Trout Software and government IT provider Carahsoft Technology Corp have released a cybersecurity system designed to protect operational technology at US water and wastewater utilities.

The release of Access Gate v26.6 follows a coordinated wave of cyberattacks in late July that targeted operational technology (OT) at more than 30 municipal water systems in Minnesota, as well as facilities in Michigan and at least five other states.

During those incidents, hackers targeted internet-exposed programmable logic controllers (PLCs) and human-machine interfaces (HMIs), altering passwords and IP addresses to lock operators out of monitoring and control systems. The attacks prompted the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA) to issue joint warnings advising critical infrastructure operators to disconnect exposed PLCs from the internet and secure their OT environments.

Trout Software’s system segments OT assets to prevent lateral movement, ensuring that a compromised workstation cannot access PLCs, HMIs, or Supervisory Control and Data Acquisition (SCADA) systems without explicit policy permission. The software also replaces standing remote access for vendors with identity-based, time-limited grants.

“Small public IT teams are being asked to defend ageing water systems against modern threats and to document every step with resources stretched thin,” said Florian Doumenc, Chief Executive Officer at Trout Software.

The system maps its controls to emerging state cybersecurity requirements for drinking water and wastewater programmes, generating automated audit logs to assist utilities in demonstrating compliance to regulators. Carahsoft will distribute the software to public sector buyers through federal and state procurement contracts.