Iran's attacks on US water systems are just the beginning

As a teenager, I was capable of hacking into critical municipal infrastructure. I wasn’t an elite operator, but I knew where the vulnerabilities were and how to get around systems that weren’t even protected in the first place. From default passwords to open ports, attackers don’t need to be brilliant when defenders leave doors open. This approach is exactly how Iranian-linked hackers locked municipalities out of their own water systems across multiple states this summer, changing passwords, cutting off access and forcing utilities back to manual pumps and valves. I wasn’t surprised that it happened — I was surprised it took this long. And the scariest part is how little sophistication it took to disrupt something as fundamental as water. These vulnerabilities have been around for years; the war with Iran is just escalating the attacks. Critical infrastructure defense still runs on human timelines, while attackers, increasingly augmented by artificial intelligence, operate continuously. As long as the Iran conflict remains unresolved, this attack surface stays open, and water is just the beginning. The clear goal of these attackers is to shake confidence in the systems people rely on without thinking about them. Clean water from the tap, lights that turn on, and trains that run on time. It’s asymmetric warfare, a way to inflict outsized damage without ever matching the other side militarily. They don’t need to breach a bank or cross a border to cause panic. They just have to …