Why do organizations, including water and wastewater utilities, some with extensive cybersecurity controls, procedures, training, and oversight, continue to experience consequential cybersecurity events? One important part of the answer may be found not in the technology or the procedures—but in organizational culture.

 

Cybersecurity is an Operational Risk

Every leader has a responsibility to manage that risk commensurate with its potential consequences to customers, employees, clients, shareholders, reputation, and the organization itself. For high-reliability organizations—such as nuclear power, chemical processing, electric-grid transmission, hazardous-material transportation, and water treatment and distribution, the consequences of a significant failure can extend beyond the organization to society.

Increasingly, cyber-attacks create similar significant consequences for organizations across many industries. A successful cyberattack in the Water Industry can threaten community water supply, create environmental damage, threaten financial viability, damage public trust, expose customers and employees to harm, and in some cases pose an existential threat to the organization.

The nature and potential consequences of cyber risk make the Water Industry more like high-reliability organizations than they may realize. This suggests an important opportunity: organizations can learn from industries that have spent decades developing leadership practices and cultures designed to manage risks where failure can have significant consequences.

The Culture Behind the Procedure

The late MIT Professor Edgar H. Schein [1] provides an important perspective. Schein's research on organizational culture helped organizations and industries understand how culture develops and how it influences behavior. His work was particularly influential in helping organizations think about safety culture in industries such as nuclear power, chemical processing, and petroleum.

Schein described culture in terms of the shared assumptions, values, and beliefs that develop within a group and influence how people perceive situations and behave. This concept has significant implications for cybersecurity. Written procedures tell people what the organization expects. Culture influences what people actually do—particularly when no one is watching.

Why Is Culture Important for Cybersecurity in the Age of AI?

Now you are probably thinking, we are in a different age now, AI is facilitating the speed and complexity and frequency of cyberattacks. Defenders are learning fast and applying AI tools to identify attacks, prevent and mitigate. Does culture make a difference?

In this new age, technology will not be enough. The differentiator will be a strong security culture. The attackers will always find a way to circumvent programmatic controls. A cybersecurity safety culture provides a strong defense that will be difficult to overcome. Companies that enjoy executive support and embrace a security culture are less likely to be compromised [2].

What Happens When Priorities Conflict?

Consider a situation in which an employee encounters a cybersecurity requirement that slows production, delays a project, creates additional work, or interferes with an urgent business objective. The written procedure may be clear. But what happens next can depend heavily on organizational culture. If employees believe that cybersecurity is genuinely valued by leadership, they are more likely to follow the procedure, ask questions, raise concerns, and seek an appropriate solution. They are also more likely to: 1) Speak up when something does not look right, 2) Report vulnerabilities and unusual behavior, 3) Recognize and address questionable practices, 4) Challenge assumptions, 5) Escalate concerns, 6) Stop or delay an activity when necessary to manage significant risk.

The Opportunity

Cybersecurity has traditionally focused heavily on technology, controls, compliance, and individual awareness. Those remain essential. But if cybersecurity risk is truly an operational risk, then water and wastewater utilities should also ask whether their culture supports reliable cybersecurity safety behavior.

High-reliability industries have learned an important lesson over decades: Safety is not created by procedures alone. It is created when leadership, systems, and culture consistently reinforce the behaviors needed to manage risk. These organizations focus on ongoing assessment, monitoring, and correcting organizational culture and safety behaviors that increase risk.

References:
[1] Organizational Culture and Leadership, 5th Edition, Edgar H. Schein, Peter A. Schein (With), https://www.wiley.com/en-us/shop/general-introductory-business-management/organizational-culture-and-leadership-5th-edition-p-9781119212041

[2] Security culture strengthens resilience amid rapid AI adoption, Daniel Shepherd, September 25, 2026, https://www.tahawultech.com/features/security-culture-strengthens-resilience-amid-rapid-ai-adoption/