treat connectivity as a control surface, not just a network design choice. See the OT Security Guide.
Practical implication: Map every connection into OT, including remote vendors and temporary workarounds, and reduce trust at each boundary.
How visibility and baselining support OT risk decisions
Passive monitoring is often the safest way to understand OT behaviour because it observes traffic without inserting tools inline. By building an inventory of assets, communications and normal process patterns, teams can spot unsupported devices, unusual protocols and changes in exposure before they become incidents. This is especially important where patching is delayed or impossible. The technical goal is not just asset count. It is to understand what normal looks like, so deviations can be prioritised against process criticality rather than treated as generic alerts.
Practical implication: Create a live OT inventory with communication baselines before you attempt to prioritise remediation.
Why response planning matters when safety and uptime come first
In OT, the question is rarely whether prevention will be perfect. It is whether the organisation can respond without losing control of a process. That makes incident response, recovery testing and role clarity part of the technical architecture, not just governance paperwork. Utilities need to know who can make operational decisions, who preserves evidence, how backups are restored and what happens if an engineering workstation or HMI is unavailable. The more distributed the environment, the more important that pre-planned coordination becomes. See the Cyber Resilience Guide.
Practical implication: Test recovery paths for critical workstations, HMI access and backup restoration before an outage forces the issue.
Threat narrative
Attacker objective: The attacker wants to manipulate operational processes in a way that disrupts service, creates safety risk or undermines trust in the utility.
- Entry occurs through internet-exposed devices, weak segmentation or insecure remote access into the utility environment.
- Escalation follows when default passwords, legacy systems or unmonitored industrial protocols let attackers reach HMIs, PLCs or operational networks.
- Impact is operational disruption, equipment damage, unsafe process changes or loss of public confidence in essential services.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OT resilience now depends on governing access paths, not just hardening devices. Water utilities cannot treat remote access, shared credentials and vendor connectivity as secondary issues because those are often the paths that lead into HMIs and PLCs. In a converged environment, identity controls and segmentation determine whether a routine connection becomes an operational hazard. Practitioners should govern every trust path into OT as a resilience control, not an IT convenience.
Continuous inventory is the prerequisite for any credible OT security programme. Static spreadsheets and tribal knowledge cannot keep pace with field devices, temporary workarounds and changing contractor access. Without a live asset and communications picture, risk scoring becomes guesswork and remediation queues become arbitrary. The important shift is from periodic review to continuous operational awareness. Practitioners should build a visibility model that ties assets, protocols and exposure together.
Control drift is the named failure mode in water OT. The article shows that many utilities inherit environments where default passwords, weak segmentation and unsupported assets persist long after the original design assumptions have expired. That is not just technical debt. It is a governance assumption that the environment will remain stable when, in reality, contractors, devices and network paths change constantly. Practitioners should treat drift itself as the risk to manage.
Operational resilience is the right success measure for critical infrastructure security. The article is clear that patching alone cannot define maturity in water and wastewater because uptime, safety and maintenance windows shape what is possible. That means security programmes should be evaluated by how well they reduce exposure while preserving service continuity. Practitioners should measure whether their controls support safe operations under stress, not whether every vulnerability is closed immediately.
The water sector’s identity problem is really a lifecycle problem for trust. When remote vendors, legacy HMIs and privileged field access coexist, the question becomes who can still reach what, when and why. That is an identity governance issue as much as an OT issue, and third-party risk management is part of the answer where outside access is involved. Practitioners should align access review, contractor offboarding and remote session control to OT change patterns.
Read next: Cyber Resilience Guide
What this signals
Visibility is the control that makes every other OT decision more defensible. Utilities cannot meaningfully prioritise remediation, segment networks or assess contractor exposure until they know what is connected and how it communicates. That makes live inventory and traffic baselining the foundation for both security and operational resilience.
Water and wastewater security is becoming an identity governance problem at the edge of OT. Remote maintenance, field access and third-party connectivity all depend on who can connect, from where and under what approval. As OT environments modernise, the strongest programmes will govern access lifecycles as carefully as they govern devices.
Resilience is the metric that will matter most in critical infrastructure programmes. The sector cannot measure success only by vulnerability closure because maintenance windows, aging assets and safety constraints limit patching. The better test is whether the utility can keep operating safely while reducing exposure over time.
For practitioners
- Build a real-time OT asset inventory Track every connected device, protocol and remote path across plants, stations and field sites so exposure is visible before prioritisation starts. See the OT Security Guide.
- Baselining normal communications Use passive monitoring to establish normal traffic, then flag new services, unusual protocols and unexpected remote connections for review.
- Prioritise remediation by operational impact Rank vulnerabilities by exploitability, exposure and process criticality, and move unsupported assets, default credentials and internet-facing services to the top of the queue.
- Test incident response for critical OT roles Document who makes operational decisions, who contacts vendors, who preserves evidence and how backups are restored when an HMI or engineering laptop is unavailable.
- Tighten third-party access governance Review vendor remote access, contractor accounts and temporary exceptions so offboarding, session control and segmentation match the pace of OT change.
Key takeaways
- Water and wastewater utilities face a compounded risk model because connectivity expands access paths while operational constraints limit conventional patching.
- The article’s evidence points to a sector where visibility and prioritisation are still immature, with fewer than 25% of U.S. utilities conducting annual cyber risk assessments.
- The practical answer is to govern access paths, inventory continuously and rehearse response so resilience improves without disrupting essential services.
Related NHI Mgmt Group resources: OT Security Guide · Cyber Resilience Guide · Third-Party Risk Management Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Default passwords, contractor access and remote operators make account governance central to this OT risk story. |
| Recommendation — Review account lifecycle controls for OT operators and vendors, and remove shared or default access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Remote access and privileged OT sessions depend on tightly governed permissions and entitlements. |
| Recommendation — Tighten access permissions for OT HMIs, PLC administration and vendor connections. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes attackers using weak passwords and insecure access paths to move from entry to operational systems. |
| Recommendation — Map exposed remote access and default credentials to credential access and lateral movement techniques. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is directly relevant where utility staff, vendors and contractors share operational access. |
| IA-5 — Authenticator Management | Default passwords and aging credentials are explicit weaknesses in the article’s attack surface discussion. | |
| Recommendation — Apply least privilege to OT administrative roles, vendor sessions and workstation access paths. Enforce authenticator lifecycle controls for OT accounts and replace default credentials wherever they still exist. | ||
Key terms
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- Human-Machine Interface: A Human-Machine Interface is the screen or console operators use to observe and control industrial systems. In SCADA, the HMI is often the first identity checkpoint for production actions, which makes shared accounts, weak authentication, and poor logging especially dangerous for accountability.
- Programmable Logic Controller: A Programmable Logic Controller is an industrial device that executes control logic for machinery and processes. PLCs are often trusted to run continuously, so unauthorized access can alter physical behaviour quickly. In modern SCADA governance, PLC access must be tightly scoped and traceable.
- Segmentation: The practice of dividing an audience into groups so that messages, offers or experiences can be tailored. In identity terms, segmentation depends on reliable attributes, and it fails quickly when the source data is stale, duplicated or poorly governed.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in practical terms. It helps practitioners connect identity controls to the broader security programmes their environments depend on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org