Rocky faced Clubber—and he lost the fight.

Utilities faced cyber-attackers this summer and thankfully walked away from a knockout.

But there will be a next time. (I talked about what comes next for utilities in the first post in this cybersecurity blog series.)

For those familiar with the “Rocky” franchise, you know his loss to Clubber isn’t where the third movie ends.

3. What improvements can we make to strengthen our security posture?

Once your utility identifies its vulnerabilities, like Rocky did after his loss to Clubber, it’s time to act… before the next cyber match.

One improvement deserves particular attention: segmentation.

Darren says utilities need a security layer between their critical OT and the outside world.

“On these specific kinds of platforms, you’re talking about something that would affect tens of thousands of people in the immediate area, when you’re talking about water systems, gas systems, electric systems, whatever the case may be. So very, very important to have some layer of security there. And the most general segmentation layer would be to put a firewall in.”

If an attacker gets access to one part of your system, you don’t want them to move freely into others. That’s especially important for utilities whose networks move data but are also connected to equipment controlling physical processes.

Darren urges additional improvements, like:

• Implementing multifactor authentication where appropriate
• Updating outdated software and equipment
• Reviewing third-party vendor access

And remember, Rocky beat Clubber by going back to the basics. He trained for months, away from the outside world, with no fancy equipment or big budget required.

If only it were that simple in the water industry.

Many of the upgrades necessary to modernize water infrastructure aren’t just costly, they can take years to implement.

But cybersecurity improvements don’t have to happen all at once.

“A risk assessment can help utilities prioritize changes that can have the greatest impact and develop a practical plan for addressing them over time,” says Darren.

CAPTION (Above): United Systems CISO Darren Duncan presents during our 2026 User Conference.

4. Do we have the proper cybersecurity policies in place?

Technology isn’t the only critical tool in the cybersecurity fight.

Rocky had a guide in Apollo Creed, the boxer he beat in the first two movies. He ultimately befriends and trains Rocky to take on Clubber a second time… and win!

Utilities need guidance, too. Darren says clearly documented policies should govern areas like:

• Password and access management
• Remote access
• Data backup and recovery
• Vendor access
• Security awareness training

“Policies establish clear expectations for everyone—employees, contractors, and vendors—and provide a framework for responding when something goes wrong,” Darren says.

But policies also need to keep pace with the threat environment. Rocky couldn’t train to fight Clubber in the same way he trained to fight Apollo in the first two movies of the franchise. The environment and threat changed, so Rocky had to change.

“The cybersecurity landscape facing utilities today is NOT the same one that utilities faced five or 10 years ago,” explains Darren.

“Threats evolve. Technology changes. Regulatory expectations adjust. Your utility’s policies should be reviewed and updated at the same pace.”

5. Who is auditing our policies to make sure they’re actually being followed?

Policies sitting in a binder, or buried in a shared drive, don’t protect utilities.

People make sure those policies are followed.

“Utilities should have a process for regularly reviewing cybersecurity practices, identifying gaps between policy and reality, and verifying that corrective actions are completed,” says Darren.

Depending on the utility’s size and resources, that might look like internal reviews, third-party cybersecurity assessments, penetration testing, or other forms of auditing.

The important part is accountability:

• Who is checking?
• What are they checking?
• How often are they checking?
• What happens when they find a problem?

Hey, even Rocky needed someone to hold him accountable during training! (RIP Mickey and Apollo)

Don’t wait for the next cyber punch to knock you out!

The recent attacks on water systems across multiple states are a wake-up call. 

So was Rocky’s shocking loss to Clubber after his meteoric rise to heavyweight champion.

But neither was really a shock. Both were the result of complacency. And both proved that failure is very possible, with very real consequences. But of course, failure can be the best teacher.

It taught Rocky that training is critical. United Systems’ IT experts say utility training starts with asking the right questions.

Next comes action.

In the final installment of this blog series on critical infrastructure and cybersecurity, I’ll look at what utilities should do now to protect their systems.