Cyber resilience and investment strategy in the water sector

In this sponsored episode of Talking Under Water, Co-host Bob Crossen spoke with Ian Bramson, vice president of industrial cybersecurity for Black & Veatch about how water utilities can best prepare their cybersecurity efforts and investments. Bramson touches on Black & Veatch’s 2025 Water Report, which found that 95% of utilities now prioritize cybersecurity investment, a growing number. Throughout the interview, Bramson explains what to learn from previous cyberattacks on water systems, why these systems are vulnerable, and what kind of protections exist for utilities of all sizes.  

Show Notes:    

• Why OT security is critical to defending against cyber threats
• Black & Veatch 2025 Water Report: Navigating regulatory uncertainty and cybersecurity threats 
• Smart stormwater management programs rely on IoT technology

Timestamps:

• Episode intro | 0:00 
  • Host introduces episode and explains how cyberattacks on water utilities are rising fast. 
• Utility cybersecurity investments are growing | 1:10 
  • 95% of utilities now prioritize cybersecurity  
• Why cybersecurity focus is increasing | 2:30 
  • Attack frequency, sophistication, and regulations are converging. 
• From theory to real threat | 03:54  
  • Cyber risks now feel urgent and tangible. 
• Why utilities are vulnerable | 04:27  
  • Motive and opportunity have both increased significantly. 
• Common cyber threats | 06:11  
  • Ransomware, malware, and internal errors are rising. 
• Internal exposure and USB threats | 08:30  
  • Most attacks stem from user behavior. 
• Smart tech and cloud challenges | 09:39  
  • Cloud visibility helps, but control adds risk. 
• Hybrid cloud in operations | 11:03 
  • OT and IT integration brings complexity. 
• Major challenges for utilities | 12:52  
  • Training, budget, and expertise shortages hinder progress. 
•  Bridging the cybersecurity gap | 14:45  
  • Utilities struggle between priorities and capabilities.   
• Start with the basics | 15:39  
  • Asset inventory is the first critical step.  
• Budgeting and investment strategy | 16:57 
  • Risk-based prioritization is key to progress.
• Cybersecurity as part of CapEx | 17:49  
  • Build-in is cheaper than bolt-on. 
• Creating a cybersecurity culture | 20:06 
  • Start early, especially at small utilities. 
• Cybersecurity as public safety | 21:41  
  • Protecting infrastructure equals protecting people. 
• Futureproofing with AI awareness | 22:29  
  • AI is here, ready or not. 
• AI is a new dependency | 24:32 
  • Utilities must manage unseen AI risks. 
• Digital transformation needs security | 25:56  
  • Fast progress requires strong cybersecurity foundations. 
• Cybersecurity as car safety analgogy | 26:31  
  • Comparing cybersecurity to the brakes, mirrors, and seatbelt in a car.
• Built-in beats bolt-on | 27:33  
  • Retrofit cybersecurity is costly and risky.  
• Closing thoughts & key takeaway | 28:38  
  • Cybersecurity is no longer optional—it's essential. 
• Housekeeping- 29:20  
  • Check out features on AI and CSO monitoring.
• Outro | 30:38 

 

 

Resources: 

• Use code WWD15 to get 15% off your attendee pass when you register at StormCon.com. 
• Wastewater Digest YouTube channel 
• WaterWorld July/August Issue 
• Stormwater Solutions July/August Issue 

  

About the Podcast      

Talking Under Water is the premier podcast for the water industry, including municipal water and wastewater, residential water treatment, storm water management and erosion control. It is produced in coordination between Wastewater Digest (WWD), WaterWorld and Storm Water Solutions (SWS). The podcast covers topics under the One Water movement including the municipal and industrial water and wastewater, residential, storm water and erosion control markets. Talking Under Water highlights news, trends, new technologies, industry disc