A water controller is built to last. Twenty years is normal. Some run longer than the careers of the people who installed them.
That's wonderful for the budget. It's terrible for security.
Think about the phone you carried in 2006. Now imagine it still runs part of your town, still on its original software, and still answers anyone who knows where to call. That's a fair picture of a lot of water equipment today.
Most of it was designed for a closed world. The controller talked to the screen. The screen talked to the operator. Nobody outside was supposed to be listening, so nobody built much of a lock.
Then the world opened up. A vendor needed to fix something without driving three hours, so a remote connection went in. A board wanted to cut overtime, so operators got access from home. A remote site had no cable, so somebody added a cellular modem. Every one of those choices made sense on the day it was made.
Together, they built a road from the internet to the pump.
And at the end of that road, too often, sits a login that has never changed. The password it shipped with. Or one password shared across every site, written on a sticky note inside the control panel door, known to three retired operators and one vendor who went out of business.
Attackers know this. They don't need to be brilliant when the door is unlocked. They need a list of addresses and a little patience.
Small teams make it harder. A big city might have a security group. A town of 5,000 has an operator, a part-time IT contractor, and a vendor's phone number. Nobody is careless. Everybody is stretched.
So stop asking "Are we a target?" Everyone with a pump is. Ask a simpler question. How many of our doors are still open, and do we even know where they are?