• A Charles Sturt University AI and cybersecurity researcher warns water engineers and other utilities providers that cyber resilience is an organisation’s survival skill
• Unlike other sectors, a successful hacker attack on power or water utility operators doesn’t just disrupt service, it can endanger public health and national security
• The potential public impacts of being without electricity, heat, or clean water for even a short period can be significant

A Charles Sturt University academic and researcher has urged cyber experts and water and environmental engineers to collaborate to protect vital civic infrastructure such as water, sewerage and storm water systems against malign hackers’ attacks.

Delivering a keynote address at the Fourth International Conference on Water and Environmental Engineering (iCWEE 2025) in Sydney in mid-November, Associate Professor in Computing Rafiqul Islam in the Charles Sturt School of Computing, Mathematics and Engineering explained that the number of malign cyberattacks globally had increase dramatically in recent years.

“Probing and cyberattacks by single nation-states and others have occurred against utilities, particularly power and water, around the world and in Australian cities and regional areas,” Professor Islam said.

“This is why earlier this month the Director General of the Australian Security and Intelligence Organisation (ASIO) Mr Mike Burgess warned in a recent speech to an Australian Securities and Investment Commission (ASIC) forum in Melbourne that Australia had entered an era of ‘strategic surprise and security fragility’.”

Professor Islam reiterated Mr Burgess’s warnings that Australia had reached the threshold for high-impact sabotage, was bracing for major disruption, and that the hacking activity was ‘highly sophisticated’ and designed to gain persistent, undetected access to systems.

“In the case of a Water Distribution System (WDS), it consists of a network of reservoirs, pumps, storage tanks, pipes, junctions, valves, and taps etc, and today’s WDSs consists of hundreds of Internet of Things (IoTs) sensors which are digital entry points and make the whole system vulnerable to attacks,” Professor Islam said.

“The ASIO chief has rightly warned that once hackers have penetrated a network they actively and aggressively map the systems and seek to maintain persistent undetected access that enables them to conduct sabotage at a time and moment of their choosing.”

At the iCWEE 2025 conference Professor Islam explained that he and colleagues had conducted research with Large Language Models (LLMs) ─ AI programs trained on vast datasets ─ to explore the best ways to detect and counter cyberattacks on water and other utility systems.

“AI in critical infrastructure is not ‘set and forget’; continuous monitoring is essential,” he said. “Monitoring, measurement, and improvement are core AI lifecycle functions, and continuous monitoring is required across the full AI lifecycle.”

This requires ongoing tracking of model performance, errors, and unusual behaviours which means planned retraining, refresh cycles, and controlled model upgrades.

“It is therefore vital that we recognise that cyber resilience is an organisation’s survival skill, it’s not just IT’s job,” he said.

Professor Islam’s presentation at the iCWEE 2025 conference was titled ‘Secure and Smart: AI-driven cyber resiliency in water engineering making cyber-physical water systems safer, not just smarter’.