Recent Breaches
Breaches
View All →
Water

Treatment Plant and Distribution SCADA Path Control

Water treatment and distribution systems directly affect public health. When control systems are compromised, attackers can alter chemical dosing, disrupt supply, or contaminate drinking water for entire populations.

Back to Control
Control

Water

When a water treatment control system is reachable from the corporate network, every phishing email becomes a potential path to altering the chemical composition of a city's drinking water.

100%

Treatment SCADA isolation from corporate IT

Zero

Persistent remote access to dosing systems

5

Operational zones with independent governance

Full

NIS2 and DWI compliance evidence

The Challenge

Water infrastructure faces direct public health threats.

Chemical Dosing Risks

Compromised control systems could alter chlorine dosing or pH levels in treatment processes, directly threatening public health on a massive scale.

Remote Pumping Stations

Hundreds of remote pumping stations and reservoirs rely on SCADA communications with limited local security, creating distributed entry points.

IT/OT Convergence

Smart water network modernisation creates network paths between corporate IT and operational technology that attackers can traverse.

The Scenario

Scenario: Water Treatment SCADA Compromise

Attackers compromise a water company's corporate network through a targeted phishing campaign against the finance department. They move laterally until they reach a historian server that bridges the IT and OT networks. From there, they access the treatment plant SCADA system and modify chemical dosing parameters for chlorine and fluoride. The changes are subtle enough to avoid immediate alarm triggers but sufficient to affect water quality across the distribution area. With Firevault Control, the treatment SCADA network is physically disconnected from corporate IT. The historian server operates in a controlled zone with authorised, time-limited data transfer to corporate systems. The attack path from finance workstations to dosing controls does not exist.

"The historian server was our biggest vulnerability. It sat on both the IT and OT networks because the business needed water quality data in their dashboards. It was the bridge that gave attackers a direct path from email to the chlorine dosing system."

Solution Blueprint

Physical governance for water treatment and distribution.

Water companies gain physical control over every network path into treatment and distribution SCADA systems. Corporate IT cannot reach treatment controls. Remote access exists only during authorised windows. Recovery to safe operating parameters is guaranteed through air-gapped configuration archives.

  • Physical separation between IT and treatment SCADA systems
  • Multi-party authorisation for all treatment parameter changes
  • Time-limited, governed access for remote maintenance
  • Cellular failover for treatment system management
  • Continuous DWI and NIS2 compliance evidence
  • Air-gapped recovery to known-safe operating parameters
Fracture

Fracture, Emergency Treatment Isolation

Module 1 of 4

Physically disconnects treatment SCADA systems during active threats. When a compromise is detected, Fracture severs all network paths to treatment controls within seconds, forcing manual operation until the threat is contained.

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider

Key Capabilities

Sovereign Water Data

All treatment and distribution control data remains within the agreed jurisdiction in secured Firevault Bunkers, meeting Ofwat and DWI requirements.

Multi-Party Process Control

Changes to treatment parameters require authorisation from both operations and water quality teams, preventing unilateral modifications.

DWI and NIS2 Evidence

Automated compliance logging maps directly to Drinking Water Inspectorate requirements and NIS2 Article 21 outcomes for water companies.

Cellular SCADA Failover

Out-of-band management via cellular connectivity ensures control over treatment systems independent of primary communications infrastructure.

Process Change Audit

Every dosing parameter change, valve operation, and access authorisation is recorded in tamper-proof logs for DWI and regulatory audit.

Safe State Recovery

Air-gapped copies of treatment configurations ensure rapid restoration to known-safe operating parameters during compromise scenarios.

Demo to Live

Adoption Guide

Step 1

Water Network Assessment

Map all network paths between corporate IT, treatment SCADA, distribution SCADA, water quality systems, and remote pumping stations.

Step 2

Treatment Zone Design

Design physically separated zones for treatment, distribution, quality monitoring, and corporate systems with Control modules at each boundary.

Step 3

Single Works Pilot

Deploy at one treatment works with full SCADA isolation, multi-party process authorisation, and compliance logging to validate operational procedures.

Step 4

Company-Wide Deployment

Phased deployment across all treatment works and pumping stations with air-gapped recovery, continuous compliance evidence, and cellular management.

Step 1

Water Network Assessment

Map all network paths between corporate IT, treatment SCADA, distribution SCADA, water quality systems, and remote pumping stations.

Step 2

Treatment Zone Design

Design physically separated zones for treatment, distribution, quality monitoring, and corporate systems with Control modules at each boundary.

Step 3

Single Works Pilot

Deploy at one treatment works with full SCADA isolation, multi-party process authorisation, and compliance logging to validate operational procedures.

Step 4

Company-Wide Deployment

Phased deployment across all treatment works and pumping stations with air-gapped recovery, continuous compliance evidence, and cellular management.

Commercial Advantage

Win Business, Earn Trust, and Build Reputation with Butterfly

Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.

Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.

Deal Readiness

Governed materials ready to share with confidence

Client Trust

Demonstrate stewardship that earns loyalty

Board Confidence

Clear governance that inspires stakeholders

Enterprise Scale

Structure data governance across your organisation

Butterfly deployment model

Who Uses Butterfly?

  • Sales Teams

    Secure client proposals, pricing, and commercial intelligence

  • Service Providers

    Exchange sensitive documents with clients through governed Vaults

  • Businesses

    Protect strategic plans, IP, and competitive intelligence

  • Family Offices

    Structure data governance across principals, staff, and advisors

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

Water blueprint - PoC

Speak to the team to organise a PoC

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Firevault

    Firevault is Offline Secure Storage. Hardware you own, physically disconnected by default, with KYC-verified access. Ransomware-proof by design, not by patch.

    © 2026 Firevault Limited. Disconnect to Protect®