Water utilities are still internet-exposed. A former NSA chief says that has to stop

Paul Nakasone, the retired Army general who ran the US National Security Agency until 2024, used a stage at DEF CON this week to make a blunt architectural argument: the programmable logic controllers running US drinking-water treatment and distribution, in many utilities, should not be connected to the public internet at all.

Nakasone's framing was not new, and the threat actor he was responding to is not new either. The reporting this week from The Register ties his remarks to a recent campaign that researchers at the threat-intelligence firm Halcyon suspect was run by "CyberAv3ngers," an Iran-linked group first identified in 2023. The FBI has not publicly attributed the activity. The same outlet's July 29 piece put the running count of affected US water systems at more than a dozen states, a figure the private-sector researchers are still updating.

What makes the warning worth taking seriously is the scale of what is exposed. Nakasone put the population at roughly 50,000 community water systems, supplying about 90% of US drinking water. Most of those utilities run on thin budgets with limited or no dedicated cybersecurity staff. The joint EPA/FBI/CISA/NSA advisory issued April 7, 2026 cataloged what "exposed" looks like in practice: configuration wiping, software-based sensor tampering, and disruption of the human-machine interfaces that operators use to monitor the plant. None of those techniques require a sophisticated actor. They require a reachable device.

The recurring question is why the exposure persists. The honest answer is that it is not a knowledge problem. The defensible posture has been documented for years: air-gap the operational technology network where feasible, segment it from the business network where air-gapping is not, monitor it continuously, and require multi-factor authentication on any vendor-managed remote access. The federal government has been telling utilities roughly this for at least a decade. The Water ISAC and CISA have run tabletop exercises, alerts, and joint advisories on the same points. A volunteer effort called the DEF CON Franklin project, launched in 2024, lets vetted hackers probe participating water-facility systems so the operators can see what an attacker would see.

None of that has moved the median utility off the public internet. The reason is structural, and it is the part of the conversation that Nakasone's call does not resolve on its own. A small community water system might run its SCADA on a single cellular modem because that is what a one-person IT shop can install and maintain. The vendor needs remote access to keep the plant running between site visits. Pulling the controller offline means paying for staff, redundant radio links, or a managed security service that the rate base does not currently support. "Just air-gap it" can shift the cost of a compromise onto the operator who has to drive to the site at 2 a.m., or it can leave the controller untouched and force the attacker to find a different path through a vendor with weaker perimeter hygiene. Both are familiar failure modes.

Cynthia Kaiser made the same structural point on the record in this week's reporting. The threat actor's learning curve, she argued, has outrun the regulator's and the sector coordinating body's. A state agency that issues an advisory and a water association that runs a webinar are not the same as a funded mandate, and the funding question is the one that has to be answered before the architectural one is.

Nakasone is also the founding director of Vanderbilt's Institute for National Security and its Wicked Problems Lab. The next test is whether the funding question can be answered at the same pace. The EPA's grant programs for water-system cybersecurity have been oversubscribed for years. The CyberAv3ngers campaign is unlikely to be the last attempted intrusion. Whether the median utility can move off the public internet before the next one will depend on whether the next advisory is followed by a check, not just a checklist.