When most organizations spot an attack, they reach for the biggest switch they have. Unplug it. Shut it all down. Sort it out later.
In an office, that works. Laptops can wait.
In a water system, the big switch has a cost. Shut down the controls and an operator has to drive to every site and run it by hand. Lose the screens and you lose sight of every tank and pump at once. Pull the plug in the wrong place and you can create the outage the attacker was hoping for.
So water needs a smaller, smarter move. Cut off the attacker. Leave the pump alone.
Let's go back to the pump station at the edge of town. 3:14 a.m.
Illustrative scenario
Findavi has been listening to that controller for months. It knows the controller's normal day: level readings to the screen, commands from the plant, nothing else. Tonight, a command arrives from a connection it has never seen. That's new.
What happens next takes seven steps.
First, Findavi spots the change and compares it with everything the controller has done before. Second, it checks your rules. Is this a device your team has agreed it can protect on its own, or does a person need to say yes? Third, if the rules say ask, it sends the on-call operator a clear message: block this connection and isolate the port it came through, and leave the controller running. One tap to approve.
Fourth, it acts. Fifth, it checks that the door is really closed, and the unknown connection can no longer reach the controller.
Sixth, and this is the step that matters most in water, it checks that the pump still works. Does the controller still answer the operator's screen? Are the tank levels still coming in? Does the pump still start when it should?
Seventh, it writes everything down. What it saw, what it recommended, who approved it, what changed, and the proof from both checks.
At 6 a.m., the town wakes up and turns on the coffee. Nobody knows anything happened. That's the goal. Contain the connection, not the town.
For water, I'll be direct. Start with Observe or Approve. Keep Autonomous for narrow, low-risk actions your operators have signed off on, like blocking a connection that should never exist. Anything that could change how water is treated or moved should wait for a human.
A word on what this takes, because you should hear it straight. Findavi can block a device, isolate a port, or push a configuration change. It does this only for the device types, models, and software versions we support, through integrations you approve, and under your rules. Those changes cover the connections and devices around your controls, like passwords and network access. Findavi doesn’t change how your pumps run. Process control and safety decisions stay with your operators and engineers. You can stop, undo, or switch off any agent at any time, and every action is recorded so you can audit it.
Observed in a NetOps IQ pilot
Simulated attack at a live water site
We have seen this work on real water equipment. During a pilot at a live water site, our team ran a simulated attack on the plant's controller screens. Findavi blocked the attacking connection and isolated the port it came through. Then it ran both checks. The door was closed, and the controls kept running for the operator the whole time. Both checks passed. This was a test during a pilot, not a real attack, and the site is unnamed.
Observed in an authorized test, power generation
During an authorized test at a power-generation facility, NetOps IQ recorded a blocked attacking connection and an available camera feed. The cameras kept recording throughout the test. The result applies to the equipment and scope tested.