Signals. Trends. Implications.
Helping utility leaders make sense of a rapidly changing water landscape.
Executive Takeaway
This month’s developments point to a broader shift: water resilience is becoming a real-time operating capability, not simply a matter of having enough physical infrastructure.
Cyber incidents disrupted monitoring and control at U.S. water systems. (FBI) Drought reduced river levels were enough to constrain electricity production, freight movement and drinking-water supplies across Europe. Proposed Colorado River rules would impose major supply reductions during dry periods, while utilities continue to navigate changing PFAS requirements.
The common thread is loss of operating margin. When pressure, supply, treatment capacity, staffing, or information is already constrained, a cyberattack, contaminant requirement or extreme weather event can quickly become a service, financial and public-confidence problem. Utilities therefore need not only stronger assets, but better visibility, earlier warning, and the ability to adapt operations quickly.
Trend of the Month
Resilience is becoming a real-time operating capability.
Historically, resilience was often associated with backup power, redundant infrastructure, emergency storage, and long-term capital plans. Those remain important, but recent events demonstrate that resilience increasingly depends on whether operators can recognize abnormal conditions, understand their consequences and retain control of the system while circumstances are changing.
This means that the value of operational intelligence is expanding. Pressure, flow, acoustic and asset-condition data are no longer useful only for efficiency or leak detection; together, they help utilities establish what “normal” looks like, recognize deviations and decide where to intervene first.
The emerging shift: From having resilient assets to operating the system resiliently.
What Happened
- Cyber threats produced physical consequences in water systems
On July 30, the FBI and EPA warned that malicious actors were targeting internet-facing programmable logic controllers used by water and wastewater utilities. Since July 27, utilities in at least seven states had reported incidents, with some experiencing degraded operations. Reported effects included loss of monitoring and control, pressure loss and flooding; agencies advised utilities to remove PLCs from direct internet exposure and retain secure, controlled access. (FBI)
Why it matters:
This moves cybersecurity from an information-technology concern into the core operating environment. A compromised control device can affect pumps, pressure, and treatment processes, meaning a digital intrusion can become a physical service risk.
It also reinforces the importance of manual fallback procedures and independent awareness of system conditions. Utilities need to know whether an unusual pressure or flow event reflects a leak, equipment failure, operator action, or malicious interference. Operational monitoring does not replace cybersecurity, but it can help operators recognize the physical effects of an incident and respond more quickly.
- Drought is disrupting systems far beyond the water sector
Record-low river levels in Europe have reduced hydropower and nuclear generation, restricted grain and oil transport and lowered company earnings. Hungary and Romania faced nuclear-generation constraints, Serbian hydropower output declined sharply, and low water on the Rhine and Danube disrupted freight movements. Half of England was also declared in drought after prolonged heat and exceptionally low rainfall depleted rivers and reservoirs. (Reuters)
Why it matters:
Water scarcity is increasingly creating cascading infrastructure risk. When river levels fall, the consequences can spread simultaneously into electricity, transportation, agriculture, industry, and municipal supply.
For utilities, the implication is that drought planning cannot focus only on total source-water volume. It must also consider peak demand, source quality, energy availability, treatment constraints, and competition among users. Continuous information about demand, system losses and available capacity becomes more valuable as the margin between supply and need narrows.
- Colorado River management is moving toward harder allocation decisions
The U.S. government proposed a new 10-year operating approach for the Colorado River after the seven basin states failed to agree on replacement rules. The proposal contemplates shortages of up to three million acre-feet annually for Arizona, California, and Nevada during dry conditions — approximately a 40% reduction from current Lower Basin supplies. The river supports one in ten Americans, major agricultural production, and hydroelectric generation. (Reuters)
Why it matters:
The Colorado River debate illustrates what happens when historical demand no longer fits available supply. The central management question shifts from how to expand the system to how to allocate scarcity transparently and defensibly.
Utilities facing tighter allocations will need to distinguish essential use from avoidable loss, assess scenarios before shortages occur and communicate difficult choices to customers and governing bodies. NRW reduction becomes especially strategic in this setting: water recovered from leakage can provide supply and financial benefits without requiring a new source.
- PFAS requirements remain active—but the implementation path is changing
EPA’s current proposals would retain enforceable drinking-water limits for PFOA and PFOS while allowing qualifying systems up to two additional years, through 2031, to comply. A separate proposal would rescind and reconsider requirements for four other PFAS and related mixtures; the public-comment periods for both proposals closed July 20 after a July 7 hearing. EPA also released July draft guidance addressing risks from PFOA and PFOS in biosolids, extending the issue beyond drinking-water treatment to residuals and disposal. (US EPA)
Why it matters:
Regulatory uncertainty does not remove the need for preparation. Utilities still need monitoring data, treatment alternatives, cost estimates, and an understanding of which decisions can be deferred and which should proceed regardless of the final rule.
The biosolids guidance also reinforces a lifecycle view of contaminants. Removing PFAS from water does not eliminate it; utilities must consider where concentrated residuals go and what future handling or disposal obligations may arise. The management challenge therefore extends across treatment, finance, procurement, waste handling, and public communication.
Signals to Watch
- Regulatory
Watch for EPA’s final decisions following the July PFAS comment periods, particularly the treatment of compliance extensions and the four PFAS proposed for reconsideration. Utilities should continue preparing around the requirements that remain in force while preserving flexibility where the regulatory path is unsettled. (US EPA) - Infrastructure
The cyber incidents make internet-exposed operational technology an immediate concern.
Watch for: greater scrutiny of remote access, third-party configurations, manual operating capability and whether utilities can independently confirm what is occurring physically in their systems. (FBI) - Climate and Supply
Europe’s drought and the proposed Colorado River rules show climate stress translating into operating limits and allocation decisions.
Watch for: more explicit drought triggers, demand restrictions, and competition between municipal, agricultural, industrial and energy users. (Reuters) - New demand
Water and electricity requirements associated with data centres are receiving growing scrutiny. A proposed Cape Town development advanced in July despite objections concerning resource use and disclosure, illustrating the pressure utilities and municipalities will face to evaluate large new loads against community capacity and resilience. (Reuters)
What this means for Utilities
Resilience is no longer just about what infrastructure a utility owns. It is about how quickly the utility can see a change, understand its consequences, and respond before it becomes a service failure.
Over the next 6–12 months, utilities should strengthen the connection between emergency preparedness and routine operations:
- Establish reliable baselines for pressure, flow, and demand so abnormal conditions can be identified quickly.
- Review internet-connected operational equipment and ensure manual control remains practical and tested.
- Build drought and supply scenarios around actual system capacity, including NRW — not only permitted or theoretical supply.
- Treat PFAS planning as a lifecycle and financial issue, including monitoring, treatment, residuals, and customer communication.
- Make capital prioritization more risk-based by combining asset condition with operational consequence and service criticality.
NRW sits at the intersection of these priorities. Reducing avoidable loss preserves scarce supply, lowers treatment and pumping costs, delays some capacity investments, and reduces the amount ultimately borne by customers. In an environment of growing infrastructure and compliance costs, that makes NRW both an operational and affordability strategy.
