Threat Intelligence & Security Insights.

July 2026 Threat Brief: When Cyber Incidents Become Operational Incidents For several organizations in July, a cyber incident did not stay behind a screen. Water utilities lost control of PLCs. Manufacturing lines stopped. Remote-access appliances provided paths into corporate environments. Credentials that had been sitting forgotten for years suddenly became useful to attackers. The common thread is not one vulnerability or threat actor. It is how quickly weaknesses in IT, identity, remote access, and OT can translate into consequences for the operation itself. Our July 2026 Monthly Threat Brief examines the incidents behind that shift and the lessons security and operational teams should take from them. Water Utilities Were Forced Back to Manual Control One of July's most significant developments began on July 26, when attackers exploited internet-exposed Rockwell PLCs at water utilities across seven states. Roughly 36 utilities in Minnesota were affected in a single weekend. Attackers locked operators…

Most of the behavior behind attacks on water systems can be detected without a single attacker IP or malware signature. Here is how Zeek and Suricata cover it, and why a person still has to make the call.