Topic starter
11/11/2026 6:00 pm
TL;DR: Water utilities are seeing intrusions succeed through weak credentials, exposed remote access and aging OT assets, with Crytica Security arguing that external monitoring often reveals compromise only after the fact. Constrained devices force detection closer to the device itself, or attackers gain time to persist and stage impact.
Editorial analysis by NHI Mgmt Group, based on content published by Crytica Security: “Invisible Targets: The Cybersecurity Crisis Facing Water Utilities”.
Key questions
Q: Why do weak credentials expose water utilities so quickly?
A: Weak credentials let attackers authenticate through remote access services, VPNs, web portals, and vendor channels, often without exploiting a software flaw.
Q: How does change-based detection work on industrial controllers?
A: Change-based detection compares the current device instruction set with a trusted baseline and alerts on unauthorised edits, new logic blocks, or altered control parameters.
Q: How should teams detect compromise in constrained OT devices?
A: Use device-level integrity checks, because constrained OT devices often lack rich endpoint telemetry.
Practitioner guidance
- Implement device-level unauthorized change detection Instrument PLCs, sensors and controllers so that instruction-set modifications trigger immediate alerts, even when traffic and logs remain normal.
- Reduce reliance on external-only monitoring Use network and log monitoring as supporting evidence, not as the primary proof of device integrity, because constrained OT systems can mask compromise.
- Prioritise remote access and credential hardening Review exposed remote access paths, weak credential practices and stale accounts first, since these are common entry points in utility environments.
Bottom line: Water utility environments fail when security assumes that external monitoring can see enough inside constrained OT devices to prove integrity.
Glossary terms: Dwell Time, OT Security, SCADA, PLC
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Blind spots, not just weak perimeter controls, are the defining governance failure in water utilities. Water utilities can have firewalls, logging and remote monitoring in place and still miss the moment a device changes state. The issue is that those controls were never designed to observe internal instruction changes inside constrained OT assets. Practitioners should treat visibility as an inside-the-device requirement, not an afterthought.
A question worth separating out:
Q: What should critical infrastructure teams prioritise over perimeter monitoring?
A: Critical infrastructure teams should prioritise device-state integrity, which verifies that controllers, hosts, and field devices are in the expected configuration and running trusted firmware or logic. Perimeter monitoring sees traffic leaving or entering a network, but integrity checks detect altered binaries, changed PLC code, disabled services, and unauthorised configuration drift.
👉 Read our full editorial: Water utility attacks turn blind spots into dwell-time risk