EPA links rising attacks on water utilities to unchanged passwords and exposed controls
EPA water chief Jess Kramer says attacks on US water utilities have risen several fold, citing unchanged passwords and system details left online. EPA keeps finding basic weak points, and officials say many utilities lack the staff and investment to close them.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence42
Bipartisan bills would put biomanufacturing and genomic data inside CISA's infrastructure planning
Five lawmakers announced two bills putting biotech and genomic data under CISA's infrastructure planning, with no new sector. If enacted, DHS would contact key biotech firms and fold their input into the National Infrastructure Protection Plan this year.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence55
Between March and April 2025 intruders searched an industrial automation firm for "customers" and "SCADA", then bundled about 800 files. FBI and CISA now want least privilege applied to integrator access.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives38
- Confidence66
Honeywell's survey finds the chillers and badge readers outside most OT monitoring programs
Honeywell asked 603 critical infrastructure leaders what they actually watch. The chillers, elevators and badge readers that keep the controllers alive mostly sit outside continuous view, and teams with thinner inventories reported longer outages.
Reality
- Evidence45
- Adoption20
- Hype gap+8
- Incentives72
- Confidence52
Pakistan schedules its Federal CERT to be 40 percent operational a year from now
The 90-day action plan drafted by Pakistan's Cyber Security Working Committee dates guidance for provincial CERTs, a critical infrastructure declaration framework and a cyber warfare escalation matrix. The federal CERT itself gets three years.
Reality
- Evidence38
- Adoption8
- Hype gap+30
- Incentives62
- Confidence45
Schneider tells SCADAPack operators to migrate off Secure Lock after a credential exposure finding
Abhinav Agarwal's report of insufficiently protected credentials covers every version of seven SCADAPack families. Schneider's answer is role-based access control on the 47x line plus network segmentation and the RTU firewall service.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap−12
- Incentives62
- Confidence66
CISA tells OT owners to classify every asset by function and criticality
The new Foundations for OT Cybersecurity guidance treats an asset inventory plus a taxonomy as the precondition for everything else in a defensible architecture. It sets no deadline and names no auditor.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence70
UK bill would let ministers bar named technology suppliers from critical infrastructure
Amendments tabled two days after a reported four-day outage at a UK energy generator would let ministers block specific suppliers, which turns vendor provenance into something a critical-sector buyer has to prove.
Reality
- Evidence46
- Adoption22
- Hype gap+32
- Incentives74
- Confidence44
A low-privilege login reaches code execution on Rockwell's FactoryTalk Historian ME
CISA's advisory covers Series B 5.202 and Series C 7.101 across five critical infrastructure sectors, but the published text carries no CVSS vectors and no corrected version numbers for an asset owner to upgrade to.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap−12
- Incentives55
- Confidence58
Helsinki appeals court restores Finnish jurisdiction over the Eagle S officers
The court accepted that the anchor drop may have been an accident, then held that the three hours of dragging after Finnish authorities radioed the ship were not, and that distinction is where the jurisdiction comes from.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap0
- Incentives62
- Confidence66
Avengers AI Labs holds about 5 million combat-labelled frames, and the UK is the first foreign partner let in. The first technology out of the deal guards a British base perimeter.
Reality
- Evidence55
- Adoption40
- Hype gap+30
- Incentives80
- Confidence62
A $22.3m counter-drone contract that buys warning time, not shootdowns
Powerus has been commissioned to wire sensors around Middle East oil and gas fields. The deal detects and classifies; it does not intercept, and nobody has said how many sites it covers.
Reality
- Evidence26
- Adoption17
- Hype gap+18
- Incentives78
- Confidence33
Counter-drone authority grew in Washington. The risk still sits with the operator.
AUVSI's chief executive told a critical-infrastructure institute that expanded counter-drone powers are progress and not enough. The interval belongs to operators.
Reality
- Evidence20
- Adoption
- Not scored
- Hype gap+32
- Incentives70
- Confidence30
Congress asks GAO to price CISA's missing third, before the next 900 cuts land
House Democrats want the watchdog to measure what the loss of nearly 1,000 CISA staff did to the mission. The fiscal 2027 request would remove about 900 more, and GAO has not yet agreed to take the job.
Reality
- Evidence62
- Adoption30
- Hype gap+10
- Incentives58
- Confidence55
California's AI security push is really a hiring order: one AI cyber officer per agency
Newsom's initiative pairs a per-agency AI cybersecurity officer mandate with an AI defense program housed in the state's Cybersecurity Integration Center.
Reality
- Evidence26
- Adoption
- Not scored
- Hype gap+32
- Incentives58
- Confidence34