Securing water SCADA and Industrial Control Systems (ICS/OT) isn't about finding a single "silver bullet" product. Because water infrastructure is distributed, legacy-heavy, and critical to public health, the "best" approach is a multi-layered framework combining OT-native visibility/monitoring, secure remote access/segmentation , and alignment with federal guidelines from agencies like the EPA Cybersecurity for the Water Sector and CISA Water and Wastewater Cybersecurity.
Top solutions and strategies for the water sector break down into key operational layers:
OT-Native Threat Detection & Asset Visibility: Tools designed specifically for industrial protocols (like Modbus, DNP3, and Profibus) without risking process disruption.
Example: The Dragos xOT Cybersecurity Platform specializes in water/wastewater asset visibility, threat detection tailored to chemical/flow controls, and OT threat intelligence. Other major players in ICS passive monitoring and anomaly detection include and .
Network Segmentation & Zero-Trust Access: Eliminating flat networks where a compromised corporate IT laptop can reach a PLC controlling chemical dosing or pumps.
Strategies/Vendors: Implementing modern micro-segmentation and tools like Blastwave OT Cybersecurity which uses network cloaking to make remote telemetry units (RTUs) and SCADA endpoints invisible to unauthorized scanners.
No-Cost Federal Assessments & Scanning: Before buying commercial software, leverage federal resources specifically designated for water utilities.
Resource: Utilize the CISA Water Services for no-cost vulnerability scanning, cyber assessments, and the 24/7 EPA Water Resilience Help Desk.
To help narrow down the right direction, could you share:
The approximate size of your utility (population served / number of treatment plants or pump stations)?
Are you currently using internal IT/OT staff or relying on managed service providers (MSPs) for security operations?
Yes. For a water/wastewater utility running SCADA/PLC/RTU/HMI environments, I would shortlist Claroty, Dragos, and Nozomi Networks rather than treating a conventional IT security platform as the primary OT control.
My recommendation
If you want one platform to evaluate first: Claroty.
I’d put Claroty xDome/CTD at the top of the initial evaluation because it combines:
Passive OT/ICS asset discovery and inventory
SCADA/PLC/HMI visibility
Vulnerability and risk prioritization
Continuous threat detection
OT-specific remote-access controls
Multi-site management
Cloud and on-premises deployment options
Claroty specifically targets water/wastewater and reports deployments covering geographically distributed pumping stations, treatment plants, pipelines, and storage/distribution systems. One U.S. water utility serving more than 2 million people deployed its CTD, Secure Access, and centralized management capabilities.
That said, Dragos may be the stronger choice if your priority is deep OT threat detection and threat intelligence, while Nozomi is a particularly strong alternative when automated asset discovery and operational anomaly detection are priorities.
OT threat detection, hunting & threat intelligence
Excellent
You have a serious SOC/IR requirement
Dragos has particularly strong water-sector positioning, including monitoring SCADA communications, HMIs and ICS, water-specific threat intelligence, and documented deployments with water utilities. www.dragos.com Nozomi likewise provides automated OT asset inventory, risk prioritization, vulnerability management, threat/anomaly detection and incident-response capabilities specifically for water/wastewater environments.
The important part: don't buy the tool before fixing the architecture
The current threat environment makes this especially important. In July 2026, CISA reported increased targeting of water-sector PLCs, including attacks that changed PLC passwords/IP addresses and disrupted operations. CISA's immediate recommendation was to remove PLCs and other OT from direct Internet exposure and put remote access through a VPN/gateway instead.
NIST's newly published SP 1800-45 for water/wastewater specifically addresses secure OT remote access, while EPA guidance emphasizes asset inventory, authentication, reducing Internet exposure, segmentation and incident response.
So I'd architect the solution roughly like this:
Internet / IT
→ firewall + IT security
→ OT DMZ
→ jump server / secure remote-access gateway
→ OT firewall / segmentation
→ SCADA servers
→ PLC/RTU networks
→ field devices
with the OT security platform receiving passive network telemetry throughout the OT environment.
The key is that the monitoring system should not actively scan or probe sensitive PLCs by default. You want visibility without creating operational risk.
What I would put in the RFP
I'd make these requirements mandatory:
Passive discovery of every PLC, RTU, HMI, SCADA server and engineering workstation
Native visibility into protocols such as Modbus, DNP3, EtherNet/IP and common water-sector protocols
Identification of Internet-exposed OT
Detection of unauthorized PLC/HMI configuration changes
Detection of anomalous commands and communications
OT vulnerability prioritization based on actual asset criticality/exploitability, not just CVSS
Secure vendor/contractor remote access with MFA and session auditing
Network segmentation/Purdue-model visibility
Integration with your existing SIEM/SOC
Offline/known-good PLC configuration backup and recovery capability
Multi-site support for remote pump stations
Reporting aligned with NIST CSF, CISA Cross-Sector Cybersecurity Performance Goals, and EPA/AWIA requirements
CISA has specifically identified asset inventory, segmentation, strong authentication and removal of Internet exposure as important controls for water-sector PLC environments.
Bottom line
If I were running the procurement:
1. Claroty — first platform I'd pilot 2. Dragos — strongest alternative, particularly for threat hunting/IR 3. Nozomi Networks — strong alternative for visibility/asset management
But I would not select purely on vendor demos. I'd run a 30–60 day proof of concept against your actual SCADA network and score each vendor on asset coverage, PLC protocol visibility, detection quality, false positives, remote-access security, deployment impact, and integration with your existing SOC.
And given the 2026 water-sector attacks, I'd make "no directly Internet-exposed PLC/HMI + controlled remote access" a prerequisite, not something the OT security product is expected to compensate for.
If you tell me your SCADA vendor (e.g., Ignition, AVEVA/Wonderware, Rockwell, Siemens, Schneider), approximate number of sites/PLCs, and whether you have a SOC/SIEM, I can turn this into a vendor comparison/RFP matrix with specific technical requirements and scoring weights.
