A utility board doesn't think in ports and passwords. It thinks in three things: safe water, steady service, and the public's trust. If you want ten minutes of real attention, speak that language.
Start with the summer of 2026. More than 30 water systems hit in one state in one night.1 Utilities in at least seven states reporting attacks within days, some running their plants by hand, some issuing boil-water notices.2 Two tiny utilities with their alarms switched off.3 None of these were big cities. And that matters. Smaller systems often have the fewest people watching.
Then bring it home. Ask the board one question: what would a single boil-water notice cost us? Count the overtime for operators running sites by hand. The calls from residents. The local news crew in the parking lot. The questions from regulators. The trust that took years to build. Many boards can answer that faster than any security vendor.
Now show what you'd measure, in three levels, and be clear about which is which.
Level one is what you found. Hard facts from your own system. How many controllers and screens could be reached from outside. How many still had factory passwords. How many remote sites talk over links nobody watches. How many doors you closed, with proof they stayed closed.
Level two is the time you saved. How many hours your operators used to spend driving to sites, chasing vendors, or checking things by hand, and how many it takes now. Multiply by what those hours actually cost.
Level three is the trouble you avoided. This one is an estimate, so say so. Show your assumptions and let the board push back. Being honest about this number is what makes the first two believable.
And before anyone says there's no budget, check whether your state, your water association, or a federal program offers help paying for cybersecurity work. It's worth one phone call.
Then make one small, clear ask.
Findavi Operational Blind Spot Assessment
A scoped, on-site assessment of connected devices, exposed paths, accountable owners, and supported response options.
Don't start with the whole system. Start with one place. One treatment plant. One set of remote pump stations. One radio network. Pick the spot that worries you most.
We ship you a small box with Findavi already loaded. It plugs into a monitoring port, listens without touching anything, and keeps your data on your own network.
You get a report you can act on: every connected device we found, the paths an attacker could use, who owns each problem, what to fix first ranked by what it means for the water, the safe ways to fix it, and what the security check and the service check will each confirm.
One site. Real evidence. A plan your operators can live with.