The US needs a real plan to defend its water systems

This op-ed warns that summer cyberattacks by Iranian hackers on water systems in 12 U.S. states, together with nation-state intrusions like China’s Volt Typhoon and rapidly advancing AI capabilities that can identify zero-day vulnerabilities, expose systemic weaknesses in U.S. water infrastructure. The authors argue that technical shortfalls (about 80% lack basic cyber hygiene), fragmented regulation, and resource-limited small utilities create a high-risk environment and propose a five-part federal approach—adopting zero-trust, formal methods and code-mending, tiered support for large/midsize/small systems, and an AI-capable cybersecurity cohort—to reduce the threat to public health and national security.