November was Critical Infrastructure Security and Resilience Month, an important reminder that public utilities are the backbone of modern life. This year, states and municipalities have greater power to make smart choices that both increase resilience and reduce costs as they work to keep the lights on, the water clean, and essential services running for millions of Americans.
The shift didn’t happen on its own. The March 2025 Executive Order on “Achieving Efficiency Through State and Local Preparedness” marked a turning point, moving more cybersecurity responsibility to state and local governments. While this decentralization empowers state and local agencies, it raises an important question: are they ready for such a monumental task? According to the most recent Nationwide Cybersecurity Review, only 22 of the 48 participating states met the recommended security maturity threshold. While real progress has been made, the preparedness gap remains wide. To meet this new mandate, state and local governments must modernize their public utility cybersecurity strategies, strengthen partnerships, and rethink resilience from the ground up.
Why Utilities are Prime Targets
Because of their essential role, public utilities have become primary targets for bad actors. Last year alone, U.S. utilities experienced a 70 percent increase in cyberattacks. The North American Electric Reliability Corporation (NERC) also reported that about 60 new vulnerabilities emerge in power grids every day. “It’s very hard to keep pace with addressing all those vulnerabilities,” said Manny Cancel, Senior Vice President of NERC.
Many utilities still rely on aging operational technology (OT) systems that lack encryption or authentication. Limited budgets and talent shortages compound the challenge, leaving organizations struggling to modernize. Meanwhile, essential digital transformation activities including remote monitoring, smart grids, and connected sensors have expanded the attack surface, making the balance between innovation and successful defense more delicate than ever.
Recent incidents highlight how IT weaknesses can cascade into OT crises. The 2021 Colonial Pipeline attack began with compromised billing credentials but disrupted fuel supplies across multiple states. That same year, the Oldsmar, Florida, water treatment incident exposed how remote access misuse could endanger public health. These cases clearly demonstrate why IT and OT systems can no longer operate in isolation.
Why IT and OT Belong on the Same Team
Traditionally, IT security teams protected networks and data while OT teams focused on uptime and safety. Today, cloud services, IoT sensors, and remote management tools blur those boundaries, and, as a result, the two environments now share risks.
The convergence offers benefits, including better visibility and predictive maintenance, but also introduces new risks. “Applying IT security capabilities to OT is essential for blocking those pathways for attackers. Yet too few critical infrastructure operators have implemented a unified approach that uses cybersecurity capabilities to protect both IT and OT,” said Dan Kent, Field CTO for Public Sector at Cloudflare.
A single compromised laptop or misconfigured cloud service can open a pathway to systems controlling pumps, grids, or treatment processes. The Colonial Pipeline and Oldsmar incidents, and more recently the April 2025 outages that left millions in Spain and Portugal without power for hours, underscore the global urgency of converging IT and OT security. A unified framework can reduce risk while building operational agility, enabling utilities to detect, isolate, and recover from threats faster.
Integrating IT and OT For Resilience
“Modern cybersecurity threats require IT security teams to expand their role. They must apply a full range of cybersecurity capabilities to OT to prevent devastating disruptions,” said Kent. A strong starting point involves adopting a three-step strategy that bridges IT and OT security while balancing immediate action with long-term resilience.
The first step is addressing high-priority risks. More than 90 percent of attacks begin with phishing, making prevention a top priority. Email filtering, secure web gateways, user training, and identify verification help prevent malicious messages or links from reaching end users.
Next, utilities must implement foundational cybersecurity best practices. Once urgent threats are contained, cyber teams should identify vulnerabilities, secure access points, and improve detection and response. Engineering workstations that bridge IT and OT environments often carry elevated privilege; applying techniques like microsegmentation can prevent attacks from spreading laterally. Likewise, web application firewalls can block attacks before they impact operations.
Transitioning to a Zero Trust model is another critical milestone. By verifying every connection within a system or network and limiting lateral movement, utilities can minimize the risk of attackers from IT to OT systems. As Cheuk Wong, Melbourne Airport’s Head of Cybersecurity noted, “We need to be very clear about who is on our infrastructure and how to protect it. When you add free public Wi-Fi into the mix, over 100,000 people connect to our network daily.” That level of visibility and control is exactly what Zero Trust aims to achieve.
Finally, aligning with a risk-informed framework like the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), provides a foundation for assessing and prioritizing risks. “While the framework does not recommend specific solutions, it can help you identify needed security capabilities and process improvements,” Kent explained. “You can use the framework to develop an efficient strategy for using IT security to maintain uninterrupted operations.”
A Shared Responsibility for the Next Era of Infrastructure
Modernizing public utility cybersecurity is as much about collaboration as technology. Cloud-based, AI-enhanced platforms can provide real-time visibility and threat intelligence, but without coordination among agencies, private providers, and regulators, progress remains fragmented. “It’s all about the power of good partnerships—being able to get the best out of people who know how to do things better than you can,” said Anthony Tomai, Melbourne Airport CIO. The most resilient systems emerge from environments where data is shared and policies align.
Adopting modern architectures will not happen overnight, but incremental progress can make a measurable difference. Supported by cross-governmental partnerships and reinforced by private sector innovation, these efforts create a multiplier effect for resilience.
The decentralization of cybersecurity responsibility is more than a policy change. As states and municipalities gain greater control over cyber posture, the stakes grow higher for the systems that keep communities running. Mike Shaw, a state legislator representing the 47th district in Alabama is optimistic: “The federal government is really big, and it’s really hard to come up with a one-size-fits-all solution for things like cybersecurity, data privacy and technology in general,” Shaw said. “So, in some sense, it’s good that the states are coming up with their own.”
Through the right strategies, public utilities can turn this moment of uncertainty into a foundation for long-term stability and trust.
Learn more about cybersecurity for critical infrastructure here.