The post from Google Cloud‘s CISO Perspectives newsletter focuses on securing water utilities in the AI era. Threat actors are increasingly targeting internet-connected programmable logic controllers (PLCs) in the U.S. water sector, though manual overrides and water-quality checks have historically prevented operational disruptions. The authors argue that preventing cyber threats still requires fundamental digital security, especially as AI lowers the barrier for attackers.

The recommended actions for resource-constrained utilities emphasize cybersecurity fundamentals: inventory assets to find insecure internet exposures, enforce basic hygiene (strong passwords, hardened firewalls), follow the 3-2-1 backup rule, segment networks with multifactor authentication, integrate cyber incident planning into existing all-hazards response systems (e.g., FEMA NIMS), and audit third-party vendor access. These align with guidance from AWWA, CISA, EPA, and others.

For IT and OT leaders, bridging the governance gap is critical. The post suggests building a unified framework, referencing NIST’s Secure Software Development Framework (SSDF) and leading indicators for resilience. It also highlights the Mandiant Operational Technology (OT) Theory of 99: in intrusions deep enough to affect OT, 99% of compromised systems, malware, forensics, detection opportunities, and dwell time involve computer workstations and servers (Purdue levels above 0-1). This means defenders can leverage AI to secure the 99% of intermediary infrastructure, protecting the critical 1% of physical processes. The Secure AI Framework is introduced as a structured approach to integrate AI while keeping human oversight central.

The newsletter also includes updates on AI agent security governance, cloud risk findings, fault injection testing, Wiz data discovery, and threat intelligence on Russian espionage clusters, AI infrastructure attacks, and supply chain attacks on Rust crates. It previews a pilot program by the Office of the National Cyber Director and the State of Texas to protect water infrastructure, and a new U.S. Senate bill in response to recent events.