Closing the Water Sector’s Attack Surface

What CISA confirmed in July 2026

The July 2026 campaign specifically targeted PLCs reachable directly over cellular modems, rather than behind any managed remote-access layer. Where attackers previously used blunt tactics — default-password changes, defacement messages left on HMI screens — researchers now describe a marked escalation: threat actors exfiltrating PLC project files using vendors’ own engineering software, and modifying add-on instructions to disable safety shutdowns while leaving operator displays looking normal.

That trajectory accelerated days later, when water-sector technology supplier Micro-Comm disclosed that nearly 850,000 files had been stolen — product diagrams, system architecture documentation, and customer-specific configurations. Because Micro-Comm supports engineering and remote maintenance for control systems across hundreds of utilities, that material is the kind of detail that turns generic scanning into precision-guided targeting, and that analysts warn can now be fed to AI tools to generate working exploitation scripts with far less expertise than in years past.

CISA’s core finding is not that any one utility made a unique mistake. It is that internet-exposed OT, reachable without a managed gateway in between, is now a routine and repeatable target across the entire sector.

Why water and wastewater utilities are uniquely exposed

Operational technology that predates modern security

Modbus — the protocol underlying most water treatment and distribution control systems — was designed in 1979 for isolated serial links. It has no authentication, no authorization model, and no encryption. Any device that can reach a Modbus endpoint can command it; there is no built-in way to distinguish an engineer’s legitimate setpoint change from an attacker’s. Traditional firewalls can see that traffic is moving over TCP port 502, but they cannot see what command is inside the packet — which leaves operators with two options: allow all Modbus traffic, or block it entirely. Neither is workable for a plant that has to keep running.

Distributed, unmanned infrastructure

Water systems are not one control room. They are dozens or hundreds of pump stations, lift stations, and remote monitoring points — often unmanned, often power- and bandwidth-limited, often reachable only by a technician driving to the site. That is precisely the profile CISA flagged: a PLC wired straight to a cellular modem because it was the fastest and cheapest way to get remote visibility.

Constrained budgets and lean teams

Most municipal utilities do not have a 24/7 security operations center, and many cannot add IT-style tooling that requires specialized training. A solution that adds an interface OT staff don’t understand, or that requires downtime to install, is a solution that will not get deployed — or will not get used once it is.

Why conventional IT security falls short here

• Perimeter firewalls inspect ports and packets, not industrial commands — they cannot tell a routine sensor read from a malicious write to a chemical dosing register.
• Endpoint agents cannot be installed on PLCs, RTUs, or HMIs. Many of these devices cannot run any third-party software at all.
• Active vulnerability scanning, a staple of IT security, can itself destabilize fragile legacy controllers not built to withstand it.
• Signature- and anomaly-based IT tools generate false positives that OT operators learn to ignore — functionally the same as having no monitoring at all.
• Rip-and-replace modernization is often the only “correct” fix on paper, and the least realistic one for a utility that cannot take a plant offline or fund a multi-year capital project.

These are not failures of effort. They are a mismatch between tools built for IT networks and the operational reality of a treatment plant. Closing the gap CISA identified requires security native to the control-system protocol itself, not layered awkwardly on top of it.

Mapping CISA’s guidance to action

PacketViper is agentless, protocol-aware, inline enforcement that requires no software on legacy OT devices and no maintenance window to deploy. The table below maps CISA’s July 2026 recommendations to how the platform addresses each one.

Table 1: CISA’s water-sector guidance mapped to PacketViper capabilities.

CISA recommendation (July 2026)	The underlying gap	How PacketViper closes it
Identify all internet-exposed OT assets	Most utilities have no reliable, current inventory of what is reachable from the public internet.	Passive, agentless discovery across Modbus, DNP3, BACnet, S7COMM and other OT protocols — no active scanning that could disturb sensitive controllers.
Route remote access through a secure gateway instead of connecting directly to a PLC, HMI, or RTU	Direct PLC-to-cellular-modem connections — the exact pattern CISA says attackers exploited in July — remove any inspection point.	Inline enforcement appliances sit in front of every PLC/RTU/HMI, terminating and inspecting sessions before they ever reach the controller.
Change default credentials and enforce MFA for remote access	Credential hygiene alone doesn’t stop an attacker already inside the session, or spoofing a trusted source.	Geographic and time-based behavioral controls flag and block access outside approved windows and locations, layered on top of credential and MFA policy.
Patch and update systems where supported	A large share of water-sector OT runs on decades-old, unpatchable, or vendor-unsupported equipment.	Command-level Modbus protection acts as a compensating control — enforcing which commands and values are allowed — without ever touching the legacy device.
Continuously monitor for anomalous activity	Small utility teams cannot staff a 24/7 SOC, and generic IT tools generate alerts OT operators don’t trust or understand.	Deception-based detection produces alerts with effectively no false positives to tune, delivered in formats OT operators already recognize.

Command-level Modbus protection

Rather than allowing or blocking Modbus traffic wholesale, PacketViper sits transparently in the traffic path as an agentless bridge and parses the Modbus Application Protocol header and payload to extract the unit ID, function code, register or coil address, and the specific value being written. That allows surgical policy — permitting a historian to read tank levels while blocking any external source from writing to a chemical-dosing register — without disrupting legitimate control traffic.

Table 2: A representative subset of Modbus function codes and how PacketViper’s inspection engine classifies their risk.

Code	Function	Class	Risk if unrestricted
1–4	Read Coils / Registers	Read	Low
5–6	Write Single Coil / Register	Write	State-changing — e.g. chemical dosing setpoints, valve position
15–16	Write Multiple Coils / Registers	Write	State-changing across multiple points simultaneously
8	Diagnostics	Control	Abuse risk — can force a controller into listen-only mode, a physical denial-of-service
43	Read Device Identification	Recon	Fingerprinting — used to map targets before an attack

Deployment follows a deliberately conservative philosophy — start open, narrow in. The system first runs in observation mode, learning legitimate master/slave communication patterns with zero enforcement risk. Operators then move to active policy and, finally, enforcement: dropping a single violating command while the rest of the session continues uninterrupted, or isolating a source entirely if it exceeds a write-rate threshold consistent with a flood or enumeration attack.

Built for the field: unmanned, low-power sites

A water utility’s greatest exposure sits at the edge — unmanned pump stations and treatment points, often DC-powered with limited connectivity. PacketViper’s remote enforcement appliances are DIN-rail mounted, low-power, and equipped with hardware bypass, so if the device loses power or faults, physical operations continue uninterrupted rather than failing closed. Enforcement continues locally even without a live connection back to a network operations center, and results — a block, an isolation — propagate automatically once connectivity is restored.

For a utility system with dozens or hundreds of remote sites, a policy authored once and pushed identically to every appliance — regardless of which physical path traffic takes — turns a fragmented, site-by-site security problem into a single, centrally managed one.

Regulatory context: AWIA, EPA, and the state patchwork

Under America’s Water Infrastructure Act (AWIA) Section 2013, community water systems serving more than 3,300 people must complete a risk and resilience assessment treating cyberattacks as a “malevolent act,” develop an emergency response plan, and recertify both every five years. AWIA does not prescribe a specific control set, but EPA enforcement activity has repeatedly cited basic failures — default passwords, shared logins, access left open for former employees — as evidence that an assessment was superficial. EPA’s 2023 attempt to fold cybersecurity directly into state sanitary surveys was challenged in court and withdrawn, shifting meaningful enforcement to the state level, where New Jersey, California and others are already layering requirements on top of the federal floor.

The American Water Works Association (AWWA), partnering with EPA, CISA and NIST, has published guidance built around the NIST Cybersecurity Framework: identify exposure, secure remote access, eliminate unnecessary internet-facing devices, and implement MFA as immediate steps, followed by a documented risk management and incident response program. Continuous monitoring, an automated audit trail, and command-level enforcement generate the kind of evidence — of both control and monitoring — that these assessments and recertifications increasingly require, whether reviewed by EPA, a state regulator, or an internal governance board.

The business case

Because PacketViper deploys inline at the boundary and at remote sites, its impact shows up in cost lines beyond the security budget. Deployments have typically reduced firewall traffic load by 30–70% within 90 days, restoring capacity on existing perimeter hardware and, in many cases, avoiding or delaying an expensive forklift firewall upgrade. That same traffic reduction — less noise, fewer events to triage — has driven reported reductions of more than 30% in the cost of volumetrically priced managed SIEM and SOC services for some clients.

For remote and unmanned facilities, running detection and enforcement on ruggedized field appliances removes the need for a dedicated on-site industrial server and its acquisition, deployment, patching and monitoring costs — a material line item multiplied across dozens or hundreds of pump and lift stations. And because contextual filtering is false-positive free by design, utilities that have previously failed a penetration test with no cost-effective remediation path have used PacketViper as a documented compensating control, closing the finding without a capital project.

Case in point: Oldsmar, Florida

In February 2021, an attacker reached a water treatment facility in Oldsmar, Florida through remote access software enabled during the shift to remote work — software that lacked multi-factor authentication, geographic controls, and behavioral monitoring. The attacker raised the sodium hydroxide (lye) setpoint from 111 parts per million to 11,100, a concentration dangerous to public health. The change was caught and reversed by an operator who happened to notice the mouse moving on screen, roughly 30 seconds after the fact.

Oldsmar remains the clearest illustration of the gap CISA is now asking every water utility to close: a single point of unmanaged, unauthenticated remote access to a safety-critical control point, with detection resting entirely on a human happening to be watching at the right moment. Geographic and behavioral access controls, combined with command-level enforcement that would have flagged or blocked the out-of-range setpoint value itself, close that gap by design rather than by chance.

Frequently asked questions

Conclusion

CISA’s July 2026 advisory is not a warning about a single utility’s mistake. It is a statement that the entire sector’s pattern of internet-exposed OT is now a routine target. Closing that gap does not require replacing control systems that have run reliably for decades, and it does not require a security operations center the utility cannot staff or afford.

It requires security that speaks the same protocol as the control system it protects, that enforces policy inline without an agent, and that keeps working at the edge even when connectivity does not.

Sources

• Over 100 US water utilities had cyberattacks in July, says CISA — SC Media
• CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks — SecurityWeek
• More than 100 water systems were hit in July cyberattacks — The Register
• EPA Water Cybersecurity Mandate: A Practical Guide — HydroKnowledge
• Cybersecurity Guidance — American Water Works Association (AWWA)

See how your utility’s exposure compares

Walk through a no-cost assessment of your remote sites against the pattern CISA described in July 2026.

Book a Demo Download the PDF ↓

← All white papers