Defending Critical Infrastructure in the Age of Internet-Connected Facilities

This report outlines recurring and escalating cyber threats to water and wastewater OT, detailing documented compromises of internet-facing PLCs and HMIs (including changes to PLC ladder logic and blocked operator access), exploitation via default/missing credentials and exposed VNC/cellular connections, and recent advisories about AI-assisted reconnaissance. It emphasizes the operational risks to public health and safety, the prevalence of authentication and access-control weaknesses across distributed utility environments, and recommended architectural mitigations while noting Fortinet’s OT security offerings and certifications as a solution.