Recent cyberattacks on U.S. water systems reveal critical vulnerabilities in operational technology, especially legacy PLCs and remote access methods.