OT Cybersecurity

Can You Still Run the Plant by Hand? Manual Fallback as an OT Security Control

By Denrich Sananda 23-10-2026 8 min read

During the 2026 campaign against US water systems, the advice from federal agencies was unusually direct. Take the affected systems offline and switch to manual mode. Utilities in at least seven states had reported incidents to the FBI since 27 July, with more than 30 community water systems targeted in Minnesota and nine in Michigan, and the recommended response was to stop relying on the automation entirely.

That advice contains an assumption worth examining, because it applies to every industrial operator and not only to water. It assumes manual mode works. It assumes somebody knows the procedure, that the procedure is current, that the physical means to execute it still exists, and that the people on shift tonight have done it before. In most facilities we assess, at least one of those four is untrue.

What the attackers actually did

The FBI described actors remotely accessing internet-facing computers used by water utilities and changing settings, IP addresses and passwords. In some cases the attacks weakened operators' ability to monitor and control their equipment. Consequences reported by the agency included loss of water pressure and flooding, though it did not say where. Reported effects on the public ranged from low pressure in homes to boil-water notices, and there were no reports of drinking water contamination.

Note the mechanism. In several cases this was not destruction, it was dispossession: credentials changed, operators locked out, visibility and control removed while the physical process kept running. In Braham, Minnesota, a cyberattack shut down the controls for the city's well and treatment plant, and the city temporarily relied on its water tower stores. That is manual fallback working, and it bought them time.

The attribution position, for accuracy

Federal agencies have described the actors only as "malicious cyber actors" and have not identified their identity or motivation. Officials speaking anonymously to news outlets have suggested Iran, and CISA's advisory warns of ongoing Iranian-affiliated targeting of internet-connected operational technology, but the FBI opened an investigation without attributing responsibility and agencies have not publicly named the group or groups involved. Treat any confident attribution you read as unconfirmed.

Why losing control is different from losing data

Joshua Corman of the Institute for Security and Technology put the stakes in terms that travel well beyond the water sector: no water is no hospital in two to four hours. Water service failures reach hospitals, businesses and fire response quickly, which means a municipal utility's resilience is an input to everyone downstream of it.

The same logic applies inside a plant. A compromise that takes your control system away does not stop the physics. Pressure still builds, tanks still fill, exothermic reactions still proceed. The question is not whether you can restore the system, which may take days, but whether you can hold the process in a safe and productive state while you do. Our analysis of how attackers stop a plant without touching a controller covers the dependency side of this problem.

What manual capability actually requires

Four things, and the gaps are rarely where people expect.

Requirement	What usually goes wrong
A written procedure	It exists but was written at commissioning, references equipment that has since been replaced, and nobody has read it in a decade.
Physical means	Manual valves have been removed, seized, or replaced with actuated valves that have no local override. The procedure assumes a handwheel that is no longer there.
Information without the HMI	Local gauges and indicators were decommissioned because the HMI showed everything. Running manually requires knowing the process state from the equipment itself.
People who have done it	The operators who ran this plant before automation have retired. Manual operation is institutional memory, and institutional memory leaves.

The third row is the one that catches modern facilities hardest. A plant commissioned twenty years ago usually retains local instrumentation. A plant modernized five years ago often does not, because removing redundant local gauges was a reasonable cost saving at the time and nobody framed it as removing the fallback.

The scale problem in water, and why it generalizes

There are roughly 148,000 public drinking water systems in the United States, of which about 50,000 supply residents year-round. They vary enormously. As Kevin Morley of the American Water Works Association notes, what a compromise means depends entirely on the device: it could be a pump, a motor, or something as simple as a tank-level log reporting whether a tank is full. The association has argued for nationwide minimum cybersecurity requirements while acknowledging that universal standards are hard to write, because what is right for one utility is not right for another.

That fragmentation is why manual capability matters more here than almost anywhere else. A large refinery has engineers, budget and a security program. A town water system may have a handful of staff and no dedicated OT resource at all. For those operators, degraded-mode operation is not a secondary control behind a sophisticated detection stack. It may be the primary one, because it does not require a budget, a vendor or a specialist.

Testing it

Pick one process and run it manually, deliberately, in a planned window. Not a tabletop. Actually do it. Everything you discover in the first hour is something you would otherwise have discovered during an incident.
Check the physical means before you plan the test. Walk the line and confirm the valves, overrides and local indicators your procedure assumes still exist and still move.
Time it. How long from losing the HMI to stable manual operation. That number is your actual resilience figure and it belongs in your risk register.
Record what the process looks like without the HMI. Which local readings matter, where they are, and what good looks like. This is the document that does not exist in most plants.
Involve night shift. Incidents are not considerate about timing, and the crew with the least support is the one most likely to face it.
Keep the safety case in view. Manual operation changes which protective functions you are relying on. That is a safety and security boundary question, not purely an operations one.

Where this sits alongside the technical controls

None of this replaces getting controllers off the public internet, segmenting properly or monitoring the conduits. Those remain the controls that prevent the incident, and our analysis of the logic manipulation seen in this campaign covers why exposure is the root issue. Manual capability is what limits the consequence when prevention fails, which is a different job. Operators who treat the two as alternatives usually end up with neither funded.

Why Choose Arista Cyber

We assess degraded-mode capability as part of OT risk work rather than as an afterthought, because on a running plant it is often the control with the best return and the lowest cost. Our consultants hold functional safety credentials alongside OT security certification, so when manual operation changes which protective functions you depend on, we can assess that properly. See our OT risk assessments, our functional safety services and our case studies.

Next Steps

Pick your most critical process and ask three questions. Is there a current manual procedure. Does the physical means it assumes still exist. Has anyone on the current roster done it. If any answer is no, you have found work that costs almost nothing and matters more than most of what is on your security roadmap. As Corman puts it, you want to dig a well before you are thirsty.

Common Questions

What happened to US water utilities in 2026?

Utilities in at least seven states reported incidents to the FBI from 27 July 2026, with more than 30 community water systems targeted in Minnesota and nine in Michigan. The FBI described actors remotely accessing internet-facing computers and changing settings, IP addresses and passwords, which in some cases weakened operators' ability to monitor and control equipment.

Was drinking water contaminated?

There were no reports of drinking water contamination. Reported effects ranged from low pressure in homes to boil-water notices, and the FBI cited loss of water pressure and flooding among consequences without specifying locations.

Who was responsible?

Federal agencies have described the actors only as malicious cyber actors and have not identified them. Officials speaking anonymously have suggested Iran and CISA has warned of Iranian-affiliated targeting of internet-connected operational technology, but no group has been publicly named and the FBI opened its investigation without attributing responsibility.

What is manual fallback and why does it matter?

The ability to run a process safely without the automation. Federal advice during this campaign was to disconnect affected systems and switch to manual mode, which only helps if the procedure is current, the physical means still exist, the process state is readable without the HMI and someone on shift has done it.

How do we test manual operation?

Run one process manually in a planned window and time how long it takes to reach stable manual operation. Check first that the valves, overrides and local indicators your procedure assumes still exist, and include night shift.

If you lost your HMI tonight, how long until the process was stable?

Arista Cyber assesses degraded-mode capability alongside technical OT controls: manual procedure currency, physical means, local instrumentation, operator competence and what manual operation does to your safety case.

Request a resilience assessment