We need to secure our water SCADA systems from cyber threats. What's the best ICS/OT cybersecurity solution for the water sector?

If you mean one primary OT/ICS cybersecurity platform for a water or wastewater utility, my current shortlist would be:

1. Dragos — my first choice for a security-mature utility where OT threat detection, ICS-specific threat intelligence, and incident response are the priorities.
2. Claroty — arguably the strongest alternative if you want a broader cyber-physical asset/exposure-management + OT security + secure remote access platform.
3. Nozomi Networks — particularly attractive for utilities that prioritize automated asset inventory, anomaly detection, and operational visibility, especially with limited OT-security staff.

My pick: Dragos

For a water SCADA environment, I'd lean toward Dragos because it is unusually focused on OT rather than adapting a conventional IT security product to industrial networks. Its water-sector offering covers asset visibility, passive network monitoring, ICS threat detection, vulnerability/risk management, threat intelligence and incident response. Dragos specifically identifies water-treatment facilities, pump stations, SCADA networks, HMIs and controllers as part of its water-sector coverage.

Claroty's advantage is breadth: its platform combines OT/IoT/ICS visibility, exposure management, threat detection and secure remote access, with both cloud and on-premises deployment options.

Nozomi is particularly compelling when asset inventory and operational anomaly detection are central requirements. Its water-sector platform explicitly addresses automated OT/ICS inventory, risk prioritization, vulnerability management, threat/anomaly detection and incident response.

But don't buy the platform in isolation

For water SCADA, the biggest mistake is treating an OT monitoring platform as the entire security architecture. Recent U.S. government guidance emphasizes reducing public Internet exposure, eliminating default credentials, maintaining an OT/IT asset inventory, MFA, backups, vulnerability reduction, incident-response planning, and security training.

This is especially important now: in April 2026, EPA, FBI, CISA and NSA issued an advisory concerning ongoing Iranian-affiliated attacks against U.S. organizations, including water/wastewater systems, involving operational technology.

I'd therefore architect the solution roughly as:

SCADA/PLC/RTU network → passive OT monitoring → OT firewall/segmentation → controlled remote access with MFA → SIEM/SOC → incident response

with the OT platform providing:

• Complete asset inventory: PLCs, RTUs, HMIs, engineering workstations, VFDs, historians, switches, radios, etc.
• Protocol-aware monitoring: Modbus, DNP3, Ethernet/IP, OPC, Siemens, etc., as applicable.
• Behavior monitoring: unexpected PLC changes, unusual HMI activity, abnormal commands and communications.
• Remote-access visibility/control: especially third-party integrators and vendor connections.
• Risk-based vulnerability management: without aggressive IT-style scanning that could disrupt fragile PLC/SCADA equipment.
• Forensics and incident response: enough telemetry to determine what happened and what changed.

EPA itself now provides a cybersecurity procurement evaluation checklist for water utilities, including evaluation criteria for integrators and managed-service providers.

What I'd do in a real procurement

Rather than choosing based on a feature spreadsheet, run a 4–6 week proof of concept at one treatment plant and one remote/pump facility.

Put Dragos, Claroty and Nozomi against the same test cases:

1. Discover every PLC/RTU/HMI without disrupting operations.
2. Identify Internet-exposed or unnecessarily reachable OT.
3. Detect unauthorized HMI/PLC changes.
4. Detect anomalous SCADA commands.
5. Identify insecure protocols and credentials.
6. Monitor vendor remote access.
7. Detect lateral movement from IT into OT.
8. Integrate alerts with your existing SIEM/SOC.
9. Demonstrate incident investigation from alert → affected asset → communications → recommended containment.
10. Measure false positives and operator workload.

If I had to issue an RFP today: I'd make Dragos, Claroty and Nozomi the three primary bidders, with Dragos as the benchmark solution. The winner should be whichever gives your operators the best visibility and detection without introducing operational risk.

Also, don't overlook the free federal resources: EPA provides water-sector cybersecurity assessments, technical assistance, incident-response resources and an OT asset-inventory guide.

If you tell me roughly utility size (small/medium/large), number of treatment plants/pump stations, SCADA vendor (e.g. Ignition, AVEVA/Wonderware, Siemens, Rockwell), and whether you already have a SIEM/SOC, I can narrow this to a specific architecture and give you a Dragos vs. Claroty vs. Nozomi procurement scorecard.

Securing water SCADA and industrial control systems (ICS/OT) requires a multi-layered approach because there is no single "best" product that fits every utility. Instead, the water sector relies on a combination of network segmentation, continuous threat monitoring, and robust access controls from top-tier ICS security vendors.

Given the recent surge in targeted cyberattacks against U.S. water and wastewater critical infrastructure, effective solutions typically combine asset discovery, anomaly detection, and secure remote access.

Top ICS/OT Cybersecurity Solutions for Water Utilities

• Claroty (Continuous Threat Detection & xDome) : Excellent for deep visibility into OT and IoT assets unique to water systems (like PLCs, RTUs, and HMIs). It provides passive anomaly detection so it won't disrupt sensitive water treatment processes, along with secure remote access for vendors.
• Nozomi Networks (Guardian & Central Management) : A market leader in operational visibility and real-time cybersecurity monitoring. It excels at mapping complex SCADA architectures, identifying vulnerabilities, and spotting unauthorized network behavior or rogue devices in municipal water networks.
• Dragos (Platform & Worldview) : Tailored specifically for industrial environments with heavy emphasis on threat intelligence. Dragos provides specialized analytics designed to detect adversary behaviors targeting water and wastewater infrastructure, backed by dedicated incident response services.
• CyberArk / Palo Alto Networks (Secure Access & Segmentation) : While platforms like Claroty and Nozomi focus on OT visibility, perimeter security and identity management are vital. Palo Alto provides ruggedized industrial firewalls for secure zone segmentation (per Purdue Model standards), while CyberArk secures privileged remote access for third-party water system maintainers.

Core Strategies for Water SCADA Security

1. Network Segmentation : Isolate your IT network from your OT/SCADA environment using industrial-grade firewalls. Ensure that water treatment plant control loops cannot be reached directly from corporate email or internet-connected billing systems.
2. Passive Asset Discovery : Deploy non-intrusive monitoring tools that listen to network traffic rather than active scanning, which can crash legacy or fragile PLCs common in older water infrastructure.
3. Strict Remote Access Control : Eliminate legacy dial-up modems and unsecured VPNs. Implement multi-factor authentication (MFA) and privileged session management for any remote engineering access.
4. Regular Firmware & Backup Audits : Maintain an updated inventory of all PLC/RTU firmware versions and keep offline, tested backups of all control logic configurations.

To help narrow down the best specific approach, could you tell me:

• The size of your utility (number of treatment plants or population served)?
• Are you currently using legacy equipment or a modern, converged IT/OT architecture?
• Do you have specific compliance requirements (like EPA or AWIA mandates) you need to meet?

If you mean “best single OT/ICS cybersecurity platform for a water utility”, my shortlist would be Claroty, Dragos, and Nozomi Networks. There isn't one universal winner—the right choice depends heavily on whether your biggest problem is exposed SCADA/PLC assets, remote access, threat detection, vulnerability management, or limited security staff.

My recommendation: Claroty

For a typical U.S. water/wastewater utility, I would put Claroty at the top of the evaluation list.

Its platform covers asset inventory, exposure/vulnerability management, network protection, threat detection, and secure remote access. Importantly for water utilities, Claroty specifically has a water/wastewater offering and supports both cloud-based xDome and on-premises CTD deployments.

The remote-access piece is particularly important. Recent attacks against water utilities have exploited remote access and exposed control systems; the FBI/EPA response has emphasized removing critical systems from the public internet, restricting remote access, strengthening authentication, and retaining manual operating capability. www.wsj.com Claroty's xDome Secure Access provides granular access, MFA/PAM capabilities, session monitoring, and auditing rather than simply giving contractors a broad VPN connection.

How I'd rank the major platforms

Dragos is especially compelling if you have a mature SOC and want deep OT threat intelligence and incident-response capability. Its water-specific platform covers asset visibility, passive network monitoring, threat detection and response, and it has dedicated intelligence on threats targeting water infrastructure.

Nozomi Networks is arguably the strongest alternative if you want automated OT asset inventory, risk prioritization, vulnerability management, and anomaly detection in one platform. It specifically markets its platform to water/wastewater utilities and emphasizes doing more with limited security personnel—a significant consideration for municipalities.

But don't make the mistake of buying an OT monitoring product and calling it “secured”

For a water SCADA environment, I'd build the architecture roughly like this:

Internet / IT → strong identity + MFA → IT/OT DMZ → OT firewall / segmentation → SCADA servers / engineering workstations → PLC networks → field devices / pumps / valves / sensors

Then add:

1. Passive OT asset discovery — identify every PLC, HMI, RTU, VFD, engineering workstation, protocol and communication path.
2. Continuous passive monitoring — preferably via SPAN/TAP rather than active scanning on sensitive control networks.
3. Secure remote access — eliminate direct Internet exposure and uncontrolled VPN/jump-box access.
4. MFA + least privilege for operators, engineers and vendors.
5. Network segmentation between corporate IT, SCADA, PLC/control zones and remote sites.
6. OT-aware threat detection rather than relying solely on conventional IT EDR/SIEM.
7. Vulnerability/exposure management with compensating controls for equipment that cannot safely be patched.
8. Offline/immutable backups of SCADA configurations and PLC logic.
9. Manual fallback procedures so operators can safely run the plant if SCADA is compromised.
10. 24/7 monitoring/response, either through your SOC or a managed OT security service.

This matters because recent water-sector incidents demonstrate that attackers don't necessarily need sophisticated exploits: exposed systems, weak authentication and poor remote-access controls can be enough to interfere with operations.

What I'd actually do

If I were running the procurement, I'd run a proof-of-value with Claroty, Dragos and Nozomi against the same representative plant/network—not choose based on a feature checklist.

I'd give each vendor a few weeks to demonstrate:

• How many real OT assets they discover
• PLC/RTU/HMI identification accuracy
• SCADA protocol visibility
• Detection of unauthorized PLC/logic changes
• Detection of abnormal operator activity
• Visibility into remote/vendor connections
• Vulnerability/exposure prioritization
• Integration with your SIEM/SOC
• Passive deployment impact
• Multi-site scalability
• Offline/on-prem requirements
• How much analyst tuning is required
• Total cost per plant/site

For a small or mid-sized municipal utility with limited cybersecurity staff, I'd lean particularly toward Claroty or Nozomi. For a larger utility with a sophisticated security operation and strong emphasis on adversary intelligence and incident response, Dragos deserves very serious consideration.

And given the current threat environment, I'd treat Internet-exposed SCADA/PLC systems and uncontrolled remote access as an emergency remediation item, even before the platform procurement finishes.

If you tell me (1) number of plants/pump stations, (2) PLC/SCADA vendors such as Siemens, Rockwell, Schneider, etc., (3) whether SCADA is on-prem/cloud, and (4) approximate cybersecurity budget, I can give you a much more concrete Claroty vs. Dragos vs. Nozomi architecture and buying recommendation for your environment.

Securing water SCADA and Industrial Control Systems (ICS) requires a layered, defense-in-depth approach rather than a single tool . With active threat campaigns targeting internet-exposed PLCs and HMIs in the water and wastewater sector, federal guidance from CISA and the EPA stresses immediate isolation alongside long-term architectural monitoring.

The top-tier ICS/OT cybersecurity platforms, architectural strategies, and no-cost resources tailored for the water sector include the following:

• Industry-Leading OT Security Platforms: For comprehensive asset discovery, passive threat monitoring, and anomaly detection specifically built for SCADA protocols (like Modbus, DNP3, and OPC UA), enterprise leaders look to platforms recognized as market leaders:
  • Dragos Platform : Highly regarded for deep ICS/OT threat intelligence, tailored adversary tracking, and incident response for utilities.
  • Claroty (Continuous Threat Detection) : Excels at deep visibility into legacy water treatment environments and risk assessment.
  • Nozomi Networks (Guardian) : Provides robust real-time operational visibility and vulnerability management across distributed water networks and remote terminal units (RTUs).
  • Microsoft Defender for IoT : Strong integration capabilities if your utility already leverages an enterprise Microsoft security stack.
• Immediate Technical Mitigations (CISA / EPA Priorities):
  1. Remove Direct Internet Exposure : Disconnect PLCs, RTUs, and HMIs from the public-facing internet immediately. All remote access must go through an encrypted VPN or a secured industrial gateway.
  2. Enforce Hardened Authentication : Eliminate all default/hardcoded passwords and enforce Multi-Factor Authentication (MFA) for any administrative or remote engineering access.
  3. Rigorous IT/OT Network Segmentation : Implement an Industrial Demilitarized Zone (iDMZ) and robust firewalls to ensure corporate IT compromise cannot easily pivot into physical process control.
• No-Cost Federal and Sector-Specific Resources:
  • AWWA Cybersecurity Assessment Tool : The American Water Works Association provides an interactive AWWA Cybersecurity Assessment Tool to help utilities benchmark and prioritize security controls.
  • CISA Cyber Hygiene Services : Water systems can request external vulnerability scanning and mapping by contacting CISA via the CISA Water and Wastewater Cybersecurity portal.
  • WaterISAC : Joining WaterISAC gives your team access to critical, sector-specific threat intelligence sharing and indicators of compromise (IoCs).

To help narrow down the ideal platform or framework for your utility, tell me:

• What is the approximate population served by your water system?
• Are you currently utilizing external remote access for vendors or operators?

There isn't a single "best" ICS/OT cybersecurity solution for every water utility. The right choice depends on your size, existing SCADA/PLC vendors, regulatory requirements, and budget. For most water and wastewater utilities, the strongest approach is a layered architecture built around an OT-specific monitoring platform rather than relying on traditional IT security tools. Studies of the water sector consistently show that many incidents begin in IT environments before spreading into OT, and that passive OT monitoring, network segmentation, and secure remote access provide the greatest risk reduction.

Here are the platforms that are generally regarded as market leaders:

A modern OT security platform should provide:

• Passive network monitoring (no active scanning of PLCs)
• Automatic asset inventory for PLCs, RTUs, HMIs, historians, and SCADA servers
• Deep inspection of industrial protocols such as Modbus, DNP3, OPC UA, EtherNet/IP, and Profinet
• Detection of abnormal control commands and process changes
• Secure vendor remote access with MFA and session recording
• Integration with your SIEM and SOC
• Purdue Model-aware network visibility

Beyond the platform itself, the highest-impact security improvements for water utilities are:

1. Strict IT/OT network segmentation.
2. Eliminate direct Internet access to HMIs and engineering workstations.
3. Secure remote access through dedicated OT gateways instead of VPNs alone.
4. Passive monitoring using SPAN/TAP ports rather than active scanning.
5. Regular backups of PLC logic, HMI projects, historians, and engineering workstations.
6. OT-specific incident response plans and manual operation procedures.
7. Continuous monitoring of ICS vulnerabilities affecting your equipment vendors.

If I were selecting solutions by organization size:

• Small utility (under ~20 sites): Nozomi Networks or Microsoft Defender for IoT combined with good segmentation and secure remote access.
• Mid-sized regional utility: Claroty or Nozomi with dedicated OT firewalls and centralized monitoring.
• Large municipal utility or critical infrastructure operator: Dragos Platform combined with network segmentation, privileged access management, and 24×7 SOC integration.

One caution: avoid deploying traditional IT vulnerability scanners, endpoint agents, or aggressive network scans directly on production OT networks without validating compatibility. OT environments prioritize safety and availability, and passive monitoring is generally the preferred approach.

If you can share more about your environment—for example:

• SCADA platform (Ignition, AVEVA, FactoryTalk, VTScada, etc.)
• PLC vendors (Rockwell, Siemens, Schneider, Emerson, etc.)
• Number of treatment plants and remote pump stations
• Whether you're a municipal utility or a private operator

I can recommend an architecture and shortlist that fits your specific environment rather than a generic industry ranking.

There is no single "silver bullet" product that completely secures a water SCADA environment. Because water and wastewater systems rely on a mix of legacy equipment, distributed pump stations, and modern remote-monitoring tools, the most effective approach combines specialized OT/ICS cybersecurity platforms with strict architectural controls.

Recent federal warnings from CISA, the EPA, and the FBI emphasize that threat actors actively target internet-exposed PLCs and unsecured HMIs in the water sector. Securing these environments requires a multi-layered defense strategy.

Top Industrial Cybersecurity Solutions for the Water Sector

• Claroty (xDome & Continuous Threat Detection): Highly regarded for water and wastewater utilities. Claroty provides deep visibility into heterogeneous OT/IoT assets, passive network anomaly detection (crucial so security tools don't interfere with fragile PLCs), and secure remote access management for third-party vendors and contractors.
• Dragos (Platform & World-Class OT Threat Intelligence): Purpose-built for critical infrastructure, Dragos excels at identifying sector-specific threats (such as malicious logic changes targeting chlorination or pressure controls) and provides specialized playbooks and monitoring for water utility environments.
• No-Cost Federal Tools & Assessments: If budget is a constraint—especially for smaller municipal utilities—the CISA Water and Wastewater Cybersecurity page and the EPA Cybersecurity for the Water Sector portal offer free vulnerability scanning, no-cost cyber assessments, and practical tools like CISA’s Malcolm network monitoring tool.

Essential Implementation Steps (The "Top Cyber Actions")

No matter which vendor platform you evaluate, your defensive architecture must prioritize these mandatory controls:

1. Eliminate Direct Internet Exposure: Disconnect all PLCs, RTUs, and HMIs from the public internet. Never expose remote desktop protocols (RDP) or direct management interfaces online. Remote access must go through a hardened virtual private network (VPN) or a jump host/bastion gateway located in an OT-DMZ.
2. Enforce Strict Network Segmentation: Logically and physically separate your IT corporate networks from your OT/SCADA control loops using industrial firewalls. Restrict communication paths so endpoints only talk to what is strictly necessary.
3. Harden Authentication & Access Controls: Immediately change all default vendor passwords to complex, unique combinations. Enforce multi-factor authentication (MFA) for any administrative or remote login.
4. Maintain an Up-to-Date Asset Inventory: You cannot protect what you do not see. Conduct a comprehensive inventory tracking every server, workstation, cellular modem, and PLC—including undocumented or vendor-installed cellular links.
5. Prepare for Manual Operations: Regularly practice and maintain the ability to run critical treatment and distribution processes completely via manual physical controls if digital systems fail.

To help narrow down the right platform or next steps, please share:

• The approximate population served or number of separate treatment/pump facilities you manage.
• Whether your current infrastructure relies heavily on cloud-connected or remote cellular modems.

There is no single "silver bullet" product or software package that completely secures a water SCADA environment. Instead, the consensus among agencies like CISA and the EPA is that the "best solution" is a defense-in-depth architecture paired with strict operational hygiene . Recent threat activity highlights active targeting of internet-exposed Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs) across multiple states, making immediate risk reduction critical.

Essential steps and technical solutions to secure water SCADA and ICS/OT systems include:

• Eliminate Internet Exposure Immediately: Disconnect PLCs, RTUs, and HMIs from the public-facing internet. Never expose direct control ports or remote desktop protocols to the outside world.
• Secure Remote Access via Jump Hosts/VPNs: If remote access is required for operators or vendors, mandate encrypted virtual private networks (VPNs) or specialized bastion/jump host gateways rather than direct device connections. Implement strict IP allowlisting.
• Harden Hardware Authentication: Remove all default factory passwords on PLCs, HMIs, and managed network switches. Enforce complex, unique passwords and multi-factor authentication (MFA) for any supporting IT or administrative gateway. Use physical or software key switches on controllers in the "run" position to block unauthorized logic changes.
• Network Segmentation (The Purdue Model): Strictly separate your OT/SCADA network from your corporate business and email networks using industrial firewalls and an Industrial Demilitarized Zone (iDMZ).
• Continuous OT Monitoring: Deploy industrial intrusion detection systems (IDS) that understand OT communication protocols (such as Modbus, DNP3, and EtherNet/IP) to flag unauthorized configuration changes or anomalous network traffic in real time.
• Leverage Free Federal & Sector Resources: Take advantage of no-cost vulnerability assessments and tools provided by CISA Assessment Services and the EPA Water Sector Cybersecurity Program . Guidance is also structured around frameworks like NIST SP 1800-45 for remote access architecture.

If you share details such as the approximate population your utility serves , whether you use third-party vendors/integrators for remote maintenance , and what PLC vendors (e.g., Rockwell, Siemens, Schneider, Unitronics) you rely on, I can help tailor a prioritized mitigation checklist for your facility.

There isn't a single "best" ICS/OT cybersecurity solution for every water utility. The right choice depends on the size of your utility, your SCADA platform, regulatory requirements, remote sites, and operational constraints.

That said, if you're securing a modern water or wastewater utility, these vendors are consistently regarded as leaders:

For water utilities specifically, I'd typically recommend an architecture rather than relying on one product:

1. Passive OT monitoring to discover PLCs, RTUs, HMIs, historians, and engineering workstations without actively scanning control networks.
2. OT-aware network segmentation using the Purdue Model (or ISA/IEC 62443 zones and conduits).
3. Secure remote access with MFA, session recording, and least-privilege access for operators and vendors.
4. Continuous vulnerability management focused on industrial assets rather than traditional IT scanners.
5. ICS incident response procedures that include manual operations if SCADA becomes unavailable.

This approach aligns with common recommendations for the water sector, where many incidents begin with compromise of the IT network and spread into OT, while limited OT monitoring remains a widespread gap.

My recommendations by utility size

• Small municipal utility (1–5 plants): Claroty or Nozomi Networks with secure remote access and strong segmentation.
• Regional water authority: Dragos Platform plus a zero-trust remote access solution and OT SOC integration.
• High-consequence treatment facilities: Passive monitoring combined with a unidirectional gateway from Waterfall for the most critical process networks.

Features I'd prioritize over vendor name

• Passive network monitoring (avoid disrupting legacy PLCs)
• Native support for industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET, OPC UA, etc.)
• Complete asset inventory
• Vulnerability and firmware tracking
• Network anomaly detection
• Secure vendor remote access
• Integration with Microsoft Sentinel, Splunk, QRadar, or other SIEMs
• Support for ISA/IEC 62443 and NIST CSF
• Minimal impact on legacy SCADA systems

Many OT practitioners also emphasize avoiding active scanning and endpoint agents on legacy control systems where possible, favoring passive monitoring connected to SPAN or mirror ports. Community discussions consistently point to Dragos, Claroty, and Nozomi as leading OT monitoring platforms, with Waterfall considered for environments that require the strongest network isolation.

If you can share:

• your SCADA platform (e.g. Ignition, AVEVA/Wonderware, FactoryTalk, GE iFIX, Siemens WinCC),
• PLC vendors (Allen-Bradley, Siemens, Schneider, etc.),
• approximate number of sites,
• and whether you're a municipal utility or private operator,

I can narrow the recommendation to the solutions that best fit your environment and budget.

Securing water SCADA systems requires a "defense-in-depth" approach that prioritizes OT-specific (Operational Technology) solutions over traditional IT security. The best approach combines network segmentation, continuous threat monitoring, and strict, role-based access control , as highlighted by Dragos and the CISA/EPA guidelines.

Top Recommended ICS/OT Cybersecurity Solutions

• OT Monitoring & Visibility (e.g., Dragos Platform, Claroty, Darktrace): These provide purpose-built visibility into SCADA networks to identify anomalous behavior in PLCs, RTUs, and HMIs.
• Unidirectional Security Gateways (e.g., Waterfall Security Solutions): These replace firewalls to provide a physical, one-way, hardware-based separation between the IT and OT networks, ensuring cyberattacks cannot enter the control system.
• Secure Remote Access (e.g., Claroty xDome, Tailored VPNs): Secure remote access is critical, as many threats target vendor access points. Solutions should include MFA, jump hosts , and full session monitoring.
• Asset Management and Vulnerability Scanning: Use CISA’s free cyber hygiene services to identify exposed devices and unpatched systems.

Core Mitigation Strategies

1. Network Segmentation: Use an OT-DMZ to separate corporate IT networks from SCADA systems.
2. Hardening Endpoints: Disable unnecessary services on PLCs and HMIs and change default passwords.
3. Incident Response Planning: Develop cyber-specific incident response plans that focus on restoring safe, manual operations.

Note: For many, a "start small" approach is best, focusing on asset inventory and patching the most critical vulnerabilities first, such as exposed internet connections.

To provide the most relevant recommendation, could you clarify:

• What is the approximate size of the utility (e.g., number of customers served)?
• Are you primarily concerned with securing existing legacy equipment or implementing new, modern systems?
• Do you have an in-house IT/OT team , or do you rely on external vendors for IT security?

There isn't a single "best" ICS/OT cybersecurity solution for every water utility. The strongest programs combine a purpose-built OT security platform with network segmentation, secure remote access, asset visibility, and an incident response capability aligned to water-sector guidance. NIST's 2026 water-sector practice guide emphasizes reference architectures using commercially available technologies rather than endorsing one vendor.

For most water and wastewater utilities, a strong architecture includes:

If I were selecting a primary OT security platform specifically for the water sector today, I'd shortlist:

1. Dragos Platform

   • Very strong OT threat intelligence
   • Excellent asset inventory
   • Mature detection for industrial protocols
   • Widely deployed in critical infrastructure

2. Nozomi Networks Guardian

   • Outstanding passive asset discovery
   • Good visibility into water treatment processes
   • Strong integration with SIEM and SOC platforms

3. Claroty xDome / CTD

   • Excellent asset inventory
   • Strong exposure management
   • Good fit for organizations integrating IT and OT security

The "best" choice depends on your environment:

• Small municipal utility: Nozomi or Claroty often provide a quicker path to visibility.
• Large regional utility: Dragos is frequently favored because of its OT threat intelligence and incident response expertise.
• Multi-site utility with an enterprise SOC: Any of the three can work well if integrated with your existing security operations.

For the water sector specifically, prioritize these capabilities over vendor branding:

• Passive monitoring (avoid active scanning on PLC networks)
• Complete OT asset inventory
• Industrial protocol awareness
• Secure remote access with MFA
• Network segmentation using IEC 62443 zones and conduits
• Continuous anomaly detection
• Engineering workstation monitoring
• Incident response playbooks for water operations

The newest NIST guidance for water utilities focuses heavily on secure remote access architectures and practical reference designs for utilities of different sizes, making it an excellent starting point for designing or validating your environment.

If you're evaluating products, I would recommend assessing them against:

• IEC 62443 compliance and support
• Compatibility with your PLCs and SCADA software
• Passive asset discovery accuracy
• Industrial protocol coverage
• Ease of deployment without disrupting operations
• Native integrations with your SIEM, CMDB, and ticketing systems
• Vendor experience in the water and wastewater sector

If you can share more about your environment—such as whether you use Rockwell, Siemens, Schneider Electric, or another control platform; the number of treatment plants or pumping stations; and whether you're a small municipal utility or a large regional provider—I can suggest an architecture and narrow the field to the solutions that are likely to fit best.