Critical Infrastructure Vulnerability Assessment: Water System Digitization and Cyber Resilience in Climate-Stressed Regions

Executive Summary

Aging water utility SCADA and PLC architecture converts climate-induced emergency operations into a force multiplier for hostile actors: when utilities shift to manual or degraded-mode operation during drought rationing or heat crises, the administrative access controls and remote monitoring protocols that normally constrain unauthorized commands are frequently suspended or bypassed, widening the exploitable attack surface precisely when operational resilience matters most. The FBI and EPA confirmed on July 30, 2026 that water and wastewater utilities in at least seven states reported cyber intrusions beginning July 27, with operational effects including flooding and pressure loss. As of August 4, more than 30 Minnesota systems were confirmed compromised, with Michigan reporting nine additional incidents. These attacks targeted Rockwell Automation MicroLogix 1100 and 1400 PLCs that remained internet-facing, a configuration the Cybersecurity and Infrastructure Security Agency's April 2026 advisory had warned against. The structural underpinnings are what this follow-up addresses: climate stress and resource constraints do not merely coincide with cyber risk, they amplify it through specific, traceable mechanisms.

• Water utility OT operators: Treat any emergency rationing protocol that requires expanded remote access as a mandatory cybersecurity review trigger; do not grant new cellular modem or VPN pathways without segmentation review.
• Risk officers at municipal insurers and bond rating agencies: The July-August 2026 incidents establish that pressure loss and flooding from PLC compromise are now confirmed operational consequences, not theoretical ones; revise coverage and credit assumptions accordingly.
• State-level emergency management directors: Federal coordination from CISA's CI Fortify program is nascent; build offline-capable manual operations protocols for water systems now, before a concurrent heat emergency and cyberattack require them simultaneously.

Climate-induced demand spikes and cyber exploitation of emergency-mode water controls are becoming concurrent threats, and the operational protocols designed to manage the first are creating the conditions for the second.

The Attack Surface That Emergency Operations Open

The cybersecurity posture for US water utilities, to the extent one exists, presupposes normal operating conditions: operators at workstations, network traffic monitoring active, remote access confined to credentialed accounts on known devices. Emergency rationing protocols disrupt every one of these assumptions.

When a water utility declares a drought emergency or activates demand-reduction protocols in response to a heat event, operational tempo increases sharply. Operators in small systems, which the National Rural Water Association estimates number approximately 50,000 community water systems nationally, frequently cover multiple facilities with two or three staff members. Cybersecurity Dive's reporting on the DEF CON Franklin program quotes one rural utility manager: running a city of 1,500 people with a team of two or three means the focus is keeping water moving, not monitoring network logs. Under those conditions, the cellular modem installed by a third-party integrator for convenience, connecting a field pump station to a central dashboard, becomes the path of least resistance for an adversary.

The FBI and EPA July 30 advisory specifically warned that attackers altered IP addresses and changed passwords on targeted PLCs, a sequence that locks out operators and forces manual fallback. Markon Solutions' reporting documents that in Minnesota, facilities that had physically locked sluice gates to manual mode before the attack were protected from remote actuation; those that had not were exposed. This is the asymmetry that climate emergency operations create: the same remote access that lets an understaffed utility monitor distributed pump stations during a rationing event is the same channel that CyberAv3ngers exploited. When operators are managing a supply crisis, adding network segmentation review to the task list is not realistic without pre-existing protocols.

The FBI advisory identified Rockwell Automation MicroLogix 1100 and 1400 series as the primary targeted hardware. CISA's April 2026 advisory AA26-097A and its July 22 update documented Iranian-affiliated actors using Rockwell's own Studio 5000 Logix Designer software, Schneider Electric's EcoStruxure Control Expert, and Siemens' TIA Portal to connect to misconfigured controllers. LevelBlue's technical review notes that meaningful operational disruption does not require advanced ICS malware when legitimate engineering tools and insecure configurations provide sufficient access. The University of Hawaii ICS Security program's February 2026 Senate testimony characterized this as a maturity gap across the sector, not an isolated case.

Resource Constraints As A Structural Amplifier

The US water sector's funding profile constrains cybersecurity investment in ways that are structurally distinct from other critical infrastructure. The American Society of Civil Engineers has documented staggering maintenance deficits across water and transportation networks, with older legacy assets suffering from chronic underinvestment and poor condition, per RAND's critical infrastructure threat survey. This translates directly into cybersecurity posture: a utility that has deferred pipe replacement for two decades has not been building OT security capability either.

DEF CON Franklin's research, shared with Cybersecurity Dive, found that free cybersecurity services were "free like a puppy," requiring upfront purchase of expensive devices to unlock free software licenses, or free monitoring systems requiring costly security consultants to interpret output. Small utilities could not afford to accept the free help. This resource constraint is not an accident of policy; it is a structural consequence of how US water utilities are financed, through local rate-payers in small jurisdictions with limited tax bases, constrained borrowing capacity, and regulatory environments that prioritize water quality compliance over OT security.

Climate pressure compounds this directly. Brookings research documents that Safe Drinking Water Act health-based violations increased 47.8 percent from 1982 to 2015, and that the country's lakes, rivers, and streams face mounting contamination challenges. RAND's urban water security work finds that population growth and aging infrastructure leave systems vulnerable to climate events that historically caused little stress. When a heat event forces a small utility into crisis management mode, cybersecurity is not a competing priority: it disappears from the priority stack entirely.

Short-term gain, long-term cost: Remote access installations by third-party integrators solve a real operational problem, providing real-time visibility into distributed pump stations without the cost of on-site staffing. But the RAND infrastructure resilience framework and DHS ICS-CERT documentation both establish that the resulting unsegmented cellular gateways create persistent, undocumented attack surface. The operational convenience benefit is real; the security liability accrues silently and is only discovered when an adversary exploits it.

The geopolitical and infrastructure dimensions of this situation are mutually reinforcing. CISA's CI Fortify program, reported by Cybersecurity Dive, explicitly shifts its messaging from risk reduction to harm reduction, asking utilities: "Assume that you're compromised. How do you make sure critical services continue?" This framing, from DHS Assistant Secretary Joseph Alm, reflects a policy judgment that closing the vulnerability gap is not achievable within current resource and regulatory constraints. The burden of that gap falls unevenly: small, rural, and financially stressed utilities are the ones least able to implement even basic compensating controls.

Climate Rationing Protocols And The Authentication Collapse Problem

The specific mechanism through which emergency rationing protocols create authentication and access control weaknesses deserves granular treatment. Under normal operations, a water utility's SCADA system enforces defined access levels: operators at the local HMI have one permission tier, remote engineers connecting via VPN have another, and most PLCs are not reachable from outside the OT network at all. Emergency operations erode all three boundaries simultaneously.

First, demand spikes during heat events force utilities to bring previously offline pump stations online quickly, often connecting them through whatever communications path is available, including cellular modems installed by integrators for occasional maintenance access that were not originally intended for operational use. The RAND and DHS documentation on the Internet of Things in industrial settings establishes that as connectivity expands within industrial control sectors, the attack surface grows commensurately, but basic cybersecurity protections such as firewalls and intrusion detection systems are frequently not integrated. A modem installed for monthly pump maintenance becomes a continuous operational link during a heat emergency.

Second, manual fallback operations require operators to make direct connections to PLCs that are not normally networked at all. CISA's advisory documentation notes that the absence of protocol-aware inspection in water and wastewater environments means that traffic on these emergency connections is not analyzed for anomalous command sequences. An adversary who has pre-positioned on the network, achievable through the cellular modem pathway without the operator's knowledge, can issue commands through these emergency connections that appear operationally normal.

Third, emergency staffing protocols reduce the number of personnel monitoring network activity. Dragos's water sector OT security framework identifies continuous OT asset visibility and monitoring of SCADA communications as the foundational defensive capability; during a crisis, the operators responsible for that monitoring are typically re-assigned to operational response. The DEF CON Franklin program found that rural utilities often lack the staff to monitor logs even under normal conditions. Under emergency rationing, that monitoring gap widens.

The case of AI-assisted intrusion documented by Dragos in January 2026, where an unidentified threat actor used Claude AI to navigate OT assets at a municipal water and drainage utility in Monterrey, Mexico, adds a forward-looking dimension. Dragos researchers identified this intrusion as part of a broader campaign against Mexican government organizations between December 2025 and February 2026. Capability without confirmed intent: the AI-assisted OT navigation capability Dragos documented in Mexico has not yet been attributed to Iranian actors in US water system intrusions, but the Iranian-affiliated campaign's demonstrated willingness to use legitimate engineering tools suggests that AI-assisted target reconnaissance is a plausible next-step capability, not a distant one.

Counterarguments

1. The climate-to-cyberattack causal chain may be overstated: The July 2026 attacks targeted internet-exposed PLCs regardless of whether those utilities were under climate stress or emergency rationing protocols. The Markon Solutions technical analysis does not establish that emergency operations mode was active at the affected Minnesota utilities at the time of the intrusion. If the PLCs were continuously internet-exposed under normal operations, then climate conditions are coincidental context, not a causal amplifier. This is a material distinction: if climate stress does not mechanically increase attack surface, the risk correlation central to this assessment weakens significantly and the "rationing protocol as vulnerability" thesis requires substantially more empirical grounding from post-incident analysis.

2. The Iranian restraint assumption may not hold for affiliate actors: Our August 5 assessment and this follow-up both assume that Iran's strategic objective, imposing bounded costs below the kinetic threshold, constrains escalation to contamination events. But as Markon Solutions' analysis notes, had the sluice gate not been physically locked in manual mode, remote actuation of physical infrastructure was technically feasible. The restraint may be less a deliberate calibration than an artifact of incomplete situational awareness on the attacker's part. An affiliate group, or a misconfigured automated script running against a PLC with real-time actuation capability, could cross the contamination threshold without a deliberate decision to do so. The Scenario B probability, which we maintained at approximately 30%, may be underweighted for exactly this reason.

3. The DEF CON Franklin and CISA CI Fortify programs represent a defensive response whose efficacy this assessment cannot yet evaluate: The evidence base available as of August 9, 2026 documents the attack landscape and the structural vulnerabilities, but it does not contain rigorous outcome data on whether CI Fortify, DEF CON Franklin engagements, or EPA enforcement actions have materially changed posture at any utility. If these programs have produced meaningful improvements at the small-utility tier, the attack surface may be narrower than the structural evidence suggests. Absence of evidence of improvement is not evidence of no improvement; the Cybersecurity Dive reporting acknowledges that some Franklin-engaged utilities have improved their posture, even if the aggregate picture remains weak.

Indicators To Watch

Near-term watch list: (1) CISA CI Fortify offline operations pilot enrollment data, expected Q4 2026, will be the first empirical test of whether emergency manual operations planning is scaling to small utilities; (2) EPA mandatory cybersecurity rule for water systems, stalled in regulatory review as of August 2026, any Federal Register action in Q3-Q4 2026 would materially change the voluntary-compliance baseline underpinning this assessment; (3) Dragos DISC conference proceedings, November 4-6, 2026, are expected to include additional technical detail on the July campaign TTPs and the AI-assisted Mexico intrusion, which would either confirm or disconfirm the AI-assisted reconnaissance hypothesis.

Decision Relevance

Scenario A (~55%): Sustained disruption-only campaign continues through Q4 2026, with scope creeping to additional states but no water quality event. Our August 5 Scenario A at 55% is confirmed by the expanded seven-state footprint and Michigan incidents, and we maintain that probability. If you operate a water utility or municipal OT infrastructure, the window to implement the specific cellular modem audit that would have blocked the Minnesota intrusion vector is now, not after the next incident; commission an independent OT asset inventory that explicitly surveys third-party integrator installations including cellular gateways, not just internally documented devices. If you are a risk officer at a firm providing water utility equipment or integration services, your customers face mandatory federal advisory compliance pressure and increasing regulatory scrutiny; pre-positioning compliance advisory services now converts a liability into a revenue opportunity.

Scenario B (~30%): An affiliate actor or misconfigured automated script produces a water quality event at a US facility before end of 2026, either by crossing the contamination threshold without deliberate intent or through loss of situational awareness by the controlling actor. If you are a state or local emergency management official, the Markon Solutions documentation that manual-mode physical locks prevented remote actuation in Minnesota should be immediately translatable into an emergency directive: require all water utilities in your jurisdiction to verify that automated valves and dosing systems can be physically isolated from remote actuation before the next heat event activates emergency protocols. If you hold positions in cyber insurance covering municipal water infrastructure, this scenario represents the first confirmed pathway from cyber intrusion to physical consequence; review policy language for exclusions covering OT-triggered physical damage and adjust pricing for small-utility coverage accordingly.

Scenario C (~15%): US-Iran escalation, whether from the broader Middle East conflict dynamic or direct retaliation for US cyber operations, triggers deliberate crossing of the water contamination threshold as a coercive instrument. If you advise national security policy or hold defense-adjacent market positions, the RAND and Brookings documentation on federal coordination gaps is the key variable; CISA's own messaging has shifted from risk prevention to harm reduction, which reflects an institutional acknowledgment that prevention is not fully achievable under current constraints. A contamination event under these conditions would require state-level public health response faster than federal coordination can deliver; engaging state emergency management leadership now on pre-staged public communication protocols and alternative water supply logistics is the preparatory action with the highest near-term return.

Expert Integration

Expert Consensus Assessment

Government, academic, and cybersecurity industry experts agree that US water sector OT is structurally underprotected and that Iranian-affiliated actors represent the current primary threat to that sector. Disagreement centers on whether voluntary advisory compliance can close the gap or whether mandatory regulatory standards are required, and on how quickly small utilities can implement compensating controls given structural resource constraints.

Expert Disagreement Areas

• Regulatory approach: Senate EPW Committee testimony (February 2026) and GAO (2024) call for mandatory cybersecurity standards for water utilities; EPA has resisted mandatory rules citing administrative burden on small systems. DEF CON Franklin's findings support GAO's position that voluntary uptake is insufficient.
• Remediation timelines: CISA's CI Fortify program frames resilience as the near-term goal given that prevention is not fully achievable (DHS Assistant Secretary Alm, Cybersecurity Dive, 2026), while Dragos argues that OT asset visibility is achievable and is the foundational prerequisite that most utilities have not yet completed.
• Climate-cyber linkage: RAND's urban water security research documents the infrastructure vulnerability pathway through aging assets and siloed decision-making, but does not directly address how emergency operating protocols change the cyber attack surface; that causal link is assessed in this article as likely but not yet empirically confirmed in peer-reviewed literature.

Systematic-Expert Alignment

Alignment: MIXED

This assessment aligns with expert consensus on the severity of the structural vulnerability and on the Iranian actor's demonstrated capability. It diverges by proposing a specific causal mechanism, emergency rationing protocols as an attack surface amplifier, that expert literature has documented individually (resource constraints, aging infrastructure, expanded remote access) but has not yet synthesized into a testable operational hypothesis. The climate-cyber linkage in this article is assessed as likely, not confirmed; independent empirical validation would require post-incident analysis from a concurrent climate emergency and cyber intrusion event, which has not yet been documented.

• The July-August 2026 attack campaign is still active and forensic analysis is incomplete; attribution has not been formally confirmed by DOJ as of August 9, 2026, meaning the Iranian actor assumption underlying this assessment could require revision if technical indicators point to a different actor cluster.
• The cellular modem gateway vector documented by Markon Solutions is drawn from a single-source technical report published August 7, 2026; independent corroboration from CISA, FBI, or a second technical firm would strengthen the finding materially before it is treated as a confirmed sector-wide attack vector. This is a single-source dependency, and the finding should be treated as provisional pending corroboration.
• No confirmed concurrent case of a climate emergency and a cyber intrusion producing co-occurring physical consequences exists as of this publication date; the climate-as-amplifier mechanism is assessed from structural evidence and analogical reasoning, not direct observation.
• The scope of undocumented cellular modems in US water utility OT networks is unknown; no federal inventory program exists, and the Markon Solutions account is the only published documentation of this specific vector in the July 2026 campaign. The true scale of this exposure could be substantially larger or smaller than current evidence supports.
• Rural and small utility cybersecurity posture is documented primarily through advocacy and program reports from DEF CON Franklin and NRWA rather than systematic auditing data; survivorship bias is possible in that utilities engaging with these programs may already have above-average security awareness relative to those that do not.