Water infrastructure is critical to modern society, yet it is becoming increasingly vulnerable to cyber threats as systems become more digitised. From ransomware attacks to attempted breaches of operational technology, risks in the water sector are no longer hypothetical – they are growing in frequency and impact.

Research from Microsoft, in collaboration with the Cyber Readiness Institute (CRI) and the Center on Cyber Technology and Innovation (CCTI), highlights that pairing practical training with hands-on support can significantly improve cyber readiness. Following a successful pilot programme, this approach is now being rolled out more widely, giving utilities ongoing access to the tools and guidance needed to strengthen resilience and better protect the communities they serve.

The unique cybersecurity challenges facing water utilities

Water utilities face a distinct set of challenges that make cybersecurity particularly difficult to implement:

• Legacy Operational Technology (OT)

Many systems were not designed with cybersecurity in mind. SCADA and industrial control systems often lack modern protections, making them vulnerable to exploitation.

• Limited Resources

Smaller and mid-sized utilities frequently operate with constrained budgets and minimal dedicated cybersecurity personnel.

• Fragmentation Across the Sector

With thousands of independent water providers, standardisation is limited, making it harder to implement consistent security practices.

• Competing Priorities

Operational continuity, safety, and regulatory compliance often take precedence, leaving cybersecurity under-resourced.

Why traditional approaches aren’t enough

Historically, efforts to improve cybersecurity have focused on:

• Frameworks and compliance standards
• Written guidance and best practices
• One-off training sessions

While these are important, they often fail to translate into real-world improvements.

The core issue is implementation.

Many utilities understand what needs to be done, but lack the time, expertise, or capacity to execute effectively.

The case for hands-on cybersecurity support

A more effective approach is emerging: hands-on, practical support embedded within organisations.

Rather than simply advising, this model focuses on actively helping utilities implement cybersecurity measures.

What Hands-On Support Looks Like:

• Guided implementation of security controls
• Real-time coaching and mentoring for staff
• Tailored action plans based on specific infrastructure
• Ongoing support to ensure progress is sustained

This approach shifts cybersecurity from theory to practice.

Why hands-on support works

• It Bridges the Implementation Gap – Hands-on support helps teams move from awareness to action, ensuring that recommended measures are actually deployed.
• It Builds Internal Capability – Instead of outsourcing knowledge, it develops in-house skills, creating long-term resilience.
• It Adapts to Real-World Constraints – Every utility operates differently. Practical support accounts for operational pressures, legacy systems, and resource limitations.
• It Drives Accountability and Momentum – Ongoing engagement ensures that cybersecurity initiatives don’t stall or fall behind competing priorities.

Strengthening cyber resilience across critical infrastructure

Improving cybersecurity in the water sector is not just about individual organisations – it’s about protecting national infrastructure.

Effective strategies include:

• Collaboration between public and private sectors
• Sharing threat intelligence and best practices
• Providing accessible tools and resources for utilities
• Scaling hands-on support programmes across regions

Governments and industry bodies are increasingly recognising that active support models are essential to raising baseline security levels across the sector.

The role of engineering and operations teams

Cybersecurity in water utilities is no longer confined to IT departments.

Engineering and operational teams play a central role in:

• Managing and securing control systems
• Maintaining infrastructure resilience
• Implementing and monitoring security measures in OT environments

As a result, cybersecurity is becoming a core engineering responsibility, particularly in environments where digital and physical systems intersect.

A more practical approach to cybersecurity

The future of water sector cybersecurity will depend on moving beyond compliance-led approaches and investing in practical, hands-on support. As cyber threats continue to grow in both frequency and sophistication, real progress will come from embedding cybersecurity into day-to-day operations and building capability within organisations themselves.

Ultimately, resilience is driven by action, not just awareness. By focusing on real-world implementation and supporting teams on the ground, utilities can strengthen their defences and better protect the essential services communities rely on.