Water systems, like other industrial and manufacturing facilities, depend on pumps, valves, motors, drives, relays, analyzers, process sensors, engineering workstations, operator displays and communication networks. These are physical systems, not information systems. The pumps move the water. The valves control it. The motors and drives provide power. The analyzers measure chemistry. The process sensors measure pressure, level, flow, temperature, voltage, current and other physical parameters. Programmable logic controllers (PLCs) and other controllers and drives use this information to monitor and control the physical process. This is what “makes” safe potable water.

Yet the cybersecurity community has largely defined the problem differently. The emphasis has been on protecting networks, preventing unauthorized access and protecting the data moving through those networks, because network security assumes that a compromise of the network automatically means the process is affected. That is not necessarily true, as protecting the packets is not the same as protecting the process. Those objectives are important. But they do not answer the most fundamental question: Can we trust the information being used to operate the physical process?

Process sensor considerations

Process sensors were designed as engineering devices, not cybersecurity devices. Many have no meaningful authentication, cybersecurity capabilities or cyber forensic functionality. This means that good cyber hygiene does not apply to process sensors as I discussed in presentations to the Air Force Cyber College and the Naval Postgraduate School. Yet the information the process sensors produce is treated as trustworthy throughout the control system and operator displays, even if the sensor is malfunctioning, out of calibration, compromised or otherwise providing an incorrect value. The network is still regarded as “cybersecure” because authentication works, encryption works, firewalls work. Intrusion detection works. Yet the incorrect sensor value can travel across the perfectly protected network and arrive at the human-machine interface (HMI) exactly as intended. The HMI displays the incorrect value. The operator sees the incorrect value. Cybersecurity has succeeded, and yet the operator has still been misled about the physical process.

This is a fundamental gap in today's approach to OT cybersecurity. The problem is not theoretical. As the November 2022 IEEE article, “Using Machine Learning to Work Around the Operational and Cybersecurity Limitations of Legacy Process Sensors,” documented, process sensors produced inaccurate information for reasons that have nothing to do with a network attack. This created an implicit incorrect assumption: if the network and communications are secure, the information must be trustworthy.

Can we trust the operator displays?

In 2010, Stuxnet demonstrated the fallacy of trusting the operator displays. The 2015 Ukrainian power-grid attack provides another example where the attackers did not simply compromise the corporate network and stop there. After gaining access to the utilities' control environments, they remotely operated breakers and subsequently compromised Moxa serial-to-Ethernet communications devices at substations, overwriting their firmware to interfere with communications and complicate recovery. The Moxa devices were not merely network infrastructure in the conventional IT sense; they were part of the communications path between the control system and the physical electrical equipment. Moxa serial-to-Ethernet converters are also widely used in the water industry. This attack therefore demonstrated two different consequences: manipulation of the physical process and compromise of equipment needed to monitor and recover that process. It is another indication that protecting the network does not necessarily protect the physical control system. The 2026 water sector cyberattacks have exposed the problem again and should force reconsideration of this assumption.

Federal agencies warned that malicious actors were targeting internet-facing PLCs used by water and wastewater utilities. The FBI, CISA and EPA reported that attackers had remotely accessed PLCs, changed passwords and IP addresses and, in some cases, disrupted operations. CISA reported that this activity had resulted in boil-water notices and sustained manual operations. The attacks were not simply about stealing information. They targeted equipment involved in operating the physical process. The attacks against more than 30 Minnesota water systems demonstrated that compromise of OT can manifest itself as an operational problem rather than a conventional IT breach. Federal agencies and investigators also warned that related activity was occurring across multiple states. The Clayton County Water Authority (CCWA) incident provides another example. What initially appeared to be a pump-station failure resulted in low water pressure and a precautionary boil-water advisory that was considered to be a “normal” operating failure. CCWA subsequently disclosed that it was investigating unauthorized cyber activity that may have caused or contributed to the disruption, with the investigation focusing on PLCs. The sequence is revealing control-system disruption → physical-process consequence → loss of pressure → boil-water advisory → Identification of cyber activity. The public saw a water problem; the underlying issue was a control-system problem. The physical consequence, and not the cyber indicator, is what ultimately matters to the water customer.

Suppose that an attacker does not shut down a pump but instead changes an alarm, a PLC parameter, manipulates a process value, or causes the HMI to display information that does not accurately represent the physical process. Now the problem is much harder to detect. The operator may still see a normal-looking screen. The network may report no obvious intrusion. The PLC may continue communicating. The HMI may continue operating. But the physical process may no longer be what the operator believes it is. That is why CISA's Matthew Rogers statement on August 18 is so important. He warned that attackers were modifying PLC project files to turn off alarms in ways that were not immediately apparent to operators.

Get your subscription to Control's tri-weekly newsletter.

This is not simply a network-security problem. It is a process-trust problem. The HMI cannot prove that the process is safe. This leads to a question that should be at the center of water-sector cybersecurity: How does an operator know that the information displayed on the HMI accurately represents what is happening in the physical process? Today, the answer is generally that the HMI receives information from the control system and displays it. But that is not independent verification. The HMI is part of the same digital chain that may have been compromised. If the sensor is wrong, the PLC may be wrong. If the PLC is wrong, the HMI may be wrong. If the HMI is wrong, the operator may be wrong. And if all three agree, that does not prove that the physical process is actually in the state being displayed as identified in the IEEE article.

Digital agreement is not physical truth. Boil water notices demonstrate the difference as they are the direct result of physical processes. The 2026 water incidents also demonstrate why the distinction between cybersecurity and process integrity matters as the physical process has entered a condition in which trust can no longer be assumed. That is precisely the type of problem that conventional network cybersecurity does not solve. The question is not merely: “Was the network compromised?” The more important question is: “Can we still trust what the control system is telling us about the physical process?”

Project Watershed 250: An opportunity — or a missed opportunity?

August 31, 2026, marked the launch of Project Watershed 250 as an important step toward addressing the cybersecurity challenges facing smaller and under-resourced water systems. The initiative is intended to provide utilities with cybersecurity resources, vulnerability assessments, and other capabilities, initially through a Texas pilot. But there is a danger in solving yesterday's problem. If the program primarily identifies vulnerable networks, Internet exposure, credentials, firewalls, remote access, and other conventional cybersecurity weaknesses, it may make the network more secure without answering the fundamental process question: Can the operator trust the process information?

These are not theoretical concerns. They are characteristics and potential failure modes of the physical systems on which water utilities depend. And they do not require a malicious cyberattack. Equipment failure, sensor degradation, calibration problems, communications failures, configuration errors, software problems, human error, and malicious activity can all produce incorrect information about the physical process. The consequence can be the same: The operator does not know that the information being used to make a safety decision is wrong. These issues require engineering participation which was not present at the Project Watershed kick-off.

We need a different layer of protection

Water sector security, and the security of other critical infrastructures, needs another layer of protection that does not depend exclusively on the integrity of the network, PLC, HMI, or communications path. We need to monitor the physics of the process itself. This concept has been identified in the IEEE work on legacy process sensors and in numerous actual control-system incidents. The objective should be to establish an independent ground truth against which electronically communicated process information can be evaluated. If the HMI says a pump is operating at a particular condition, can we independently determine whether the physical process is behaving as it should? If a sensor reports a pressure value, can we determine whether that value is consistent with the physical behavior of the system? If an alarm is disabled, can the physical process itself identify the abnormal condition? If a sensor value changes, can we determine whether the physical process has changed correspondingly? That is a fundamentally different cybersecurity philosophy. It does not assume that digital information is trustworthy. It verifies the digital information against the physical world.

Water utilities make water

The water industry should not measure the success of cybersecurity solely by how well it protects networks. The ultimate measure should be whether the utility can continue to safely and reliably control the physical process, whether the problem is malicious or non-malicious, and know when the information being used to control that process can no longer be trusted. The cybersecurity industry has spent decades protecting computers, networks, and data (and not always successfully as can be seen by the numerous cyberattacks continuing to date). Those things matter. But water utilities do not exist to produce packets. They exist to produce safe, potable water. The pumps, valves, drives, PLCs, analyzers, and process sensors are what make that possible. And at the foundation of all of it are the process measurements that tell operators what is happening in the physical world. If we cannot establish that those measurements are trustworthy, then we have a fundamental cybersecurity and safety gap. We need to stop asking only whether the network is secure. We need to start by asking: Is the process telling us the truth?