(TLP:CLEAR) Research Report – Insider Threats in the Water Sector: A Growing and Underestimated Risk

Summary: This week, the Institute for Homeland Security at Sam Houston State University published an in-depth research report “Insider Threats in the Water Sector: A Growing and Underestimated Risk,” which was written by WaterISAC’s Lead Analyst Alec Davison along with David Pounder. The report analyzes recent insider threat trends, the factors increasing the risk of insider threats, and offers several mitigations that organizations can implement to strengthen their security.

Analyst Note: The report finds that insider threats represent a growing and often underestimated risk to the water and wastewater sector, one that extends far beyond the popular image of a lone malicious employee sabotaging a facility for revenge. This report defines insider threat risk broadly as harm arising when trusted individuals—employees, contractors, vendors, or other authorized personnel—misuse or fail to protect the access they have been given, whether intentionally or unintentionally.

The authors contend that insider incidents are on the rise in virtual every sector, with unintentional or negligent insiders remaining the most frequent category while malicious insider incidents, the most financially and operationally damaging kind, are also increasing, driven in part by the rapid, often ungoverned adoption of AI tools that can amplify how quickly sensitive access is exploited. In addition to AI, the report assesses that heightened geopolitical tensions, growing Information Technology (IT) and Operational Technology (OT) convergence, increased access by contractors and other third-parties to water and wastewater controls (including the use of remote access), and calls by violent extremists to recruit insiders in critical infrastructure organizations are together all heightening the risk of insider threats.

Moreover, the report examines five manifestations of insider risk specific to water and wastewater utilities, including unintentional errors, employee theft, cyber-enabled sabotage, disgruntled-employee retaliation, and workplace violence. Each real-world case study  underscores how insider access can translate directly into public health, safety, financial, and reputational consequences.

Ultimately, the report argues that because insider threats are fundamentally a human problem rooted in behavior and organizational culture rather than technology alone, water and wastewater utilities must adopt a risk-informed, multidisciplinary approach spanning security, cybersecurity, HR, legal, and leadership to detect early warning signs and intervene before a concern becomes an incident.

Original Source: Access the full report below.

Additional Reading:

• (TLP:GREEN) Managing the Risk of Chinese Government Sponsored Insider Threats
• (TLP:GREEN) Physical Security Case Study: Water Treatment Plant Insider Threat Incident

Mitigation Recommendations:

• (TLP:CLEAR) WaterISAC Physical Security and Resilience Advisory Committee: Insider Threat Management – Fact Sheet
• Insider Threat Mitigation for U.S. Critical Infrastructure Entities

Related WaterISAC PIRs: 1, 2, 3, 4 & 5