From the Utility Management edition of November 5, 2026
Scoping review: human-governed agentic AI for SCADA cybersecurity in water and wastewater systems
Discover Computing (Springer Nature) · Water and wastewater OT/SCADA cybersecurity research · International evidence base with US incident references
- Publisher
- Discover Computing / Springer Nature
- Original publication
- Discover Computing, 9 Oct 2026
- Source retrieved
- 2026-11-06
What happened
This open-access scoping review (search completed 22 May 2026; published 9 Oct 2026) screened 2,341 records and synthesised 25 studies on water/wastewater SCADA cyber risk and AI. It finds cyber risk is a cyber-physical resilience problem—exposed HMIs, insecure remote access, weak segmentation, limited asset visibility, sensor manipulation, scarce labelled attack data and weak validation of AI detectors. Supervised, unsupervised, graph, digital-twin and RL methods each help under specific conditions, but none should substitute for operator judgement. The authors propose a conceptual, not field-validated, safety-constrained agentic AI framework that observes, detects, learns and recommends while humans retain final approval, and argue agentic AI should follow OT foundations (inventory, MFA, segmentation, backups, IR).
Why it matters
Gives SLED water utilities an evidence-mapped caution against buying autonomous OT defence AI before basics are in place, and a vocabulary for human-governed recommendation-only designs that boards and operators can accept.
Evidence and measured results
Peer-reviewed open-access scoping review with PRISMA-ScR-informed methods. Strength is evidence mapping; limitation is no formal critical appraisal and a conceptual framework not validated in simulation or the field.
Limitations and uncertainty
Conceptual framework unvalidated; heterogeneous included studies; not a product evaluation; US transfer requires local threat and process context.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Utilities want AI help against OT attacks without giving up operator control of treatment processes.
- Stakeholders
- OT/SCADA manager
- CISO
- Chief operator
- Regulator/ primacy agency
- Discovery questions
- Is there a current OT asset inventory?
- Are remote-access paths MFA-protected?
- What false-alarm tolerance do operators have?
- Value hypothesis
- Human-governed detection/recommendation can aid triage after foundations exist; autonomy claims are unsupported here.
- Potential engagement
- OT foundations assessment then shadow-mode detection pilot.
- Unsupported claims
- Field-proven agentic autonomy
- Any single algorithm always best
- Simulation results equal plant readiness
Pre-sales engineering
Role takeaway
- Fit
- Water/wastewater utilities with historians and willingness to keep humans in the loop.
- Architecture and integration
- Read-only telemetry to detection stack; recommendations to operators via audited channel; no write path to PLC setpoints without human approval.
- Prerequisites
- Asset inventory
- Segmented remote access
- Backup/IR basics
- Constraints
- Scarce labelled attacks
- Process seasonality/drift
- Thin OT staffing
- Security
- No autonomous high-impact actuation; log every recommendation and operator decision.
- Proof of value
- False-positive rate in shadow mode
- Mean time to operator acknowledgement
- Rollback drill success
Delivery
Role takeaway
- Work
- Harden OT access, deploy shadow detection, define approval gates, train operators.
- Dependencies
- Network/firewall changes
- Vendor model support
- Operator schedule for review
- Ownership
- OT manager with CISO co-sponsor.
- Skills and adoption
- Tabletops on spoofed sensors vs real process faults.
- Governance checkpoints
- Approve no-auto-actuation policy
- Shadow-mode exit criteria
- Quarterly drift review
- Acceptance criteria
- Proposed: written human-approval gates
- Proposed: false-alarm rate within agreed band
- Proposed: no unapproved PLC writes from AI tools
- Risks
- Alert fatigue
- Vendor autonomy creep
- Ignoring foundational hygiene
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Architect AI as a recommendation layer beside SCADA/historians with explainability, rollback and no autonomous dosing/pumping/pressure changes.
Governance
Who approves, reviews and stays accountable for outcomes?
Requires explicit safety, authorisation, accountability and audit constraints; aligns with NIST AI RMF-style lifecycle governance for high-impact OT advice.
Security and privacy
What data, permissions and controls need testing?
Warns that AI detection cannot compensate for unknown assets, uncontrolled remote access or untested backups; labelled attack data scarcity and drift are central failure modes.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Phased path for resource-constrained utilities; operators remain accountable for chemical dosing, pumping, pressure, disinfection and discharge.
Procurement
What should contracts, pricing and exit terms secure?
Prefer detection/decision-support tools with operator override, audit logs and false-alarm monitoring over autonomous response claims.
Operating model
Which teams own the service once it runs?
Sequence work as OT hygiene first, then process-aware detection, then constrained agents—never the reverse.
Publication history
- 2026-11-05Utility Management · Issue 087 resources
Stable resource ID: springer-human-governed-agentic-ai-scada-water-scoping-review-2026