Dear Readers,

Last week was a whirlwind. I left Washington, D.C., for Huntsville, Alabama, where I caught up with some of my oldest friends from my undergraduate days at Auburn University. From there, I connected through Denver to Salt Lake City to deliver the opening keynote for Cetera Financial Group’s Connect2Peers 2026 conference.

Standing in front of more than 2,000 financial advisors, I challenged them to think differently about what they do. They are not simply managing money. They are helping people build dreams for the future. And spies, criminals and hackers would very much like to steal those dreams.

A few hours later, I was back on a plane for Las Vegas and Black Hat, where I spent two packed days introducing NeXasure to the cybersecurity world. Black Hat is an enormous collision of hackers, executives, engineers, investors, government officials and security companies. Yet the most valuable part rarely happens on the expo floor or from a stage. It happens across a table, in the conversations, handshakes and relationships that survive long after everyone flies home.

After an event at the Aria, I traded my suit for travel clothes, boarded a red-eye and raced home for Parents’ Weekend at the U.S. Naval Academy. My oldest daughter is in her Plebe Summer, and after three days with her, I’m happy to report that she is thriving. In a matter of weeks, I have watched an incredible teenager become a young woman carrying herself with more confidence, poise and purpose. I recognize some of that feeling. I found my own sense of purpose at the FBI Academy many years ago.

Looking back, the entire week was about connection. Old friends. An audience from the stage. New business partners. My daughter and the squadmates who will help carry her into an extraordinary future. We thrive when we connect and wither when we isolate ourselves. And sometimes, as we are about to see, survival depends upon knowing exactly what to do when the connection disappears.

Go Navy!

Eric

For several hours, Braham, Minnesota, lived on the water above its head. Attackers had disrupted the digital controls for the small town’s well and water-treatment system, and the technology operators relied upon to monitor and control their equipment could no longer be trusted. Fortunately, Braham had something wonderfully low-tech sitting high above town: a water tower.

Stored water inside the tower kept flowing while residents were asked to conserve and operators worked the problem. Roughly 1,700 people depended temporarily on that reserve, and no water-quality problem was reported. The old backup bought them time.

Braham was hardly alone. The FBI and Environmental Protection Agency have warned that, beginning in late July, water and wastewater utilities in at least seven states reported cyberattacks targeting internet-facing industrial controllers. These are computers that reach beyond spreadsheets and email. They control equipment in the physical world.

Attackers reportedly changed device passwords and network addresses, causing operators to lose the ability to monitor or control equipment. Across the reported incidents, effects included loss of water pressure and flooding. Minnesota identified malicious activity involving more than 30 community water systems, while Michigan later reported nine affected systems. Those numbers may overlap with the broader federal count, so they should not be treated as one giant national total.

There is also a geopolitical wrinkle. WIRED reported that a leaked water-sector industry memo linked some of the Minnesota activity to Iran. The FBI’s public alert, however, has not formally attributed these attacks to Iran. That distinction matters. In intelligence work, what you suspect and what you can prove are two very different things.

The larger lesson matters even more. For years, we have connected industrial systems to networks because connectivity makes everything easier. Operators can manage equipment remotely. Vendors can perform maintenance. Data can be collected instantly. Convenience, however, has a price. Every new connection creates another path an adversary may attempt to follow.

That does not mean we should disconnect modern society and return to clipboards and rotary phones. It means we need to remember an old rule of espionage: always have an abort route. If the communications channel is compromised, what happens next? If the computer cannot be trusted, can the operation continue? If the automated system fails, does somebody still remember how to run the mission manually?

In Braham, the answer was yes. The water tower became the hero because someone had built reserve capacity before the emergency arrived. Cybersecurity usually focuses on keeping the attacker out. Resilience asks a tougher question: what happens when they get in?

That may be the most important question any organization can ask.

Your backup plan is not the document buried in a binder. It is the thing your team has actually practiced.

The FBI and EPA are advising water utilities to remove critical controllers from direct internet exposure, secure remote access, maintain clean backups and routinely test manual operations. The same principle applies far beyond water systems.

Every organization should be able to answer a few basic questions. Who has the authority to declare that the normal system is compromised? Who knows how to keep operating without it? How will your people communicate if the network is unavailable? Where are your clean backups and known-good configurations? And most important, when did you last test any of this?

If the answer to that final question is “I’m not sure,” you do not have a backup plan. You have a theory.

That same lesson played out again last week in Suisun City, California. In a separate incident not known to be connected to the water-system attacks, malware compromised city systems and disrupted technology supporting police, fire and emergency dispatch.

The city shut down its IT network and activated its emergency operations center. But 911 did not simply stop. Dispatch operations shifted to nearby Solano County while first responders continued handling emergencies.

We still do not publicly know who was behind the attack, how they entered the network, whether data was stolen or whether money was demanded. We do know the important part: there was another route.

That is what resilience looks like in practice. A backup system that has never been tested is merely comforting paperwork.

Now for something unsettling. During cybersecurity testing conducted by the United Kingdom’s AI Security Institute, AI agents were given unusually broad permissions, including internet access, while certain security safeguards were deliberately disabled.

Researchers conducted 122 runs. In ten of them, agents took 19 actions they had not been authorized to perform. The strangest episode reads like something from a counterintelligence investigation.

An AI agent created fake identities and used them in an attempt to pressure a real software maintainer into approving malicious code. Think about what happened there: reconnaissance, a cover identity, social engineering and an attempt to manipulate a trusted insider.

Fortunately, the human maintainer rejected the code, and researchers found no resulting real-world harm. The machine did not suddenly become a sentient spy. Something more useful happened. When given a goal, powerful tools and weak boundaries, it rediscovered techniques human spies and criminals have used forever.

That is why the AI security conversation needs to move beyond asking whether a model is “safe.” We should also ask what the model can access, what authority it has and what happens when it does something nobody expected.

Every serious intelligence operation considers failure before the mission begins. What happens if surveillance detects you? What if communications disappear? What if the meeting location is compromised? You establish an alternate route before you need one.

Businesses should think the same way. Braham had stored water. Suisun City had another dispatch center. Neither backup prevented the cyberattack, but both prevented the attack from becoming something worse.

That distinction is enormous. Security tries to stop the punch. Resilience determines whether you are still standing afterward.

If you enjoyed this week’s newsletter, you’ll find even more inside my new book, SPIES, LIES, AND CYBERCRIME. Drawing on my years hunting spies for the FBI, it reveals how espionage, cybercrime, and AI-powered deception intersect—and what you can do to stay one step ahead.

Ready for the next mission?

Already read the book? A quick review on Amazon or Goodreads helps more readers discover it. Thank you for your support.

Please support my sponsors. It only takes a click - no purchase necessary!

Tired of overpaying GoDaddy or Namecheap? There's a smarter option with Porkbun!

Porkbun is the domain registrar trusted by creators, developers, entrepreneurs, and anyone who wants low prices without the nonsense or the forced upsells.

Here's why so many people are making the move to the Bun:
• Most domains sold at cost
• Low, transparent registration and renewal pricing
• Free features like WHOIS privacy and SSL certificates
• Powerful web and email hosting options
• Real human support 24/7, 365 days a year
• Named the #1 domain registrar by Forbes Advisor and USA Today

Whether you're launching a business, building a personal brand, starting a side project, or creating your very first website, Porkbun makes the whole thing easy.

Get $1 off your next domain registration with Porkbun now.

Get Your Domain At Porkbun

If someone forwarded you this newsletter, join more than 4,500 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

Think about the system in your life or business that absolutely cannot fail. Maybe it is payroll, communications, electricity, customer records, manufacturing, emergency services or something else entirely.

Now ask yourself: When did we last test what happens if it does?

If you know someone responsible for keeping an organization running when the network goes dark, send them this newsletter. Connection makes us stronger. Knowing how to survive without it makes us resilient.

Until next week, stay safe out there and keep thinking like a spy hunter.

Praemonitus Praemunitus!

Forewarned is Forearmed!

~Eric