When Water Plant Operators Have to Choose Between Security and Getting the Job Done

It's 2 a.m. and a pump fails at a small-town water treatment plant. The only operator on call lives 45 minutes away. He can log in from home and fix it in ten minutes—if the system is online. If it's air-gapped, he's driving. If it's connected, he's a headline.

This isn't hypothetical. It's the daily reality for thousands of water utilities across the country, and it's the uncomfortable truth behind the latest alarm bell from the security establishment.

Retired General Paul Nakasone, former NSA chief, recently echoed what many have been saying for years: critical infrastructure controllers simply don't belong on the internet. The statement came on the heels of indictments against alleged Iran-backed hackers who breached a small Indiana water plant and manipulated controls. The reaction online was predictable: air-gap everything yesterday.

But if you talk to the people actually running these systems, you get a different picture. We've been tracking problems reported by water treatment professionals, and the numbers tell a story that policy debates often miss.

We're seeing 47 distinct problems logged in the water treatment industry, with an average severity of 3.8 out of 5. They're not just complaining about hackers. They're flagging outdated HMI interfaces, lack of network segmentation, and insufficient security training. One problem in particular—outdated HMI interfaces in water treatment plants—has a severity score of 4.2 and is among the most upvoted. Operators are telling us that when HMIs crash or need patches, the only way to get support is to let a vendor in remotely. So they do. That's not negligence; that's a tooling gap.

Dig a little deeper and the size of this gap becomes clear. Under our broader Equipment Management category, we've logged 867 problems. Many come from water treatment, and the pattern is consistent: asset monitoring and control increasingly rely on some form of connectivity—but the security layer hasn't caught up. You hear it in the language operators use: "we had to open the VPN," "the integrator demanded TeamViewer," "the PLC was default credentials because the vendor said so."

General Nakasone's recommendation is directionally correct, but PainSignal's data suggests that the real work isn't just pulling plugs. It's building the tools that make air-gapping operationally feasible—or that make limited connectivity actually trustable.

One app idea gaining traction in our community is a secure remote access solution for small water utilities. The concept addresses the core tension: operators need to get to their systems outside of business hours, but they shouldn't need to expose a whole SCADA network. Solutions that offer zero-trust access, session recording, and simple audits are exactly what this market needs. And yet the incumbents are mostly selling honking great appliances that cost more than the plant's annual maintenance budget.

That's where an indie hacker or a specialized agency could walk right in. The demand is real, the pain is acute, and the buyers are motivated—they just don't want another 50-page RFP. They want something that plugs the hole without breaking the budget or their backs.

For investors, the angle is equally sharp. Look past the headlines about Iran and China. Yes, nation-state threats are serious, and yes, CISA and EPA warn about them constantly. But the bigger market signal is the day-to-day operational chaos that makes those threats possible. When you hear that a PLC was left exposed, ask why. Our data points to the answer: because the plant's maintenance contractor demanded remote access and nobody knew how to argue. That's a solvable problem. It's a compliance problem. It's an equipment management problem. It's a security problem. And it's a business.

So next time someone declares that water controllers shouldn't be on the internet, nod along—then ask them what they propose the night-shift operator does when the pump alarms go off. That's the real conversation. And it's one where builders armed with the right data can show up with answers, not just opinions.