By Franklyn C. Adams,
Timehri Networks
Water and wastewater utilities often think about cyber risk in terms of the assets closest to the physical process.
The focus usually falls on PLCs, RTUs, HMIs, SCADA servers, and engineering workstations. That focus is understandable. These systems help control pumps, valves, chemical feed, treatment processes, tank levels, pressure zones, and telemetry across remote facilities.
But recent cybersecurity developments point to a growing and important reality:
attackers do not always begin with the PLC.
Increasingly, they begin with the systems that are supposed to protect, manage, or support access to the environment.
They begin with the VPN gateway.
They begin with the remote support appliance.
They begin with the firewall.
They begin with the centralized security-management platform.
In other words, they begin with the security infrastructure.
That shift matters because many utilities have spent years improving perimeter defenses, remote access, and vendor support connectivity. Those investments remain necessary. But if those same tools are compromised, they can become a trusted pathway into the environment they were meant to defend.
For water utilities, that is not just an IT problem.
It is an operational risk.
Security Tools Are Increasingly High-Value Targets
Recent guidance and advisories reinforce the same lesson from multiple directions.
On October 15, 2026, BeyondTrust disclosed BT26-05, a critical vulnerability in Remote Support that could allow a remote attacker to perform file operations on an affected appliance. BeyondTrust stated that the issue affected Remote Support versions up to 26.2.3 and that self-hosted customers needed to patch, while SaaS customers had already been updated.
BeyondTrust also stated that a suspected China-nexus espionage actor had exploited the vulnerability as a zero-day. The company’s October 16 follow-up explained that exploitation occurred on August 29, 2026, against both a BeyondTrust-hosted Remote Support instance and a self-hosted customer appliance.
This matters because a remote support appliance is not a passive system.
It often sits in a position of trust.
It may broker access to servers, workstations, and sometimes the systems that support SCADA administration and troubleshooting. If that appliance is compromised, the attacker may inherit visibility, access pathways, and credentials that were originally intended for legitimate support and maintenance.
That is why water utilities should stop thinking of remote support platforms as ordinary IT utilities.
They are privileged access infrastructure.
The Same Risk Extends Beyond One Vendor
The broader concern is not limited to one product or one company.
Federal guidance issued this year warns that edge devices such as load balancers, firewalls, routers, and VPN gateways are increasingly attractive targets for nation-state actors because they provide a way to gain network access, maintain persistence, and compromise sensitive systems.
That observation aligns with what defenders have already seen repeatedly across critical infrastructure.
When a firewall, VPN appliance, or remote support platform is compromised, the attacker does not need to break into the OT environment the hard way.
The trusted connection may already exist.
The device may already:
- authenticate remote users,
- store administrative credentials,
- enforce segmentation policy,
- broker vendor access,
- manage VPN sessions,
- or connect multiple remote sites.
In many environments, these systems also sit at key trust boundaries between enterprise IT, industrial DMZs, and control-system networks.
That means compromise of security infrastructure can do more than expose data.
It can weaken or bypass the very controls meant to separate business systems from operational systems.
Why Water Utilities Should Care
Water utilities are especially exposed to this problem for several reasons.
First, many utilities depend heavily on remote access.
Smaller and midsize utilities may not have every needed skill in-house at all times. They rely on SCADA integrators, equipment vendors, support engineers, and outside specialists to troubleshoot problems, maintain software, review alarms, and assist with recovery.
Second, many utilities operate distributed infrastructure.
Pump stations, lift stations, tanks, wells, booster stations, and treatment facilities may be spread across large geographic areas. That creates pressure to support remote visibility and remote administration.
Third, utilities often operate a mix of legacy OT and modern connectivity.
The control devices themselves may be older and less flexible, while the surrounding environment becomes more connected through firewalls, VPNs, cellular gateways, remote-support tools, and centralized management systems.
That combination creates a dangerous mismatch.
The PLC may not be directly exposed to the internet. But if an attacker compromises the trusted infrastructure around it, the path into operational systems may still exist.
The FBI and EPA already warned in 2026 that malicious cyber actors targeting internet-facing PLCs had caused operational disruption in water and wastewater utilities in at least seven states. Some of that activity degraded water operations. The lesson is clear: if attackers can reach OT, the consequences are not theoretical.
Security Infrastructure Must Be Treated as Operationally Significant
Figure 1 — When Security Infrastructure Becomes the Attack Path
Utilities should therefore treat certain “security” or “support” systems as operationally significant assets, especially when they can influence or enable access to SCADA.
Examples include:
- VPN gateways
- firewalls
- jump hosts
- remote support appliances
- privileged remote-access platforms
- centralized firewall or security-management systems
- identity systems used to authenticate OT access
- cellular gateways supporting remote sites
- engineering access brokers
- logging and monitoring systems that contain sensitive network intelligence
These systems may not open a valve or start a pump directly.
But they may determine who can reach the system that does.
That makes them part of the operational risk picture.
What Utilities Should Do Now
The right response is not to remove every remote-access pathway or support tool.
Utilities need connectivity. They need vendor support. They need secure ways to administer systems.
The goal is to reduce the trust and blast radius associated with those platforms.
Figure 2 — Reducing the Blast Radius of Remote Access
1. Inventory Security Infrastructure That Touches OT
Utilities should explicitly identify every security or support platform that can influence access to SCADA or field systems.
This inventory should include not only the obvious tools, such as firewalls and VPNs, but also remote support platforms, centralized management tools, identity dependencies, and third-party access paths.
A good question to ask is:
If this system were compromised, what OT systems, credentials, or network paths could it expose?
2. Restrict Administrative Reachability
Administrative interfaces for firewalls, remote support appliances, and VPN platforms should not be broadly reachable.
Management access should be limited to trusted networks and authorized administrators.
If a support appliance allows customer-facing access and separate administration, those functions should be tightly controlled and monitored.
BeyondTrust’s own post-incident guidance emphasized reducing exposure, restricting administrative interfaces to trusted networks, and limiting appliance connectivity to what is actually needed.
3. Assume Stored or Brokered Credentials May Be Exposed
A compromised security appliance is not just a device problem.
It can be a credential problem.
If a platform stores, injects, brokers, or relays credentials, compromise of that platform may expose those credentials or the sessions built around them.
Utilities should be prepared to rotate credentials associated with a compromised platform, especially privileged and vendor accounts.
They should also review whether remote-access sessions can be limited in time, scope, and reachable systems.
4. Segment Security Infrastructure From the Systems It Supports
A remote support appliance should not provide unrestricted access to the entire OT environment simply because it exists for support.
A firewall management server should not automatically sit on the same trust plane as every managed system.
A VPN appliance should not become a universal bridge into engineering workstations, SCADA servers, and remote field infrastructure.
Access should be segmented, scoped, and aligned to operational need.
5. Forward Logs Off the Appliance
One of the practical lessons from edge-device and appliance compromises is that local visibility may not be enough.
If an attacker tampers with or disables logging on the compromised system, defenders need independent records elsewhere.
Utilities should ensure that meaningful logs from security infrastructure are forwarded off the box to a protected logging or monitoring environment.
6. Practice Operating Without the Trusted Tool
If the remote support platform fails, can the utility still support critical operations?
If the VPN gateway must be isolated, can the organization maintain operations safely?
If the firewall management system is unavailable, can the environment still be administered through controlled alternatives?
This is where the July 2026 CI Fortify guidance becomes especially useful. CISA and its partners recommend that critical-infrastructure organizations identify critical systems, map connections, and implement separation points so that vital OT and enabling systems can be isolated from other networks during disruption or crisis.
For water utilities, that is not just crisis-planning language.
It is a practical resilience requirement.
If security infrastructure becomes the attack path, the utility must be able to contain the problem without losing the ability to deliver essential service.
The Security Boundary Is No Longer Just the Firewall
Figure 3 — The Modern OT Security Boundary
For years, many organizations treated the firewall as the boundary.
But in modern utility environments, the effective security boundary is much broader.
It includes the systems that:
- control trusted access,
- manage security policy,
- authenticate remote users,
- broker vendor support,
- and provide administrative reach into the environment.
Those systems must be treated as high-value assets.
They should be patched quickly, monitored carefully, segmented thoughtfully, and reviewed through the lens of operational consequence.
Because if they are compromised, the attacker may not need to defeat the PLC directly.
The trusted pathway has already been created.
A Better Question for Utility Leadership
The right question is no longer only:
Are our PLCs secure?
It is also:
What security infrastructure could become a trusted attack path into our SCADA environment?
That question shifts attention toward the systems that often sit quietly in the background until they fail or are exploited.
It also leads to better conversations about remote access, third-party support, segmentation, credential handling, centralized management, and operational continuity.
The Operational Lesson
The main lesson from recent advisories is to evaluate each new product vulnerability based on its potential impact on operational systems and services.
At the same time, security infrastructure itself must be treated as part of the attack surface for operational technology.
A water utility may have no internet-facing PLCs and still face serious risk if its VPN gateway, remote-support platform, or firewall-management system becomes compromised.
That is why protecting SCADA environments requires more than protecting control devices.
It requires protecting the systems that can reach them.
And in many organizations, those systems are the ones wearing the label security.
Call to Action
Need help evaluating remote access, firewall exposure, vendor connectivity, or OT segmentation?
Timehri Networks can help assess whether your security infrastructure is strengthening your SCADA environment or unintentionally expanding its attack surface.
Sources & Further Reading
- BeyondTrust Security Advisory BT26-05 — Remote Support vulnerability
https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 - BeyondTrust blog — ARMORY CASTLE and BT26-05: What Security Teams Need to Know
https://www.beyondtrust.com/blog/entry/bt26-05 - CISA / ASD’s ACSC / FBI and partners — CI Fortify: Advice for isolating vital systems
https://www.cisa.gov/resources-tools/resources/ci-fortify-advice-isolating-vital-systems - FBI Cyber Alerts 2026 — including Reducing the Attack Surface for End-of-Support Edge Devices and water-sector OT alerts
https://www.fbi.gov/investigate/cyber/alerts/2026
About Timehri Networks
Timehri Networks helps water and wastewater utilities and other critical-infrastructure organizations strengthen OT and ICS cybersecurity through practical assessments, secure remote-access reviews, firewall and VPN evaluations, network segmentation analysis, passive OT monitoring, and cybersecurity strategies designed around operational realities.
Securing Operations. Strengthening Communities.