30+
Minnesota water and wastewater utilities hit in a single coordinated weekend in July 2026. In Braham, operators lost control of their own plant until staff restored it by hand.
Cloud Security Alliance, July 2026Water plants, substations, and pipelines run on commands, readings, and clocks they accept without question. DOR proves each one is authentic before your equipment acts on it, so when the screen says normal, it is.
This is already happening.
The attacks on infrastructure in 2025 and 2026 did not need to break anything. They changed what equipment was told and what operators were shown.
900+
cybersecurity vulnerabilities EPA has identified at U.S. water systems since 2025. EPA officials say attackers are now manipulating operator screens to change critical settings.
EPA officials to Fox News, October 2026Dec 29, 2025
the day coordinated attacks damaged controllers at more than 30 wind and solar farms in Poland, cutting them off from remote control, and targeted a plant that heats almost half a million customers.
CERT Polska, January 20264 hours
a dam's outflow ran open in Norway after attackers took over its controls in April 2025, releasing about 500 liters of water every second.
Security Affairs, August 202510 ms
timing shifts of up to this size, sent by radio at a substation's GPS clock, made protection trip a healthy transformer in a 2026 lab test. The attack never touched the network.
Karlsruhe Institute of Technology, July 2026300+
Intermarché and Netto stores in France whose refrigeration was remotely forced into defrost in October 2026, pushing some cases as high as 122°F. The food supply runs on control systems too.
Al Jazeera, October 2026Every command, reading, and clock, proven.
Power, water, and pipelines run on different equipment and share one weakness. They act on what they are told.
Power and the GridGeneration, transmission, and distribution, from the control room to the substation to the solar field.Water and WastewaterTreatment plants, towers, and lift stations, most of them run by small teams.Oil, Gas, and PipelinesWells, pipelines, and terminals controlled across hundreds of miles.Across Every SiteThe ways in that every operator shares.
Power and the Grid
Generation, transmission, and distribution, from the control room to the substation to the solar field.
P-01
The control room
Operators decide from the screens in front of them, and those screens can be made to show normal while equipment is pushed toward failure. DOR proves every reading came from the device it names, unchanged, and holds any command it cannot prove before it reaches a breaker or controller.
P-02
Substations and grid time
Protection relays and grid measurements keep time by GPS, and a shift of a few thousandths of a second can trip a healthy transformer. DOR checks time where it enters the substation and holds a clock that fails, so protection acts on the true time.
P-03
Wind, solar, and storage
Renewable sites are run from a distance through controllers, inverters, and cellular links. DOR verifies every setpoint and command on those links and confirms each device is the one registered to the site.
P-04
Equipment you did not build
Inverters, batteries, and controllers can arrive with parts and communication paths no one documented. DOR watches equipment while it runs, so a device behaving outside what was approved is flagged and recorded.
Water and Wastewater
Treatment plants, towers, and lift stations, most of them run by small teams.
W-01
Control logic
In 2026, attackers downloaded water plant controller programs, changed them, and disabled alarms and shutdowns. DOR checks control programs before they load and confirms the one running is the one you approved, so changed logic is held instead of run.
W-02
What the operator sees
A false pressure, flow, or chemical reading can hide a problem or start a needless shutdown. DOR proves each value on the screen came from the sensor it names, so an altered display is caught.
W-03
Towers and lift stations
Remote sites talk to the plant over cellular modems, and in 2026 utilities had to disconnect them to stop an attack. DOR verifies every command at the site where it arrives, so the link carrying it no longer decides who is in control.
W-04
Small systems
Most water systems serve small towns with a handful of operators and no security staff. DOR is built to the system already in place and runs on its own, with no outside service to subscribe to or reach.
Oil, Gas, and Pipelines
Wells, pipelines, and terminals controlled across hundreds of miles.
G-01
Field controllers
Controllers at wellpads, compressor stations, and valve sites turn commands into pressure and flow. DOR holds any command it cannot prove before the equipment acts, and records who sent it.
G-02
Pipeline readings
Leak detection depends on pressure and flow readings that can be altered on the way in, hiding a leak or forcing a costly shutdown. DOR proves each reading is unaltered from the instrument to the control room.
G-03
Measurement and custody transfer
Meter records decide what changes hands and what gets billed between companies. DOR makes every record provable, so a disputed volume is settled with evidence.
Across Every Site
The ways in that every operator shares.
X-01
Vendor and remote access
Equipment makers and integrators log in from outside to maintain your systems. DOR holds every remote action to what was approved, with a name and a reason recorded for each one.
X-02
Laptops, updates, and USB drives
The tools that program your controllers are also the easiest way in. DOR accepts only registered devices and checks updates and files before they touch the system.
X-03
Calls and orders to operators
An urgent call from someone who sounds like a supervisor or a vendor can talk an operator into acting. DOR confirms who sent a request before anyone acts on it, and flags a cloned voice while the call is happening.
X-04
After an incident
Attackers erase and edit logs to hide what they did. DOR keeps a record of what your systems received and acted on that cannot be edited, so recovery and investigation start from what actually happened.
X-05
The rules you answer to
NERC CIP for the bulk power system, TSA security directives for pipelines, risk and resilience assessments for water systems, and the federal cyber incident reporting rule now in final review all ask operators to show what their systems did. DOR produces that record.
How DOR works with you.
No new equipment to rip out. No dependence on a link to the outside. Every deployment starts with your systems as they are.
Walk the system
DOR maps what your control systems receive and act on, from the field device to the historian.
Build to it
Every deployment is built to your equipment, your operators, and the rules you answer to.
Deploy on what you run
DOR runs as software on the systems you already operate, fully offline. Where a site has nothing suitable, DOR provides a compact host built for it.
Hand over the evidence
You get a record of what was checked, what was held, and why. It cannot be edited.
Inside every deployment
- Verification where it arrives
- Commands, readings, files, and time are proven authentic before your systems act on them.
- A hold, not just an alarm
- Anything that fails is held. It moves only when an authorized person releases it with a recorded reason.
- A record that stands
- What was checked, held, and released, kept in a record no one can edit.
Questions operators ask.
Straight answers to what utility, pipeline, and plant leaders ask first.
Does DOR replace our firewalls, OT monitoring, or network segmentation?
No. Those tools decide where traffic can go and watch for trouble. DOR proves the commands, readings, and files are authentic before your systems act on them, so it strengthens what you have already built.
Our controllers are 15 to 20 years old. Do we have to replace them?
No. DOR works where commands, readings, and files enter your control system: the engineering workstations, operator and SCADA servers, and gateways. The equipment in the field stays as it is.
Does DOR need internet access or a cloud service?
No. DOR runs fully offline and depends on no outside service to verify anything, so it fits segmented and isolated control networks.
Will DOR slow down our control systems?
DOR verifies at the pace of the system it protects. Every deployment is built and tested against your equipment before it goes live.
What happens to a command DOR cannot verify?
It is held before it reaches the equipment. Operators see it, and it moves only when an authorized person releases it with a recorded reason.
Does DOR ever block our safety systems?
No. Emergency shutdown and safety functions are designed into every deployment with your engineers, and DOR never stands between them and the process they protect.
How does DOR help with NERC CIP, TSA pipeline directives, water risk assessments, and federal incident reporting?
Each asks operators to show what their systems did and when. DOR produces a verifiable record of what your systems received, checked, and acted on that cannot be edited, which supports audits, assessments, and incident reports. The federal cyber incident reporting rule under CIRCIA has been in final White House review since October 1, 2026, and would require covered entities to report substantial incidents within 72 hours.
Is DOR only for large utilities?
No. Every deployment is built to the system in front of it, from a small-town water plant to a regional grid operator.
What does an engagement with DOR look like?
DOR walks your systems, builds to your equipment and rules, deploys on what you already run, and hands you the evidence. It starts with a briefing.
Reference
The Critical Infrastructure Reference.
The full list behind this page: how power, water, and pipeline systems get fooled, in plain language, with what DOR does about each one.
Critical Infrastructure
Start with a briefing.
Bring your control system diagram, or just the questions keeping your operators up at night. DOR will show you exactly where it fits.