Cybersecurity and Water System Risk: What City Leaders Should Know By Bill Kloster Turning on the tap feels simple; however, today’s water systems are anything but. Once mostly mechanical, they now rely on connected software, sensors, and control networks. That shift improves efficiency and visibility, but it also opens the door to cyber risk. Cybersecurity is no longer just a background IT concern. It directly impacts reliability, public health, and community trust. For utility leaders, recognizing and addressing these vulnerabilities is essential to keeping water systems safe, resilient, and dependable. Cybersecurity in water systems: What it actually means Modern water infrastructure relies on computer-based technology, often called Supervisory Control and Data Acquisition (SCADA) and Operational Technology (OT) systems. These platforms direct how water is treated, monitored, and distributed. In simple terms, they support day-today operations by managing treatment processes, chemical balancing, pump controls, and distribution. Without this coordination, infrastructure could not function as intended. Cybersecurity goes beyond traditional IT environments like office networks or email. It also includes protecting the operational technology that controls physical water processes. As connectivity increases, understanding where risks exist is important for protecting operations and public safety. Why cybersecurity has become a water sector issue Water systems are not targeted because they are easy to access, but because they are essential. Disruptions create immediate, visible impacts, making these systems attractive targets for cyber threats. As digital connectivity expands across treatment, distribution, and monitoring systems, operations become more efficient and visible, but also more exposed. Cyber activity is increasingly targeting metropolitan areas of all sizes, where large-scale systems and data are valuable targets. In October 2024, American Water, which serves more than 14 million people across 14 states and 18 military installations, experienced a cyberattack that forced billing pauses, disrupted customer service, and required system isolation.