18706_Authority_Oct

46 The Authority | October 2025 protocols. Developing well-defined policies and procedures is essential to ensure a coordinated and appropriate response when incidents occur. • Physical security controls: implementing access control systems, surveillance technologies and physical barriers helps prevent unauthorized entry and tampering. These measures form a critical layer in a defense-in-depth strategy, complementing cybersecurity efforts by reducing the risk of physical breaches that could compromise sensitive infrastructure. AI: a powerful tool with cyber implications AI is increasingly being used to optimize operations in water utilities. From reducing chemical usage to forecasting demand, AI offers data-driven insights that improve efficiency and sustainability. However, the integration of AI into OT environments introduces new cybersecurity considerations: • Data integrity: AI models rely on historical and real-time data. If that data is manipulated - intentionally or accidentally - the model’s outputs can be misleading or harmful. • Model security: AI algorithms must be protected from tampering. Adversarial inputs can trick models into making incorrect decisions, such as misclassifying sensor readings. • System complexity: AI systems often interact with multiple data sources and control systems. This complexity can obscure vulnerabilities and make troubleshooting more difficult. • Cloud dependencies: Many AI tools are cloud-based, requiring secure APIs, encrypted data transfers and robust identity management. Utilities must treat AI as part of their cyber ecosystem. This means involving cybersecurity teams in AI deployment, conducting risk assessments, supplier vetting and ensuring that AI outputs are validated by human operators. The path forward: security as a strategic imperative As digital transformation is embraced, cybersecurity must be a strategic priority—not an afterthought. This requires leadership, investment and cultural change. Boards and executives must understand that cyber risk is operational risk. A successful attack can do more than just remove access to data. With OT implications, it can now disrupt service, damage reputation and endanger public health. Cybersecurity should be integrated into strategic planning, capital projects and vendor selection. Utilities should also adopt a risk management framework that prioritizes critical assets, identifies vulnerabilities and allocates resources accordingly. This approach enables informed decision-making and helps utilities balance security with operational needs. Securing the Flow article continued from page 16.