Underserved utilities: what’s blocking cyber resilience in practice?

TL;DR: Underserved U.S. utilities often cannot turn cyber risk awareness into action because staffing, hardware, and approval bottlenecks block deployment, according to Dragos, even where threats are already active. The limiting factor is not threat visibility but the operating model that leaves small critical-infrastructure operators without the means to act.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Supporting Our Underserved Utilities: Launching the Community Cyber Resilience Foundation”.

Key questions

Q: What breaks when small utilities cannot staff cyber defence themselves?

A: The control stack breaks at the point of adoption.

Q: When should utilities prioritise outside support over building internal security teams?

A: When the utility is too small to sustain dedicated security staff, the priority should be external support that delivers assessment, deployment, and training together.

Q: What are the signs that a utility cyber programme is not operational?

A: Common signs include controls that were purchased but never deployed, hardware that was never provisioned, assessments that were never completed, and staff who cannot keep the tools running after installation.

Practitioner guidance

• Build a deployment-ready support model Treat onboarding, hardware provisioning, and initial assessment as part of the security programme rather than as optional services that the utility must self-fund and self-staff.
• Map the approval chain for security funding Identify who can authorise cyber spend in a utility, how long that path takes, and where a security decision can stall before any technology is installed.
• Prioritise OT controls that can be sustained locally Select controls that a small utility can operate after deployment, including clear maintenance, training, and escalation paths that do not depend on dedicated in-house security staff.

Bottom line: Underserved utilities do not fail because the risk is invisible; they fail because they cannot reliably operationalise the controls they need.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →