Water Security Quarterly: threat surface, recent incidents, defended posture

U.S. public water utilities are the most under-defended segment of federally-designated critical infrastructure. Of the roughly 50,000 community water systems in the country, the overwhelming majority serve populations under 10,000, operate with one or two IT-and-OT staff, and run a mix of legacy supervisory control and data acquisition (SCADA) equipment alongside modern internet-connected sensors and chemical-dosing controllers. The compound is a soft attack surface that has been clearly identified as a target by both foreign-state actors and non-state ransomware operators. Public reporting through the first half of 2026 (CISA and federal-partner joint advisories, state primacy-agency notifications, and operator-network field intelligence) confirms sustained interest from foreign-state-affiliated threat groups and an opportunistic ransomware ecosystem that has migrated toward water and wastewater after federal pressure tightened on healthcare and energy.

The defended posture is not theoretical. A small set of utilities and water authorities operate with materially better protection than the cohort baseline: layered network segmentation between business IT and OT, vendor-managed monitoring on the OT side, hardened remote-access posture, mandatory phishing-resistant authentication on every administrative account, and a 24/7 monitoring relationship with an outside SOC. The Water Hawk managed software suite, adapted from the Salian Defense product line, brings that posture to small and mid-size utilities at a cost structure they can absorb. The engagement is scoped per utility on assets-under-protection, integration depth, and 24/7 SOC support. The free edition of this quarterly is the public threat-surface picture; the scoped engagement is where the protection actually gets installed.

The Water Hawk managed software suite is adapted from the broader Salian Defense product line for the specific operational profile of a small or mid-size U.S. public water utility. The suite is modular: utilities can adopt the network-segmentation and OT-monitoring layer alone, or the full stack that adds managed endpoint detection, vendor remote-access brokering, mandatory phishing-resistant authentication rollout, and a 24/7 SOC relationship. The deployment is hands-on; the operator has a named engagement lead and a 90-day onboarding window during which the baseline posture is established.

Pricing is custom per utility. The drivers are assets under protection (number of OT segments, number of PLC and HMI endpoints, count of administrative accounts), integration depth (does the utility have existing SCADA historian, GIS, billing-system, and laboratory information systems that we read from), and 24/7 SOC support (the SOC relationship is the most material cost lever). Indicative bands run from the low five figures per month at smaller utilities adopting a single layer to the mid-five figures per month at the largest regional authorities running the full stack with around-the-clock SOC support. We do not publish a list price because the work doesn't scale that way; we scope, then quote, then deliver. The scoping call is no cost and no obligation.