Summary
Cyberattacks targeting water systems across multiple states are giving utilities a reason to act. What water leaders can do now to protect their systems—before the next cyber incident.
Cybersecurity After the Attack: What Utilities Can Do Now to Protect Their Systems
Cyberattacks targeting water systems across multiple states have given utilities a reason to act.
In the first three installments of this series, we looked at cyber incidents this summer and the questions (Part 1 and Part 2) utilities need to ask now about their own cybersecurity posture.
Now comes the practical question: What can a utility do to reduce its risk?
United Systems Chief Information Security Officer (CISO) Darren Duncan says you won’t get immunity from a single product, service, action, or checklist.
“Cybersecurity is an ongoing process,” says Darren. “It requires technology, policies, monitoring, training, and a plan for responding when something goes wrong.”
For some utilities, that means managing cybersecurity internally. For others, it’s working with a managed IT or cybersecurity provider. And for many, it’s likely a combination.
“The important thing is making sure the necessary protections are in place,” Darren says.
Start with the basics: know what’s connected
You can’t protect what you don’t know about.
It’s a simple, but BIG lesson utilities need to learn after recent cyberattacks.
Your organization needs to maintain an accurate inventory of hardware, software, network infrastructure, and operational technology. That includes knowing which devices can communicate externally, which systems have remote access capabilities, and who has permission to access them.
“Every unnecessary connection creates another potential avenue for an attacker,” Darren says, emphasizing the importance of keeping systems off public IP addresses whenever possible.
He recently discussed this issue with local NBC affiliate WPSD-TV. Watch Darren’s interview here.
Build layers of protection
There’s no single “magic bullet” when it comes to cybersecurity.
“Effective protection comes from layers,” Darren stresses. “Each layer addresses a different part of the risk.”
- Firewalls can help control network traffic and prevent movement between systems.
- Endpoint protection can help identify malicious activity.
- Multifactor authentication can make stolen credentials less useful to attackers.
- Backups can help a utility recover when systems are compromised.
- Monitoring can help identify suspicious activity before it becomes a larger problem.
- Employee training can help stop an attack before it starts.
“Utilities don’t just store customer information. Their networks likely connect to systems that monitor and control pumps, valves, treatment processes and other physical infrastructure.”
Keep systems patched, and keep watching them
Cybersecurity isn’t a “set it and forget it” job.
“Software vulnerabilities are discovered continually. Attack techniques change. Employees join and leave organizations. Vendors gain and lose access. Equipment ages,” Darren says.
“That means utilities need a process for keeping systems updated and watching for signs that something isn’t right.”
United Systems Managed IT services, for example, are designed around proactive management rather than waiting for something to break. That can include monitoring systems, managing patches and updates, maintaining equipment, and providing access to IT expertise when issues arise.
For utilities that don’t have the staff or expertise to perform those functions internally, outsourcing some (or all) of that work can provide yet another layer of support.
But regardless of who performs the work, someone must be watching.
CAPTION (Above): United Systems CISO Darren Duncan presents during our 2026 User Conference in
Bowling Green, KY.
Don’t overlook the people behind the technology
Technology is only part of the equation.
“If employees aren’t trained to recognize phishing attempts, suspicious requests, unusual login activity, or other warning signs, you’re still vulnerable,” Darren says. “That’s even if you have sophisticated security tools in place.”
Cybersecurity awareness should be part of your organization’s regular operations, not a once-a-year training exercise that employees complete and immediately forget.
Your people can be one of your greatest cybersecurity defenses. (I wrote about that, too!)
Have a plan for when prevention fails
Even the best-protected utility should plan for the possibility an attacker gets through.
Utilities should know:
- Who makes the decisions during a cyber incident?
- What systems can be taken offline?
- What manual processes can keep critical operations running?
- How quickly can systems be restored from backups?
“A response plan that’s never been practiced may look good on paper but fall apart when employees are dealing with a real incident,” Darren says.
“Those plans should be tested—you can’t just write them down.”
Where does United Systems fit in?
This is where United Systems’ Managed IT and Security+ services can provide real value.
Darren explains that Security+ is designed specifically to help utilities strengthen their cybersecurity planning and protections: “It’s built around the NIST cybersecurity framework and business-specific CIS controls, with a support team that includes professionals holding a variety of security and auditing certifications.”
That expertise can help utilities evaluate their current environment, identify weaknesses, and develop a more proactive approach to cybersecurity.
If you work with another managed IT provider, ensure that cybersecurity is treated as an ongoing strategy, not simply another item on their IT checklist.
Cybersecurity is a moving target
Utilities will continue adding connected devices. Remote access will continue to play a role in operations. Automation will continue to increase. Data will continue to move between systems, people, and locations.
All that technology can make utilities more efficient, responsive, and resilient—but they also need to be protected.
In 2026, cybersecurity can’t be an afterthought. It must become part of how your utility operates.
Ready to reduce friction across operations?
Coordinate billing, payments, customer service, metering, work orders, and operational workflows through utility-focused technology and support services. Talk with our team to learn how United Systems supports utilities through technology, operational services, metering, customer service, and workflow management.
