InfrastructureIssue 087 records
Utility Management
OT security and small-utility operations dominate tonight. InsideEPA reports a NARUC draft resolution headed for an 8–11 Nov vote that would urge Congress to create an EPA-backed Water Risk and Resilience Organization for minimum water cyber requirements; NIST's October guidance and a new Springer scoping review both insist AI for water SCADA stay human-governed and follow remote-access foundations after mid-2026 PLC attacks. On the operations side, Freeland, Pennsylvania, put a grant-funded digital twin, leak loggers and limited AMI to work on non-revenue water, and Cherryland Electric Cooperative used InsightAI on AMI voltage data to find failing equipment. EU Opti-SITE work and a Duke/Accenture methane case add stormwater and US gas colour, both still early and vendor-tinged.
- Evidence records
- 7
- Cross-source patterns
- 2
- Evidence classes
- 3 independent reporting2 vendor claim1 academic research1 standards or public-body guidance
- Outcomes
- 5 emerging2 cautionary
- Source freshness
- 3 recent2 new this fortnight2 undated
- Research completed
- 2026-11-06
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Water OT AI should stay recommendation-only until remote-access and inventory basics exist
NIST's October guidance responds to mid-2026 internet-facing PLC compromises with SP 1800-45 remote-access architectures, while a October scoping review of 25 studies argues agentic SCADA AI must remain human-governed and should follow asset inventory, MFA, segmentation and backups. Together they set a sequence: harden access first, then detection, then constrained agents—not autonomy.
Operating questionBefore any OT AI pilot, which internet-facing controllers still lack MFA-protected remote access and a current asset inventory?
Supporting evidenceNIST National Cybersecurity Center of Excellence (NCCoE)Discover Computing (Springer Nature)
Small and rural utilities are operationalising AMI and digital twins for anomaly and leak work
Freeland Municipal Authority federated SCADA, 74 leak loggers and limited AMI into a WaterSight twin with grant support, and Cherryland co-op used InsightAI over AMI voltage intervals to find failing transformers. Both show thin-staff utilities can get operational value from meter and sensor data without waiting for large-enterprise AI programmes, though neither publishes quantified reliability or water-loss results.
Operating questionWhich AMI or SCADA feeds are already available for a scoped anomaly or leak pilot without a greenfield AI platform?
Supporting evidenceFreeland Municipal Authority (FMA)Cherryland Electric Cooperative
Evidence ledger
Full record · every source keeps its link and limitations
Freeland Municipal Authority puts a digital twin, leak loggers and AMI to work on non-revenue water
Freeland Municipal Authority, serving about 3,900 residents through 2,100 connections, implemented a $225,033 digital twin integrating Bentley OpenFlows WaterSight with 74 acoustic leak loggers, 15 AMI smart meters, SCADA and other operational data, supported by a $203,500 Susquehanna River Basin Commission grant. Middleware translated incompatible legacy SCADA formats; staff relocated and calibrated loggers to reduce traffic and equipment noise. HRG provides monthly analytics reviews. The Authority reports reduced time, labor, fuel, chemical use and energy spent locating leaks, but no quantified water-loss reduction is published.
Why it matters, evidence and limitations
- Why it matters
- A small US municipal water utility showing digital-twin and AMI instrumentation can be grant-funded and operated with ongoing partner support is directly transferable to similarly sized SLED water systems facing non-revenue water and thin engineering benches.
- Evidence and measured results
- WaterWorld Top Projects feature dated 2 Nov 2026 based on utility and consulting-engineer accounts. Cost and grant figures are stated; leak-finding resource savings are qualitative. No before/after non-revenue-water percentage is given.
- Limitations and uncertainty
- Qualitative benefits only; vendor and consultant co-authored narrative risk; AMI coverage is still limited (15 meters).
InsideEPA: NARUC draft resolution would urge Congress to create an EPA-backed WRRO for water cybersecurity
On 4 Nov 2026 InsideEPA reported that a NARUC draft resolution scheduled for approval at the 8–11 Nov 2026 annual meeting would call on Congress to create a Water Risk and Resilience Organization (WRRO) under EPA oversight to set minimum cybersecurity requirements for water systems, and to expand cybersecurity resources after federal cuts. The publicly visible teaser also links the proposal to heightened stakes from geopolitical conflict. Full article text is paywalled; the official NARUC draft PDF could not be retrieved from pubs.naruc.org during this run.
Why it matters, evidence and limitations
- Why it matters
- If adopted, a NARUC call for WRRO-style minimum cyber requirements would reshape how state commissions and municipal water utilities plan OT security investment, training eligibility and compliance evidence—directly relevant to SLED water and wastewater OT programs.
- Evidence and measured results
- Paywalled Independent reporting teaser dated 4 Nov 2026. Core WRRO/EPA/Nov 8–11 facts appear above the login. NARUC's public resolutions list confirms a Nov 4, 2026 4:52 PM draft packet for the annual meeting, but the PDF itself returned empty/blocked to automated fetch. Related H.R. 2594 (WRRO Establishment Act) and AWWA's Aug 2026 support letter were inspected as corroborating context, not as substitutes for the full InsideEPA article.
- Limitations and uncertainty
- Paywalled source; draft may change before the Board vote; teaser does not quote full resolved text; not an AI-product evaluation.
Scoping review: human-governed agentic AI for SCADA cybersecurity in water and wastewater systems
This open-access scoping review (search completed 22 May 2026; published 9 Oct 2026) screened 2,341 records and synthesised 25 studies on water/wastewater SCADA cyber risk and AI. It finds cyber risk is a cyber-physical resilience problem—exposed HMIs, insecure remote access, weak segmentation, limited asset visibility, sensor manipulation, scarce labelled attack data and weak validation of AI detectors. Supervised, unsupervised, graph, digital-twin and RL methods each help under specific conditions, but none should substitute for operator judgement. The authors propose a conceptual, not field-validated, safety-constrained agentic AI framework that observes, detects, learns and recommends while humans retain final approval, and argue agentic AI should follow OT foundations (inventory, MFA, segmentation, backups, IR).
Why it matters, evidence and limitations
- Why it matters
- Gives SLED water utilities an evidence-mapped caution against buying autonomous OT defence AI before basics are in place, and a vocabulary for human-governed recommendation-only designs that boards and operators can accept.
- Evidence and measured results
- Peer-reviewed open-access scoping review with PRISMA-ScR-informed methods. Strength is evidence mapping; limitation is no formal critical appraisal and a conceptual framework not validated in simulation or the field.
- Limitations and uncertainty
- Conceptual framework unvalidated; heterogeneous included studies; not a product evaluation; US transfer requires local threat and process context.
NIST NCCoE: securing water and wastewater OT remote access after mid-2026 PLC attacks
NIST's 1 Oct 2026 blog, responding to late-July 2026 water-sector OT attacks on internet-facing PLCs reported via CISA/FBI/EPA alerts, explains that attackers changed settings and locked out operators. It points utilities to NIST SP 1800-45 architectures for secure OT remote access: conventional firewalls plus remote-access servers; cloud-brokered access for resource-constrained systems; and encrypted system-to-system links for machine-to-machine flows. Core practices stressed include asset inventory, reducing internet exposure, MFA, segmentation, least privilege and logging.
Why it matters, evidence and limitations
- Why it matters
- Authoritative US guidance that municipal water and wastewater utilities can implement now, and that sets the baseline any later AI detection or agentic tooling must assume.
- Evidence and measured results
- Federal NCCoE blog summarising SP 1800-45 build architectures and tying them to 2026 incident reporting. Not a controlled evaluation of a single product.
- Limitations and uncertainty
- Guidance and lab reference architectures, not measured outcomes at a named utility; capacity to implement varies widely by system size.
Cherryland Electric Cooperative uses InsightAI on AMI data to find voltage anomalies and failing equipment
After fully deploying about 40,000 second-generation Sensus AMI meters across 3,400 miles of line, Cherryland invested in Xylem Data Lake's InsightAI, an AI-driven analytics assistant that helps staff write prompts/SQL to analyse meter data without deep data-science skills. The co-op used it to segment three-phase commercial voltage interval data into ranges, flag readings outside ANSI 5% limits, and find bad or failing transformers and faulty secondary connections. Last-gasp outage reporting also speeds OMS restoration. No quantified SAIDI/SAIFI or dollar savings are published.
Why it matters, evidence and limitations
- Why it matters
- A US rural electric co-op turning AMI interval data into AI-assisted voltage anomaly workflows is a concrete metering/operations pattern for other co-ops and municipal utilities with thin analytics benches.
- Evidence and measured results
- T&D World feature dated 18 Aug 2026 based on metering supervisor interviews. Qualitative equipment finds; no measured reliability or cost outcomes. Older than last run but not previously archived.
- Limitations and uncertainty
- Trade feature; self-reported finds; no independent evaluation; August publication date.
Opti-SITE: Danish and Swedish utilities train ML and radar nowcasting for stormwater and nature-based siting
The Interreg Öresund-Kattegat-Skagerrak Opti-SITE project, described on DHI's site, is building decision-support tools that combine machine learning (including graph neural networks), multi-objective optimisation and real-time radar rainfall to site nature-based solutions (rain gardens, basins, ponds) and to nowcast combined sewer overflows. A prototype ML model with benchmarking and training-data workflows is reported done; final optimisation tooling and radar-hydrodynamic integration remain next steps. Testing is with utilities HOFOR and NSVA in Copenhagen and Landskrona. Results are expected to feed DHI's CityFlow Live product.
Why it matters, evidence and limitations
- Why it matters
- US municipal stormwater and CSO programs face the same siting and nowcast problems; transfer requires caution on EU funding context, climate, and the vendor-hosted roadmap, but the ML-plus-radar pattern is relevant where radar and sewer models exist.
- Evidence and measured results
- Vendor project page without a clear publication date. Prototype status is self-reported; no published overflow-reduction percentages on this page. Treated as vendor-claim.
- Limitations and uncertainty
- Vendor page; incomplete tooling; European pilots; no US measured results; publicationDate unknown.
Duke Energy and Accenture build an Azure AI/satellite platform for gas-distribution methane monitoring
Accenture's case study describes an Azure-based platform co-built with Duke Energy, Avanade and Microsoft that uses satellite monitoring, analytics and AI to quantify and prioritise methane emissions from gas-distribution assets such as pipelines and meters, supporting Duke's 2030 net-zero methane goal for the gas business. The page claims workers are finding leaks in minutes versus physical inspection and that the platform is already delivering more accurate leadership insights, while still framing full scale-up across asset types and jurisdictions as future work. No independent measurement, leak counts or emissions tonnes are published on the page.
Why it matters, evidence and limitations
- Why it matters
- US municipal gas utilities and public LDCs evaluating satellite-plus-AI leak programs can treat this as an architecture pattern, with heavy discounting for vendor marketing language and IOU scale.
- Evidence and measured results
- Vendor case study without a clear publication date. Outcome language is qualitative and attributed to the program; treat as vendor-claim pending independent verification.
- Limitations and uncertainty
- Vendor marketing; undated; IOU scale may not match small municipal gas systems; no public quantified emissions results.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Academic research
- Research produced through an academic institution or peer-reviewed venue.
- Standards or public-body guidance
- Normative or advisory guidance from a standards body or public institution.