Water utilities are next. The attack surface looks exactly like food & ag.

Water and wastewater systems are critical infrastructure in the most literal sense: they have no backup. When a power plant goes offline, grid operators reroute generation. When a water treatment plant is compromised, the population it serves has no alternative supply. That asymmetry makes the sector a high-value target for nation-state actors seeking leverage and a convenient target for ransomware groups that know a utility cannot wait out an extended outage.

The WaterISAC's annual threat assessment records a 200% increase in cyber incidents affecting water and wastewater operators between 2024 and 2026. EPA and CISA issued a joint advisory citing active exploitation of internet-facing operational technology at water utilities, with specific mention of HMIs accessible without authentication and PLCs running firmware with known critical vulnerabilities. The advisory does not describe a new attack technique. It describes the same attack surface that has existed for years, now being actively used.

The water sector's challenge is structural. The United States alone has more than 50,000 community water systems. The vast majority serve small populations with small budgets and no dedicated security staff. The OT equipment at a rural water district is the same category of device as at a major municipal utility, but the rural district has no CISO, no IT team, and often no one who knows what firmware version the SCADA system is running. The attack surface per dollar of security budget is orders of magnitude higher.

The Oldsmar, Florida incident in 2021 was a warning: an attacker accessed a water treatment plant's HMI remotely and attempted to increase sodium hydroxide levels to dangerous concentrations. An operator caught it manually. The plant had no detection capability — the catch was visual, not automated. In 2026, the EPA and CISA advisory notes that similar access vectors remain open at utilities across the country. The lesson from Oldsmar was not universally applied.

The resource constraint is real. A small water utility cannot buy an OT security platform, hire a security analyst, and implement IEC 62443 in one budget cycle. What it can do is close the highest-risk exposures with the budget it has. The EPA's Water Sector Cybersecurity Baseline Controls are designed for exactly this context: a prioritized list of controls calibrated to what a small operator can implement without dedicated security staff.

The top of that list is consistent with every other OT security framework: remove internet-facing access to OT systems, change default credentials on every device, separate the OT network from administrative systems, and implement MFA on any remote access that remains. None of those require a large program or a security team. They require a decision, a maintenance window, and accountability to follow through. The gap between the advisory and the action is not technical. It is organizational.