The defensive capability Salian Defense offers Water Hawk customers is the same capability that protects classified facilities. The layers below are described in plain language; specific implementation, named components, and technical specifications are scoped per engagement under non-disclosure.
How engagements work
The capability layers below are not sold as off-the-shelf products. Each capability is delivered through a scoped engagement that begins with a no-cost briefing with a cleared engineer, proceeds to a written environment-specific scoping document, and ships only after both sides agree on the deliverable, the standards of record, and the price. Adoption is modular: a utility can start with a single layer (most commonly Hardware OT encryption or Threat intelligence fusion) and expand as the relationship matures. The broader posture (verified-vs-in-review on live records, citation discipline on stats, antitrust safeguards on cohort-aggregated outputs) is documented on /trust.
Operational technology encryption at the boundary
Water utility supervisory-control traffic, programmable-logic-controller communication, and remote-terminal-unit telemetry are the most exposed and least defended surfaces in the sector. Engagements at this layer deploy a hardware encryption appliance at the boundary between information-technology and operational-technology networks and at the perimeter of every remote site. The appliance encrypts every TCP and UDP packet at the binary level, with full-system latency that lands inside the operating envelope of standard water-sector control loops (IEC 61850, Modbus over TCP, DNP3). The cipher does not rely on the algebraic structures quantum-decryption algorithms target. The appliance also supports unidirectional traffic enforcement, delivering data-diode behavior with the encryption layer preserved across the boundary. Specific appliance, firmware, and integration detail is scoped per environment.
Synthetic content and insider-threat detection
Engagements at this layer install a locally-running analysis capability inside the customer environment with no external data transmission required. It identifies synthetic content, deepfake media, and machine-generated text targeting utility communications, board governance, vendor onboarding, and ratepayer interaction. It performs data-loss prevention across the categories of regulated and sensitive content that govern utility security plans and customer records. Air-gapped deployment is supported. The capability runs on standard enterprise hardware and produces forensic-quality evidence chains suitable for law-enforcement coordination. Integration with the customer's existing security-information-and-event-management platform is part of the engagement scope.
Continuous regulatory posture
Engagements at this layer stand up a continuous-evaluation capability that maps current control implementation against the standards that govern water-sector operation: the Safe Drinking Water Act, the Clean Water Act, America’s Water Infrastructure Act Section 2013, and the EPA cybersecurity guidance. The same engine, deployed inside Salian-managed sensitive-compartmented-information facilities, audits against Intelligence Community Directive 705 in real time; the water-sector deployment is the direct port of that capability. Audit cycles compress from months to days. Remediation priorities arrive as a prioritized backlog rather than as a binder. Mapping to the specific primacy agency, federal contracting vehicle, and operating standard of record is part of the engagement scope.
Air-gap-native deployment and audit
A managed orchestration plane underpins the defensive stack and allows it to be deployed, updated, monitored, and audited inside customer environments, including environments with no internet connectivity. Configuration drift is detected continuously and every configuration change carries its own audit trail as evidence-as-code. The orchestration plane reduces the operational burden on the small information-technology teams that staff most water utilities; the system runs in the background, and the team is freed to do the work it was hired to do. Whether the orchestration plane is delivered as a standalone deployment or as part of a broader stack engagement is scoped per environment.
Post-quantum readiness today
The 2035 National Security Agency Commercial National Security Algorithm Suite 2.0 deadline applies to national security systems, but the same threat surface and the same vendor-migration cost reach the water sector earlier. Salian Defense engagements include post-quantum cryptographic primitives in the deployment plan, so customers who engage now do not face a costly cryptographic migration project later. The migration is the deployment. Which primitives are deployed and how they integrate with existing key-management infrastructure is scoped per environment.
Threat intelligence fusion
The Salian Defense threat-intelligence team aggregates open-source threat reporting, government threat reporting, the Water Information Sharing and Analysis Center alert stream, and the cleared-environment-derived signal that Salian’s classified work generates. The fusion product is delivered to Water Hawk subscribers under the platform’s standard licensing terms. Customers receive the same threat picture that informs Salian’s own classified-facility defense, sanitized for the appropriate handling caveats. This is the most consequential single benefit a non-cleared water-sector operator can obtain. It is included.