Fortifying a Small Water Utility Against Hybrid Threats

Small water utilities are increasingly digitizing their operations to gain efficiency, but this development also exposes them to growing cyber-physical security risks, including hybrid threats potentially conducted by nation-state actors. Existing research and frameworks are often inaccessible to small utilities with limited resources and technical literacy. This study applies an Integrated Action Research (IAR) approach to co-develop and evaluate a sociotechnical framework aimed at enhancing operational resilience for a small Finnish water utility. By utilizing a set of custom workshop canvases to understand daily realities, the findings indicate that the most acute risks relate to human capital, technical continuity, and unclear communication chains. To provide immediate, actionable guidance, an A7-sized physical handbook was introduced to assist operators and the utility manager in navigating various cyber and hybrid threat scenarios. This proof-of-concept demonstrates a scalable model for other critical infrastructure sectors globally.