52% of Water Utilities Lack Email Security Amid Iranian-Backed Attacks

For cybersecurity practitioners, the numbers are a call to shame. Despite decades of warnings, email authentication adoption remains abysmally low in the water sector, leaving a direct path for nation-state adversaries. The Iranian intrusions—exploiting phishing emails that impersonate trusted sources—prove that foundational controls like SPF, DKIM, and DMARC are not optional extras but the first line of defense for operational technology environments. The 52% statistic from Red Sift’s analysis is not just a vulnerability metric; it is a operational risk multiplier that turns every employee inbox into a potential staging ground for attacks on critical infrastructure.

A stark cybersecurity vulnerability has been laid bare across America's critical infrastructure: more than half of water and waste utilities have left the front door unlocked. A new analysis by cybersecurity firm Red Sift, examining over 800 companies in the water, chemical, and energy sectors, reveals that 52% of water and waste operators lack strong email authentication protocols. This gap coincides with a wave of confirmed breaches—the FBI and Environmental Protection Agency (EPA) disclosed that hackers had compromised dozens of water systems in at least seven states, with some operations 'degraded.' Intelligence officials reportedly assess Iran as the likely perpetrator. The attacks, and the underlying security posture, expose a systemic neglect of basic cyber hygiene in utilities that control millions of Americans' drinking water.

“

The 52% statistic from Red Sift’s analysis is not just a vulnerability metric; it is a operational risk multiplier that turns every employee inbox into a potential staging ground for attacks on critical infrastructure.

The attack chain is depressingly simple: phishing emails. Brian Westnedge, director of alliances and partnerships at Red Sift, explained that email remains the most reliable vector because 'the best way to get access into the organization is a person.' Adversaries craft messages impersonating trusted colleagues or government officials. Once a recipient clicks, the attacker can seize credentials, move laterally, and ultimately lock operators out of operational technology (OT) systems. In nation-state campaigns—this is not a ransomware profit play—the objective is to inflict 'pain' on critical infrastructure, a strategy that turns civilian utilities into military targets.

The geopolitical context heightens the urgency. A week before the FBI-EPA disclosure, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) published an advisory specifically warning that Iranian cyber actors were actively exploiting internet-connected critical infrastructure. Representative Mike Turner, a member of the House Armed Services Committee, noted that U.S. adversaries view civilian infrastructure as legitimate theaters of conflict. This marks a dangerous evolution: from espionage and data theft to operations that directly degrade the physical world. The water sector, often run by small municipal bodies with limited IT budgets, is uniquely vulnerable. Unlike large financial institutions or defense contractors, many water utilities lack dedicated cybersecurity staff, and email authentication protocols like SPF, DKIM, and DMARC—which can dramatically reduce impersonation—remain underdeployed.

The numbers are damning. Across all three sectors studied (water/waste, chemical, energy), 42% of organizations lacked strong email authentication. The water sector fared worst at 52%. This isn't merely a theoretical risk; the FBI confirmed tangible consequences, including degraded operations. Though the full scope of impact remains classified, the phrase 'degraded' could mean anything from disrupted water treatment processes to temporary loss of system control. No public health emergencies have been declared, but the potential for service interruption or water quality manipulation is real.