October is Cybersecurity Awareness Month, which means your inbox is likely filling up with phishing reminders and a suspicious number of password-themed memes. Fair enough. But if you run a water treatment plant, an energy facility, or a food and beverage operation, your cybersecurity to-do list has a few items that don't fit on a poster.
This summer made that clear. In late July, more than 30 Minnesota water and wastewater systems were hit over a single weekend, and similar activity turned up in at least six other states. Some communities asked residents to conserve water, and others switched to manual operations. CISA later said that over 100 internet-exposed water systems were targeted in July, most often through programmable logic controllers (PLCs) connected straight to a cellular modem. Drinking water stayed safe, which is great news. The lesson is that the door was unlocked and someone walked up and tried the handle.
CISA's Cybersecurity Awareness Month theme gives us a handy framework for what to do about it. Reduce, Replace, Recover. Here is how we see each one from the plant floor.
First, Know What You Have
Here's the uncomfortable truth behind most of the items below: you can't protect what you don't know about. Many plants run on a mix of equipment installed over decades by different integrators, with documentation that ranges from "pretty good" to "a sticky note on the cabinet door." Before you can shrink your exposure, retire old gear, or plan a recovery, you need an accurate picture of what's on your network.
That means a living inventory of your PLCs, HMIs, switches, servers, and remote connections, along with how they talk to each other. Passive monitoring tools can build that picture without poking at fragile control equipment, so you get visibility without risking production. And it's not a one-time exercise. Devices get added, vendors connect remotely, and a laptop shows up that nobody can explain. If you can't say what's on your network today, that's your first project. Our Industrial Networking and Cybersecurity team can help with this. A network and security assessment will identify all your assets, how they are connected, and the risk they pose.
Reduce: Shrink the Target
CISA reports that the volume of newly published vulnerabilities in 2026 had already passed the total for all of 2025 by August. Nobody can patch everything, and nobody should try. The goal is to find the vulnerabilities relevant to your environment and fix those first.
Start with a hard look at what is reachable from the outside. That PLC with the cellular modem your integrator installed in 2014 is probably still out there, and to hackers it is more tempting than Halloween candy. Our team can map your IT/OT environment, close off exposed access points, segment your networks so one problem stays one problem, and set up remote access that doesn't rely on a hopeful password.
Replace: Say Goodbye to Zombie Equipment
Every facility has that one piece of hardware. It still runs, nobody is quite sure who installed it, and the vendor stopped issuing security updates around the time when new cars still came with tape decks. When a device reaches end of support, every vulnerability found afterward stays open forever, and attackers love that.
Take stock of your controllers, HMIs, servers, and operating systems, and check their lifecycle status. Where something has aged out, we can plan the migration with you, whether that means a PLC platform upgrade, a SCADA refresh, or retiring a Windows machine old enough to vote. We build the plan around your production schedule, because we know a treatment plant can't take a day off to update its software.
Recover: Plan for the Bad Day
You can do everything right and still have an incident. What matters then is how fast you get back to normal. CISA's CI Fortify guidance asks operators to plan for a worst case with no phones and no internet, and to be ready to isolate from third-party networks and run manually if needed.
We help with the practical side. That means backups of your control system configurations and historian data, tested restores so you know the backups work before you need them, documented recovery procedures, and drills that include the people who will actually be in the room. A backup you have never restored is a theory, and a crisis is a bad time to test a theory.
Keeping Watch So You Can Run the Plant
Here's the catch with all of the above: a one-time cleanup helps, but environments drift. New vulnerabilities get published, devices age out, and somebody plugs in something they shouldn't. Most plants don't have an internal dedicated team watching the OT network around the clock, and honestly, they shouldn't need one.
That's where Vertech's Managed Services come in. We monitor your control system network for unusual activity, keep an eye on asset inventory and lifecycle status, stay on top of patching and updates on a schedule that respects your production, and verify your backups so they're ready when you need them. When something looks off, our team, which understands both the IT and the plant-floor side, can help you sort out what matters and what doesn't. Think of it as a second set of eyes that doesn't take coffee breaks.
A Few Things to Check This Week
Grab a coffee and take an honest look at these:
- Visibility. Could you produce a current list of every device on your control network today? How confident are you that it's complete?
- Equipment age. Do you know which devices in your control environment are past end of support?
- Exposure points. Can any of your PLCs, HMIs, or remote access tools be reached from the public internet?
- Backups. Are your control system backups current, stored offline, and recently tested?
If any answer was "uh, let me get back to you," you are in good company, and that is a perfectly good place to start.
Your Part Still Counts
Hardware and network upgrades are only half the picture. CISA's basics still apply: train your people to spot phishing, require strong passwords, turn on multifactor authentication wherever you can, keep software updated, and report incidents. Your team is part of your defense, and a little cheerful training goes a long way.
We can help with the modernization and the ongoing monitoring, and you cover the people side. Together that's a pretty solid setup. Not sure where to start? Reach out to our team for a conversation about your environment.
Comments