The first time a utility sees every connected device across all its sites, the reaction is usually the same. A long silence. Then: "We have how many?"
Then comes the list of problems. Old software here. A factory password there. A modem nobody remembers buying. The instinct is to start at the top and fix everything, fast.
Resist it. In water, a rushed fix can hurt more than the problem it fixes.
Some changes are free. Changing the password on a screen that only shows reports, during a quiet afternoon, with the operator watching. Nobody notices, and the risk goes down.
Some changes can touch the water itself. Anything near chemical dosing. Anything near pressure control. Anything that decides when a pump runs or a valve opens. Get those wrong, and you can cause the very outage you were trying to prevent.
So before you touch anything, ask three questions about every device.
What can it reach? A screen that only displays levels is a small problem. A screen that can send commands to the pumps is a big one. Follow the wires and the radio links, and find out what an attacker could do from that device.
What happens to the water if it fails? Follow the device to the job it does. If this controller stops, does a tank overflow? Does pressure drop? Does a dose go wrong? Does an alarm go quiet? The closer a device sits to water quality, pressure, or public safety, the higher it goes on the list.
Can we change it safely right now? Some fixes take five minutes during a quiet hour. Others need the vendor, a maintenance window, and an operator standing next to the equipment. A dangerous device with an easy, safe fix goes straight to the top. A dangerous device with a hard fix gets fenced in first, so it can only talk to the one thing it needs, while you plan the real fix.
That's what we mean by Prove. You end up with a short, ranked plan built on evidence from your own system. A list tells you what's wrong. A plan tells you what to do on Monday, and what to leave alone until Thursday's maintenance window.
It also gives your operators something they deserve: a say. The people who run the water know exactly which changes could hurt the water. Their answer to question two is worth more than any score a tool can produce.