Alabama Water Cybersecurity Summit Tackles Escalating Threats to Critical Water Infrastructure
Huntsville, Alabama - On Thursday, September 4, 2025, Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security hosted the inaugural Alabama Water Cybersecurity Summit at its Research and Innovation Campus in Huntsville, Alabama. This landmark event, the first of its kind in the state, brought together a diverse group of stakeholders, with a strong emphasis on local utility and water companies, to address the escalating cyber threats targeting Alabama’s water systems. These systems are critical to public health, economic stability, and national security, and the summit marked a pivotal step toward securing them against increasingly sophisticated attacks.
The Rising Cyber Threat to Water Systems
Water systems are essential to Alabama’s communities, providing clean drinking water and supporting industries such as agriculture, manufacturing, and energy production. However, these systems are increasingly vulnerable to cyberattacks from ransomware gangs, cybercriminals, and nation-state actors. These adversaries exploit weaknesses in outdated information technology (IT) and operational technology (OT) systems, threatening to disrupt access to safe water and cause widespread harm. Recent incidents across the United States have demonstrated the tangible consequences of such attacks, including contaminated water supplies and prolonged service disruptions.
Nick Sellers, Associate Director and Chief Operating Officer of the McCrary Institute, emphasized the urgency of the issue in his address:
"Targeting intrusions across multiple states and real-world incidents, where adversaries attempted to disrupt public access to clean water. It is no longer a big city or a big budget problem. It's local, it's rural, and it's here. And the cost of an action isn't just financial. It's public safety. We've all had to talk around our dinner table or the water cooler. Of what happens? What if our Power Systems and our clean water systems go down for an extended period of time. And folks. As you know, it ain't pretty. Society breaks down pretty quick. At Auburn University, we created the McCrary Institute for cyber and critical infrastructure security for one purpose. To defend the systems that power our national and economic Security, and that includes all of you and the Water Systems that all you run every day."
Sellers’ remarks underscored the widespread nature of the threat, which impacts not only urban centers but also rural communities with limited resources. The summit’s focus on local utility and water companies highlighted the critical role these organizations play in safeguarding Alabama’s water infrastructure.
A Collaborative Approach with Local Focus
The Alabama Water Cybersecurity Summit was designed to foster collaboration among stakeholders, with a particular emphasis on engaging local utility and water companies. These organizations, which operate the state’s water systems, were well-represented at the event, reflecting the grassroots nature of the cybersecurity challenge. Attendees included managers and operators from small, rural water utilities as well as larger municipal systems, alongside representatives from state and federal agencies, cybersecurity firms, and academic institutions.
The strong presence of local utility and water companies underscored the summit’s commitment to addressing the unique challenges faced by these organizations. Many local utilities operate with limited budgets and outdated technology, making them particularly vulnerable to cyberattacks. The event provided a platform for these operators to share their experiences, learn from industry experts, and collaborate on solutions tailored to their needs.
Keynote addresses by Chad Smith, Chief Information Security Officer for the State of Alabama, and John Garstka, Director for Cyber Warfare within the Office of the Under Secretary of Defense for Acquisition and Sustainment, set the stage for meaningful discussions. Smith emphasized the importance of embedding cybersecurity into the operational culture of water utilities, particularly for local operators who manage day-to-day system functions. He advocated for practical measures such as regular security audits, employee training, and incident response planning. Garstka highlighted the Department of Defense’s role in supporting civilian infrastructure, stressing the need for federal-state-local collaboration to counter advanced threats from nation-state actors.
The summit featured panel discussions and breakout sessions that delved into specific challenges faced by local utilities, such as securing legacy OT systems, mitigating ransomware attacks, and navigating complex regulatory requirements. Experts shared best practices for implementing cost-effective cybersecurity solutions, including open-source tools and cloud-based monitoring systems. Participants also explored emerging technologies, such as artificial intelligence for threat detection and blockchain for secure data management, that could enhance the resilience of water infrastructure without straining local budgets.
Funding Challenges in the Current Political Climate
A central theme of the summit was the growing difficulty in securing adequate funding for infrastructure cybersecurity. Under the current presidential administration and Congress, budget constraints and competing priorities have created significant barriers to protecting critical systems like water utilities. This funding shortfall is particularly challenging for local utility and water companies, many of which lack the financial resources to invest in robust cybersecurity measures.
The lack of federal funding has placed a heavy burden on state and local governments, which often rely on limited grants or reallocate funds from other essential services to address cybersecurity needs. This financial strain hinders efforts to modernize aging infrastructure, hire trained cybersecurity personnel, and deploy advanced security technologies. Summit participants, particularly those from local utilities, voiced concerns about the sustainability of these funding gaps, noting that they leave water systems vulnerable to attacks that could disrupt service, contaminate supplies, or undermine public trust.
The funding crisis is exacerbated by the rapid evolution of cyber threats, which require continuous investment to stay ahead of adversaries. Local utility representatives called for increased federal and state support, including dedicated cybersecurity grants and streamlined funding mechanisms, to help them address these challenges. The summit underscored the need for policymakers to prioritize infrastructure protection to ensure the resilience of Alabama’s water systems.
The Broader Implications for Alabama’s Communities
Alabama’s water systems are a cornerstone of the state’s economy and public health, supporting industries critical to Huntsville’s growth, such as aerospace, manufacturing, and agriculture. A successful cyberattack on a water utility could have far-reaching consequences, disrupting supply chains, halting production, and endangering public safety. Rural communities, which rely on small water utilities with limited resources, are particularly at risk. The summit’s focus on local utility and water companies highlighted the need to address these disparities by providing tailored support, such as access to affordable cybersecurity tools and training programs.
The potential societal impact of a water system outage is profound. As Sellers noted, prolonged disruptions to water and power systems could lead to societal breakdown, with communities losing access to essential services and businesses facing significant financial losses. The summit’s emphasis on collaboration and innovation aims to mitigate these risks, ensuring that Alabama’s water systems remain secure and reliable for all residents.
Huntsville’s Role as a Cybersecurity Leader
Huntsville, a hub for aerospace, defense, and technology, is emerging as a leader in cybersecurity innovation. The city’s Research and Innovation Campus, home to the McCrary Institute, provides a collaborative environment for addressing complex challenges like infrastructure security. The summit’s success, driven by the participation of local utility and water companies, reinforces Huntsville’s position as a center for tackling pressing national security issues. The event also highlighted the city’s role in fostering partnerships between academia, industry, and government to drive meaningful change.
A Roadmap for the Future
The Alabama Water Cybersecurity Summit is the first step in a broader effort to strengthen Alabama’s critical infrastructure. The McCrary Institute plans to build on the event’s momentum by establishing working groups to develop actionable cybersecurity frameworks and best practices. These initiatives will focus on enhancing threat intelligence sharing, improving incident response capabilities, and fostering partnerships between local utilities, government agencies, and private companies.
Workforce development was another key priority discussed at the summit. Local utility operators emphasized the need for accessible training programs to build a skilled cybersecurity workforce. The McCrary Institute is committed to addressing this need through workshops and certification courses to prepare the next generation of cybersecurity professionals.
Call to Action
The Alabama Water Cybersecurity Summit serves as a clarion call for stakeholders at all levels to prioritize the protection of critical infrastructure. Local utility and water companies, government agencies, and private sector partners must work together to address vulnerabilities, secure funding, and implement innovative solutions. The McCrary Institute’s leadership in hosting this event demonstrates Auburn University’s commitment to safeguarding the systems that power our society.
Throughout the day, an important source of funding for local municipalities was discussed. The State and Local Cybersecurity Grant Program is a federal grant program that was designed to help state, local, tribal, and territorial governments strengthen their cybersecurity posture against evolving threats.
The Alabama Office of Information Technology administers the funding and partners with the McCrary Institute to help local government entities apply for services. They can apply for that funding directly at https://slcgp.alabama.gov/
For more information on the McCrary Institute’s cybersecurity initiatives, visit Auburn University’s McCrary Institute website. The Huntsville Commerce Report will continue to provide updates on Alabama’s efforts to secure its water systems and other critical infrastructure.
