Back in March, New York became the first state to enact cybersecurity standards for public drinking water and sewage treatment systems. Now as thousands of treatment plants across the state scramble to meet a Jan. 1, 2027, deadline to comply with the new rules, a Kingston-based company is looking to become their first line of defense against cyberattacks.

A wave of cyberattacks against municipal water plants in seven Midwest states – believed to be the work of hackers in the service of the Iranian government – underscored the vulnerability of the facilities which rely on computerized operating technology (OT) to monitor flow, tank levels and other data and automatically operate valves and other machinery. The extremely-short-by-government-standards timeline of New York’s new regulations also highlights the growing alarm among officials at all levels about the prospect of cyberattacks that can shut down critical infrastructure. Marc Hoover, head of business development at Kingston’s Trout Software said that the increasing sophistication and coordination of cyberattacks on water systems had led municipalities across the country to start upgrading their online security protocols.

“Attackers move to where the opportunity is,” said Hoover. “And there’s a lot of vulnerability there.”

Cyberattacks on water treatment facilities usually involve hacking into OT systems and changing passwords to effectively deny operators access to any of the plants’ controls. The most secure systems, like those used by the military to run weapons systems, operate on a closed loop with no internet connection. But, as a practical matter, most OT systems need to have some internet capability to allow outside vendors to install updates and perform maintenance on them.

Additionally, sophisticated hackers can infiltrate operating systems through seemingly unrelated internet-connected devices like security cameras, HVAC systems or office computers. In some cases, the attacks come from international crime syndicates who will demand a ransom to restore access. Other attacks originate with hostile foreign powers to send a message or probe for vulnerabilities that could be exploited in the event of a conflict.

“They are always – no pun intended – testing the waters to see where those vulnerabilities lie as areas of opportunity,” said Hoover. “And often they’ll target these small water and wastewater plants where the operators think ‘why would we be attacked.’ Well it’s because they can identify that you might not have the right security posture in place.”

The new regulations from the state Department of Environmental Conservation seek to ensure that all of New York’s 600 sewage treatment plants and 2,324 public water systems do have the right security posture in place. The new mandate requires that operating technology systems be physically or “logically” isolated from internet-connected ones. The regulations also require plant operators to tighten access control with multi-factor identification and a ban on default credentials, incorporate cybersecurity incidents in their emergency plans and ensure personnel receive cybersecurity training.

Trout Software – located in a suite above a real estate office on Wall Street in Uptown Kingston – is well positioned to be the go-to for small and midsize plants without the resources to hire a full-time cybersecurity team. The company produces standalone plug-and-play “access gate” hardware that, Hoover said, checks all the boxes on DECs new cybersecurity mandate. The device maps out networks and creates secure “bubbles” that isolate operating technology from internet-facing systems. The system also creates detailed activity logs that can help users comply with new reporting requirements and spot hacking attempts.

Critically, as a stand-alone system it can work with proprietary OT or systems that are so old they cannot run modern software. The company operates on an annual subscription model with prices running from $5,745 for plants that can host the software on their own hardware to $19,755 for an on-site device that can protect up to 1,000 assets – price points within reach of most municipalities.

The January deadline looming, the company has undertaken a marketing blitz to convince plant managers and elected officials that they can provide solutions that don't rely on hiring new staff or outside consultants. In addition to a series of webinars that Hoover said had hundreds of participants signed up, the company, which does much of its own marketing, is conducting direct outreach to Hudson Valley communities, including the City of Kingston.

“We have had those discussions,” said Hoover. “And we would certainly be interested in working with them.”