Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control for water

Treatment plant and distribution SCADA path control.

Water treatment and distribution systems directly affect public health. When control systems are compromised, attackers can alter chemical dosing and disrupt supply. Control puts a real boundary between corporate IT and the chemistry of public water.

  • Chemical dosing risks
  • Remote pumping stations
  • IT/OT convergence

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The challenge

Water infrastructure faces direct public health threats.

When a water treatment control system is reachable from the corporate network, every phishing email is a route towards the plant.

  1. Treatment and distribution control data held in secured Firevault Bunkers, which can help support Ofwat and DWI expectations.

  2. Changes to treatment parameters require authorisation from both operations and water quality teams, preventing unilateral modifications.

  3. Automated compliance logging that can help support Drinking Water Inspectorate requirements and NIS2 Article 21 outcomes.

Challenge 3

IT/OT convergence.

Smart water network modernisation creates network paths between corporate IT and operational systems.

Answered byDWI and NIS2 evidence

The scenario

Scenario: water treatment SCADA compromise.

The historian server was our biggest vulnerability. Step through it, or play it through.

Step 1 of 2

The attack path

Attackers compromise a water company’s corporate network through a targeted phishing campaign, then move laterally until they reach a historian server that bridges the IT and OT networks.

From there, they access the treatment plant SCADA system and modify chemical dosing parameters, subtly enough to avoid immediate alarm triggers.

The path
Always there
What the attacker needs
A foothold and time

An illustrative scenario.

Layer 1
Separation of treatment SCADA from corporate IT
Time-bound
Remote access to dosing systems
5
Operational zones with independent governance
Logged
Evidence for NIS2 and DWI

Where each module sits

Where each Control module is deployed across treatment and distribution.

Water companies run the same Purdue stack as power, with telemetry reaching every treatment works and pumping station.

  1. Purdue boundaries, L3 operationsIsolateOffice, telemetry, treatment and distribution sit on separate physical fabrics.
  2. L5 to L4 and L4 to L3.5 linksFirebreakA physical cut on the public and office boundaries, taking the live path away.
  3. L5 to L4 link and L3.5 DMZValidateBefore any reading or request reaches operations, Validate checks its origin and integrity.
  4. L3.5 industrial DMZRelaySensor and pump data flows into SCADA on a scheduled, controlled route.
  5. L2 supervisory controlExecuteCross-plant actions need the right approval and the right state.
  6. L1 to L0 linkLockField devices tie to named engineers, the right device and the right authority.

Explore the Control Blueprints

Capabilities

What you get with every deployment.

Six things Control gives the team, from the first boundary to the audit afterwards.

Water

Water data in Firevault Bunkers

Treatment and distribution control data held in secured Firevault Bunkers, which can help support Ofwat and DWI expectations.

Water

Multi-party process control

Changes to treatment parameters require authorisation from both operations and water quality teams, preventing unilateral modifications.

Water

DWI and NIS2 evidence

Automated compliance logging that can help support Drinking Water Inspectorate requirements and NIS2 Article 21 outcomes.

Water

Cellular SCADA failover

Out-of-band management via cellular connectivity keeps control over treatment systems independent of primary communications.

Water

Process change audit

Every dosing parameter change, valve operation and access authorisation is recorded in tamper-evident logs for DWI and regulatory audit.

Water

Safe state recovery

Verified baselines of treatment configuration support restoration to known-safe operating parameters during compromise scenarios.

Adoption guide

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

  1. 1

    Water network assessment

    Map all network paths between corporate IT, treatment SCADA, distribution SCADA, water quality systems and remote pumping stations.

  2. 2

    Treatment zone design

    Design physically separated zones for treatment, distribution, quality monitoring and corporate systems, with Control modules at each boundary.

  3. 3

    Single works pilot

    Deploy at one treatment works with SCADA isolation, multi-party process authorisation and compliance logging, to validate operational procedures.

  4. 4

    Company-wide deployment

    Phased deployment across all treatment works and pumping stations, with verified configuration baselines, continuous compliance evidence and cellular management.

Questions

What teams ask first

Sensor and pump data flows into SCADA on a scheduled, controlled route through Relay in the industrial DMZ, so monitoring continues while the path from corporate IT stays separated.

Yes. Telemetry reaches SCADA through governed routes, and out-of-band management over cellular connectivity keeps control independent of primary communications.

Changes to treatment parameters need authorisation from both operations and water quality teams, and every change is recorded for audit.

Data leaves the historian zone through authorised, time-limited transfer, and every dosing change, valve operation and access authorisation is logged for DWI and regulatory audit.

All questions

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.