Chemical dosing manipulation
Sodium hydroxide overdose attempts (Oldsmar, 2021) show what unauthorized dosing changes look like before traditional alarms fire. The PLC write is fast — operator response can't be.
ICS-CERT AA21-042AOT integrity at Level 0 and Level 1 across drinking-water treatment, distribution, and wastewater operations — so dosing pumps, valves, level sensors, and disinfection systems behave the way safety and EPA compliance require.
Sodium hydroxide overdose attempts (Oldsmar, 2021) show what unauthorized dosing changes look like before traditional alarms fire. The PLC write is fast — operator response can't be.
ICS-CERT AA21-042AUnauthorized writes to pump-station controllers can drop distribution pressure, trigger boil-water notices, and stress aging mains. The damage is downstream and slow to recover.
Whether the source is a credentialed insider, a compromised engineering workstation, or a third-party integrator, unauthorized writes to dosing PLCs, valve controllers, and pump-station logic all surface the same way — as a PLC-side change OTegrity catches the moment it happens.
Slow chlorine residual or turbidity drift can hide MCL excursions that should trigger EPA reporting. The drift is invisible to alarm-only monitoring.
EPA SDWA MCLsSelf-calibrated baselines for dosing rates, valve actuation, and level controls — unauthorized deviations are detected within seconds, with no manual threshold tuning.
When dosing changes coincide with PLC program changes, OTegrity automatically classifies the event as a Cyber Attack — not as a fault or routine drift.
Equipment fault, sensor failure, drift, or cyber manipulation — every alert tells operations and the SOC the same thing, with the same evidence.
A live walkthrough on a process similar to yours — values, rates, timing, relationships, and classification — and how it fits alongside your existing stack.