Water utility OT security: are exposed PLCs still the weak point?

TL;DR: Water sector OT security still leaves exposed controllers, weak access controls and delayed patching in place, according to Dragos, as Bowman Dam in 2013 and Minnesota utilities in 2026 both showed attackers could reach critical systems without sophisticated malware. The lesson is that visibility, segmentation and remote access governance remain the decisive controls, not awareness alone.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Water Under Attack: A Decade of Warnings, and the Same Gaps Still Open”.

Key questions

Q: What breaks when OT devices are exposed to the internet?

A: Internet exposure turns HMIs and PLCs into reachable control points rather than protected field assets.

Q: Why do weak credentials and bypassable authentication create outsized OT risk?

A: Because many OT environments rely on devices that are expected to be stable for long periods, so a small authentication failure can persist unnoticed and give an attacker durable control.

Q: How should utilities prioritise OT vulnerabilities when patching is slow?

A: They should prioritise based on whether the asset is reachable, whether the weakness is already known to be exploited, and how much operational impact a compromise would create.

Practitioner guidance

• Remove unnecessary public internet exposure Pull OT controllers, HMIs and related access paths off the public internet wherever they do not have a justified operational need, and replace direct exposure with controlled remote access paths.
• Govern remote access like privileged access Route all vendor and operator remote sessions through managed gateways, restrict device-level credentials, and separate authentication for operators from authentication for plant equipment.
• Build an OT asset exposure inventory Map every externally reachable PLC, cellular endpoint and remote management service so you can see which assets are reachable, by whom and from which networks.

Bottom line: The recurring weakness in these water sector incidents was not novel malware but exposed OT systems and weak control boundaries.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →