{"resourceId":"springer-human-governed-agentic-ai-scada-water-scoping-review-2026","versions":[{"version":"external-32a67e06b4ee63f9bdd4f59e2d74ce2f56ee63835b51a214951cef746c0a3c7d","resource":{"id":"springer-human-governed-agentic-ai-scada-water-scoping-review-2026","title":"Scoping review: human-governed agentic AI for SCADA cybersecurity in water and wastewater systems","organization":"Discover Computing (Springer Nature)","sector":"Water and wastewater OT/SCADA cybersecurity research","geography":"International evidence base with US incident references","publishedAt":"Discover Computing, 9 Oct 2026","publicationDate":"2026-10-09","eventDate":null,"sourceName":"Discover Computing / Springer Nature","sourceLabel":"Open-access peer-reviewed scoping review","sourceUrl":"https://link.springer.com/article/10.1007/s10791-026-10697-7","evidenceClass":"academic-research","outcomeClass":"cautionary","topics":["data-security","infrastructure","governance-procurement"],"finding":"This open-access scoping review (search completed 22 May 2026; published 9 Oct 2026) screened 2,341 records and synthesised 25 studies on water/wastewater SCADA cyber risk and AI. It finds cyber risk is a cyber-physical resilience problem—exposed HMIs, insecure remote access, weak segmentation, limited asset visibility, sensor manipulation, scarce labelled attack data and weak validation of AI detectors. Supervised, unsupervised, graph, digital-twin and RL methods each help under specific conditions, but none should substitute for operator judgement. The authors propose a conceptual, not field-validated, safety-constrained agentic AI framework that observes, detects, learns and recommends while humans retain final approval, and argue agentic AI should follow OT foundations (inventory, MFA, segmentation, backups, IR).","sledRelevance":"Gives SLED water utilities an evidence-mapped caution against buying autonomous OT defence AI before basics are in place, and a vocabulary for human-governed recommendation-only designs that boards and operators can accept.","evidence":"Peer-reviewed open-access scoping review with PRISMA-ScR-informed methods. Strength is evidence mapping; limitation is no formal critical appraisal and a conceptual framework not validated in simulation or the field.","architectureImplications":"Architect AI as a recommendation layer beside SCADA/historians with explainability, rollback and no autonomous dosing/pumping/pressure changes.","governanceImplications":"Requires explicit safety, authorisation, accountability and audit constraints; aligns with NIST AI RMF-style lifecycle governance for high-impact OT advice.","securityPrivacyImplications":"Warns that AI detection cannot compensate for unknown assets, uncontrolled remote access or untested backups; labelled attack data scarcity and drift are central failure modes.","caveats":"Conceptual framework unvalidated; heterogeneous included studies; not a product evaluation; US transfer requires local threat and process context.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: buyers asking for AI to defend water SCADA need a hard boundary. This review of 25 studies says AI methods help under conditions but must not replace operators, and agentic tools should wait until inventory, MFA, segmentation and backups exist. Offer an OT-foundations-plus-detection roadmap, not autonomous response. Do not sell the conceptual framework as proven.","engineering":"Engineering framing: design recommendation-only agents with explicit safety constraints, drift monitoring and historian or SCADA read paths that never write setpoints without a human. Validate detectors against this utility's seasonal modes and maintenance windows, not only public datasets or testbeds. A proof of value should report precision and recall with operator-reviewed false alarms and a rollback drill—not an autonomous containment demonstration.","delivery":"Delivery framing: cyber and operations share ownership; start with exposure reduction and MFA, then pilot anomaly detection in shadow mode. Proposed acceptance criteria are documented human approval gates and measured false-alarm rates. Risks are alert fatigue, unvalidated models and vendors pitching autonomy."},"roleDetails":{"sales":{"customerProblem":"Utilities want AI help against OT attacks without giving up operator control of treatment processes.","stakeholders":["OT/SCADA manager","CISO","Chief operator","Regulator/ primacy agency"],"discoveryQuestions":["Is there a current OT asset inventory?","Are remote-access paths MFA-protected?","What false-alarm tolerance do operators have?"],"valueHypothesis":"Human-governed detection/recommendation can aid triage after foundations exist; autonomy claims are unsupported here.","potentialEngagement":"OT foundations assessment then shadow-mode detection pilot.","unsupportedClaims":["Field-proven agentic autonomy","Any single algorithm always best","Simulation results equal plant readiness"]},"engineering":{"fit":"Water/wastewater utilities with historians and willingness to keep humans in the loop.","architectureIntegration":"Read-only telemetry to detection stack; recommendations to operators via audited channel; no write path to PLC setpoints without human approval.","prerequisites":["Asset inventory","Segmented remote access","Backup/IR basics"],"constraints":["Scarce labelled attacks","Process seasonality/drift","Thin OT staffing"],"security":"No autonomous high-impact actuation; log every recommendation and operator decision.","proofOfValue":["False-positive rate in shadow mode","Mean time to operator acknowledgement","Rollback drill success"]},"delivery":{"work":"Harden OT access, deploy shadow detection, define approval gates, train operators.","dependencies":["Network/firewall changes","Vendor model support","Operator schedule for review"],"ownership":"OT manager with CISO co-sponsor.","skillsAdoption":"Tabletops on spoofed sensors vs real process faults.","governanceCheckpoints":["Approve no-auto-actuation policy","Shadow-mode exit criteria","Quarterly drift review"],"acceptanceCriteria":["Proposed: written human-approval gates","Proposed: false-alarm rate within agreed band","Proposed: no unapproved PLC writes from AI tools"],"risks":["Alert fatigue","Vendor autonomy creep","Ignoring foundational hygiene"]}},"retrievedAt":"2026-11-05T22:08:37-06:00","enrichedAt":"2026-11-05T22:14:19-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Phased path for resource-constrained utilities; operators remain accountable for chemical dosing, pumping, pressure, disinfection and discharge.","procurementImplications":"Prefer detection/decision-support tools with operator override, audit logs and false-alarm monitoring over autonomous response claims.","operatingModelImplications":"Sequence work as OT hygiene first, then process-aware detection, then constrained agents—never the reverse.","peerReview":"peer-reviewed","sourceVerification":{"responseId":"p5.html","openedUrl":"https://link.springer.com/article/10.1007/s10791-026-10697-7","referenceExcerpt":"none should be treated as a complete substitute for operator judgement","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}