Cybersecurity Pre-Positioning in U.S. Water Utility Networks: Simulation Diagnostic and Coverage Gap Assessment

The timestamp on the message read two minutes ahead of the clock on the wall. The content was a single sentence: the servers are lying. The room filed it as a curiosity. Gloria filed it as a confirmation.

Thirty insurance executives gathered in a conference space above Times Square on a Tuesday morning to run a scenario the industry has not yet had to execute for real. The scenario: 5,000 water utilities compromised by Chinese military actors operating under the designation Volt Typhoon, present in American networks since at least 2023, possibly earlier. The intrusion was not for data collection. The access was maintained quietly, using techniques that blend into normal system operations, waiting for a moment of strategic necessity that has not yet arrived.

The simulation was a diagnostic. The findings were not encouraging.

Volt Typhoon was first disclosed in May 2023, identified inside networks spanning manufacturing, telecommunications, and the electric grid. The disclosure came from Microsoft, the NSA, and CISA working in coordination. What the disclosure named was the technique: living off the land, meaning the intrusion uses the target system's own tools rather than imported malware, which makes detection dependent on behavioral analysis rather than signature matching. Municipal water utilities do not generally have the budget for 24-hour behavioral monitoring. The actors know this. The access points remain.

Joe Slowik, who tracks threat actors for the energy sector, has confirmed the intrusions continue. Some have been caught. Most have not. Jen Easterly, former CISA director, described what has been found as the visible portion of a much larger problem: access points distributed across civilian infrastructure, maintained at low cost, indexed against a future crisis in the Taiwan Strait. Rob Joyce, former NSA cybersecurity director, described the engineering reality without softening it. The access constitutes the digital equivalent of explosives attached to the backbone of American infrastructure. That is a structural description, not a rhetorical one.

In four of the six nearby timelines, the targeted utilities patched their network edge devices within six months of the May 2023 disclosure. In two, they did not. The simulation in the conference room above Times Square explored a third condition: a timeline where the disclosure was received but never fully absorbed, because the capacity to act on it was never funded. The number that defines this condition is 450. Approximately 450 of the 151,000 water utilities operating in this timeline participate in cybersecurity information sharing groups. That is 0.3 percent. In adjacent timelines where participation reached 2 percent, then 5 percent, the pre-positioning was detected earlier. The simulation would not have been necessary.

The structural detail the simulation surfaced is not the intrusion itself but the insurance switch. When a critical infrastructure operator experiences a catastrophic cyber event, the first call is typically to the insurer. The insurer controls the budget for incident responders. The insurer therefore controls, in practice, which systems get restored first and in what order. The thirty executives were divided into teams and asked to prioritize: human life, economic continuity, or military mobility. The teams chose human life. One participant noted that this choice might violate existing contracts, conflict with federal continuity-of-government strategy, and expose the companies to shareholder litigation. The room went quiet.

The quiet identified the actual failure. Two sets of operational instructions are running on the same system. One says to save lives. One says to honor the contract. Both were written by people who intended them to work. They cannot both execute when the scenario is catastrophic enough. This is not a failure of intent. It is a version conflict, and version conflicts do not resolve themselves.

Mark Camillo of CyberAcuView named the coverage problem directly. A catastrophic cyberattack on water infrastructure may be uninsurable at current scale. The costs could exceed what the industry can absorb. The available exits are two: invoke act-of-war exclusions and walk away from the claims, which would destroy the functional relationship between the industry and its policyholders, or establish a government backstop structured like the Terrorism Risk Insurance Act, funded by policyholder payments after the event. Neither option is clean. Both require decisions that have not been made.

Joshua Corman argued for a different framing. Insurance is currently a response mechanism. It could be a prevention mechanism. Policies could require policyholders to patch vulnerable edge devices as a condition of coverage. Participation in information sharing groups could be mandated rather than encouraged. The 0.3 percent participation rate is not a fixed condition. It is a variable that responds to incentives. Insurance is an incentive structure. The industry has not yet used it this way for critical infrastructure cybersecurity, but the simulation suggests the window for choosing that option is not permanent.

The simulation ended without a winner. This was noted by participants as realistic. The scenario was designed to surface the gaps, not to model a successful response. The gaps it surfaced: inadequate information sharing infrastructure, coverage terms that were not written for this category of event, no established federal backstop, and a detection problem that money could solve but that no current funding mechanism is directed at solving.

In Timeline 3, a water main in the eastern district was completed thirty-one days ahead of schedule. The accelerated timeline meant the network segment attached to that main was upgraded in the same maintenance window. The upgrade included patching the edge devices. The pre-positioning in that segment was found during a routine audit eight months later. Found, documented, removed. In this timeline, the maintenance window happened on a different schedule. The patch did not ship in the same window. The edge devices are running the version they were running when the disclosure was made.

The simulation is not the diagnostic. The simulation is the documentation that the diagnostic has been deferred. The actual diagnostic is the 0.3 percent. That number is the system state. Everything else is consequence.

Advisory: patch the edge devices before the scenario stops being a simulation.