Key Takeaways
- Cyberattacks on the nation’s water infrastructure are rising, threatening drinking water supplies, ecosystems, and community stability.
- A William & Mary research team received a $170,000 ARII grant to create PROPHETESS, a multimodal agentic framework that predicts cyber‑attack scenarios and their physical, environmental, and economic impacts.
- PROPHETESS integrates cyber event data, news, advisories, technical docs, scientific charts, and geospatial imagery to generate understandable, actionable insights for operators, agencies, and policymakers.
- The project stresses community collaboration, leveraging existing VIMS‑Center partnerships and planning to engage local commissions, health departments, and sanitation districts.
- Ultimately, the team aims to deliver customized decision‑support interfaces that help utilities anticipate attacks, assess consequences, and strengthen defenses before a crisis occurs.
Escalating Threats to Water Infrastructure
As cyberattacks on the nation’s water infrastructure become more frequent, the systems that manage drinking water supplies face growing risks. A single breach could disrupt service, damage ecosystems, and leave entire communities scrambling to respond. The increasing reliance on internet‑connected operational technology amplifies these dangers, making proactive cyber‑risk management essential for public safety and environmental protection.
ARII Funding Supports Innovative Research
To address this emerging threat, a team of William & Mary researchers received a $170,000 award through the university’s Applied Research & Innovation Initiative (ARII). The grant funds a project aimed at developing a new approach for predicting, understanding, and preparing for cyberattacks on water infrastructure. ARII’s mission is to bring together multidisciplinary teams to tackle pressing societal challenges through applied research, and this effort exemplifies that goal.
Multidisciplinary Team Leadership
The project is led by Qingyun Wang, assistant professor of data science, and includes Stephen Herwig, assistant professor of computer science; Karinna Nunez, senior research scientist with the Center for Coastal Resources Management at William & Mary’s VIMS & Batten School; and three undergraduate and two graduate student researchers. This blend of expertise in data science, computer science, coastal resources, and student involvement ensures a comprehensive approach to the technical and societal dimensions of the problem.
Root Causes of Vulnerability
The team identifies several factors that heighten the nation’s water infrastructure vulnerability to cyber intrusions: pervasive internet connectivity, reliance on outdated software, weak password security, and limited financial and personnel resources for routine system updates. These weaknesses create entry points that malicious actors can exploit to gain control over critical physical processes.
Physical Consequences Highlighted
Stephen Herwig warned that if an attacker gains access to these computer systems, they can instruct physical actions such as opening a dam unexpectedly or cutting off or redirecting water supplies. Such manipulations could lead to immediate public‑health risks, flooding, or water scarcity, underscoring the need for defenses that go beyond protecting data alone.
Recommended Cybersecurity Hygiene
To mitigate these risks, operators are encouraged to adopt established cybersecurity best practices: changing default passwords, enforcing strict user access controls, limiting public‑facing internet exposure, and conducting regular penetration testing to uncover vulnerabilities before attackers can exploit them. While essential, these measures often focus narrowly on the operational technology layer.
Beyond Operational Technology
The project team argues that effective cyber risk assessment must extend beyond operational technology alone. Understanding how a cyber incident could cascade into environmental damage, economic loss, and community disruption requires a broader view that incorporates geospatial, social, and infrastructural data. Only then can stakeholders anticipate the full spectrum of potential consequences.
Introducing PROPHETESS
In response, the researchers propose PROPHETESS, a multimodal agentic framework designed to integrate diverse information sources—cyber event datasets, news reports, cybersecurity advisories, technical documentation, charts and tables from scientific publications, and geospatial imagery—to build a holistic picture of a facility’s potential vulnerabilities. By weaving together these strands, PROPHETESS aims to capture both cyber and physical dimensions of risk.
How PROPHETESS Works
Using this historical knowledge base, the framework identifies patterns, generates realistic cyberattack scenarios, and predicts how disruptions could affect surrounding communities, the environment, and the economy. By simulating a range of attack possibilities and forecasting their potential outcomes, PROPHETESS provides operational technology personnel, plant operators, environmental agencies, and policymakers with actionable insights to strengthen preparedness and improve response planning.
Bridging Technical Gaps with Language Models
Qingyun Wang explained the advantage of the agentic system: “With traditional automated penetration testing, you write code to simulate an attack, and the output is a list of identified vulnerabilities. For non‑experts, it’s difficult to understand what those results actually mean. Our agentic system, combined with a large language model, goes a step further by explaining not only the vulnerabilities themselves, but also the potential physical consequences of such a cyberattack.” This translation of technical findings into plain‑language narratives makes the information accessible to decision‑makers who may lack deep cybersecurity expertise.
Community Outreach and Partnerships
The success of PROPHETESS depends not only on technological innovation but also on close collaboration with the communities and agencies responsible for protecting critical infrastructure. Karinna Nunez emphasized, “Our work is grounded in applied science, and our goal is for it to be used to benefit communities. Local agencies value being involved in the process, and their participation helps ensure our research has a meaningful impact.”
Leveraging Existing Networks
Those relationships are built on longstanding partnerships with organizations working to protect Virginia’s coastal communities and critical infrastructure. Nunez noted, “The Center for Coastal Resources Management at VIMS has long‑lasting partnerships with the community. We hope to strengthen our collaborations with the Planning District Commissions to support efforts in risk mitigation and coastal resilience efforts, as well as continue working with the Virginia Department of Health and the Hampton Roads Sanitation District.” These ties ensure that the framework is tailored to real‑world operational contexts and local priorities.
Engagement in Cyber Fortress Exercise
The PROPHETESS team will also participate in the annual Cyber Fortress seminar in Virginia Beach next summer. This tabletop exercise brings together federal, state, local, and private‑sector partners to evaluate Virginia’s preparedness for cyberattacks on critical infrastructure. Participation will allow the researchers to test their framework in a realistic, collaborative setting and refine it based on feedback from seasoned responders.
Vision for Customized Decision‑Support Tools
Ultimately, the team hopes to develop customized interfaces that provide different stakeholders with the information most relevant to their needs. As cyber threats to critical infrastructure continue to evolve, the researchers envision PROPHETESS becoming a decision‑support tool that helps utilities and government agencies anticipate attacks, assess their potential consequences, and strengthen their defenses before a crisis occurs. By delivering clear, actionable insights, the framework aims to turn raw data into proactive resilience.
Broader ARII Context
Editor’s note: This project is one of three funded this year through ARII. The other initiatives include a study on how microplastics affect trout aquaculture—combining animal health, environmental chemistry, materials science, and public policy—and an investigation into how Afghan allies and their families navigate U.S. immigration systems and resettle nationwide. Together, these efforts illustrate ARII’s commitment to interdisciplinary, solutions‑oriented research that addresses pressing societal challenges.