A white paper titled “Insider Threats in the Water Sector: A Growing and Underestimated Risk” by Alec Davison and David Pounder was published by the Institute for Homeland Security. The paper is worth a close read, not only for water utilities. The lessons apply broadly to critical infrastructure owners and operators.
Insider threats are a growing problem not only for the water and wastewater sector, but for every critical infrastructure organization writ large. This report argues that insider threats are fundamentally a human problem rooted in behavior and organizational culture rather than technology alone. To overcome this challenge, organizations should adopt a risk-informed, multidisciplinary approach spanning security, cybersecurity, HR, legal, and leadership to detect early warning signs and intervene before a seemingly innocuous concern becomes a serious security incident. Alec Davison
The central argument is simple but easy to overlook: even the strongest cybersecurity controls and the most resilient system architecture can be quickly defeated by an insider, someone who already has physical or privileged access.
The numbers back this up. Insider incidents now cost organizations an average of 19.5 million dollars a year, and more than half stem from negligence rather than malice. Documented cases have grown from 3,269 in 2018 to 7,868 in 2025. The paper also walks through real incidents, from a chemical dosing error in Oklahoma to a disgruntled former employee remotely disabling a treatment plant’s chlorination system in Massachusetts, that illustrate the wide range of insider risk: unintentional errors, personally motivated grievances, financially motivated theft, sabotage, workplace violence, and recruitment by foreign intelligence services.
The takeaway aligns with a principle we return to often: resilience comes from people, process, and culture working together, not from technology alone. Building a multidisciplinary team spanning cybersecurity, human resources, legal, and operations – essentially all facets of the operation – is essential to building resilience against an insider threat. Train your workforce to recognize behavioral warning signs and provide a clear, low-friction way to report concerns. Treat insider risk management as mission-essential, not an administrative afterthought.
Read the full white paper.
Understand the Threats.
Assess the Risks.
Take Action.
