Protecting America's Water Infrastructure Starts with Predicting Cyberattacks

As cyberattacks on our nation’s water infrastructure become more frequent, the systems that manage the nation's water supply face growing risks. A single breach could disrupt drinking water supplies, damage ecosystems, and leave entire communities scrambling to respond.

To help address this emerging threat, a team of William & Mary researchers received a $170,000 award through the university's Applied Research & Innovation Initiative (ARII) to develop a new approach for predicting, understanding and preparing for cyberattacks on water infrastructure.

The project reflects ARII's mission to bring together multidisciplinary teams to advance applied research projects that address some of society's most pressing challenges. Led by Dr. Qingyun Wang, assistant professor of data science, the team includes Dr. Stephen Herwig, assistant professor of computer science, Dr. Karinna Nunez, senior research scientist with the Center for Coastal Resources Management at William & Mary's VIMS & Batten School, and three undergraduate and two graduate student researchers.

Their work addresses a growing vulnerability in the nation's critical infrastructure due to internet connectivity, outdated software, weak password security, and limited resources for routine system updates.  

"If an attacker gains access to these computer systems they can instruct physical actions, such as opening a dam unexpectedly or cutting off or redirecting water supplies," said Herwig.

To reduce these risks, operators are encouraged to implement cybersecurity best practices, to include changing default passwords, enforcing user access controls, limiting public-facing internet exposure, and conducting penetration testing to identify vulnerabilities before attackers can exploit them.

But the project team argues that effective cyber risk assessment must extend beyond operational technology alone.

PROPHETESS: A Novel Approach to Cyberattack Preparedness

Their proposed multimodal agentic framework, PROPHETESS, integrates diverse sources of information, including cyber event datasets, news reports and cybersecurity advisories, technical documentation, charts and tables from scientific publications, and geospatial imagery to build a more comprehensive understanding of a facility's potential vulnerabilities.

Using this historical knowledge base, the framework identifies patterns, generates realistic cyberattack scenarios, and predicts how disruptions could affect surrounding communities, the environment, and the economy. By simulating a range of attack scenarios and forecasting their potential consequences, PROPHETESS provides operational technology personnel, plant operators, environmental agencies, and policymakers with actionable insights to strengthen preparedness and improve response planning.

"With traditional automated penetration testing, you write code to simulate an attack, and the output is a list of identified vulnerabilities," stated Wang. "For non-experts, it's difficult to understand what those results actually mean. Our agentic system, combined with a large language model, goes a step further by explaining not only the vulnerabilities themselves, but also the potential physical consequences of such a cyberattack."

Community Outreach

The success of PROPHETESS depends not only on technological innovation, but also on close collaboration with the communities and agencies responsible for protecting critical infrastructure.

“Our work is grounded in applied science, and our goal is for it to be used to benefit communities. Local agencies value being involved in the process, and their participation helps ensure our research has a meaningful impact,” said Nunez.

Those relationships are built on longstanding partnerships with organizations working to protect Virginia's coastal communities and critical infrastructure.

“The Center for Coastal Resources Management at VIMS has long-lasting partnerships with the community," stated Nunez. "We hope to strengthen our collaborations with the Planning District Commissions to support efforts in risk mitigation and coastal resilience efforts, as well as continue working with the Virginia Department of Health and the Hampton Roads Sanitation District.”

The PROPHETESS team will also participate in the annual Cyber Fortress seminar in Virginia Beach next summer. The annual tabletop exercise brings together federal, state, local and private-sector partners to evaluate Virginia's preparedness for cyberattacks on critical infrastructure.

Ultimately, the team hopes to develop customized interfaces that provide different stakeholders with the information most relevant to their needs. As cyber threats to critical infrastructure continue to evolve, the researchers envision PROPHETESS becoming a decision-support tool that helps utilities and government agencies anticipate attacks, assess their potential consequences and strengthen their defenses before a crisis occurs.