An alarm is a promise. It says: if something goes wrong, you'll hear about it.
Now imagine someone quietly breaks that promise and doesn't tell you.
In late August 2026, attackers reached two small, privately owned water utilities in Colorado. Each one serves fewer than 200 people. According to the governor's office, the attackers changed equipment settings, disabled remote access and alarms, and changed the pumping cycles.3
The ending was a good one. The state said the disruptions were brief, and that there were no known impacts on water treatment, water quality, or public safety.3 Somebody noticed. Somebody fixed it.
But look at the list of what the attackers touched. Settings. Remote access. Alarms. Pumping cycles. Each one is a different way of losing sight. Change the settings, and the equipment does something the operator didn't choose. Kill remote access, and the operator has to drive out to see. Silence the alarms, and the system stops telling anyone when something drifts. Change the pumping cycles, and the water moves on someone else's schedule.
That's why, in water, kicking out the attacker is only half the job.
Say Findavi spots trouble at a pump station and, with the operator's approval, blocks the bad connection. The attacker is out. Good. Now the real questions start. Are the settings back to what the operator chose? Does remote access work for the people who should have it? Will the alarm sound if the tank runs low? Is the pump running on the right schedule?
That's why Findavi checks each action twice: one check for security and one for service. The door is closed, and the alarms, the remote access, and the pumping all still work. Both have to pass before the job counts as done.
If we can't show the alarm will still sound, or that the operator can still see and control the site, the issue stays open. Cutting off the attacker is not the finish line.
This is the same idea at the heart of this whole series, and water is where it matters most. An attack you stop but can't verify is just a quieter problem.