Passive · read-only · never in the control loop

Your plant already knows. Now you can see it.

One pane for every pump, plant, and lift station. UtilityCockpit gives water and wastewater operators the reliability picture their SCADA screens don't show, and gives leadership continuous resilience evidence that reads like a report, not a log file.

● Pump health● Setpoint drift● Station rollups● Resilience evidence
~50,000
community water systems in the US; ~4,000 mid-market systems serve about 80% of the population
>70%
reported non-compliance with federal resilience requirements across the sector
24/7
continuous, passive visibility across every site you run
0
writes to your control system. Ever. Read-only by design
The gap

The paper says one thing. The physics says another.

Every utility has the same three artifacts: SCADA alarms, run tickets, and compliance paperwork. What almost none of them have is the layer that checks those against each other, and against what the water is actually doing.

1

The paper gets written

Risk assessments and emergency response plans get certified. Findings get filed. Maintenance logs get signed. The binder looks great.

2

The physics keeps moving

A setpoint drifts. A pump runs long. A chemical feed trends odd overnight. Each signal lives in a different screen, and nobody's job is to correlate them.

3

The gap lands on a thin crew

Retirements, one-deep roles, and on-call rotations mean the person who would have noticed is stretched across three other problems. Findings become shelf documents.

When the paper and the physics disagree, the plant is telling you something. UtilityCockpit is the layer that listens.
What you see

One platform, three audiences, zero touch on your controls

The same monitored data, surfaced for the people who need it. Operations gets a cockpit. Leadership gets a scorecard. IT gets an architecture it can approve in one meeting.

For operations

Reliability Cockpit

The shift-change screen your SCADA doesn't give you.
  • Pump health and runtime anomalies, compared against each pump's own history and its twin
  • Setpoint drift caught early, before it becomes a callout at 2am
  • Station rollups: every lift station, well, and tank on one screen
  • Early warnings written in operator language, with a recommended move
For leadership

Resilience Scorecard

Continuous evidence a council, board, or insurer can actually read.
  • Every risk-assessment finding tracked to closure, with proof attached
  • A single resilience score with the trend, not a binder
  • Ready for the next federal recertification cycle before it arrives
  • Emergency situational awareness when weather or main breaks hit
For IT

The easiest sign-off in the building

Reviewed by IT. Run for operations.
  • Passive and out-of-band: taps and read-only pulls, nothing inline
  • No agents on control hardware, no inbound path, no writes
  • Built on a platform your IT team likely already knows
  • Full audit trail of who saw what, when
Live demo

What it can do, through three sets of eyes

Switch tabs to move between the operator's cockpit, the leadership scorecard, and the IT review view. All data below is illustrative.

🔒 cockpit.yourutility.gov

Lift Station 4 Watch

Southside collection · 2 pumps, lead/lag · demo data
+38%
Pump 2 runtime vs twin
412 gpm
Current draw
Drifting
Wet-well cycle time
OK
Comms heartbeat
Early warning: Pump 2 is running 38% longer than Pump 1 for the same level change, and the gap is widening week over week. Consistent with impeller wear or a partial blockage. Recommended: swap lead/lag tonight and schedule an inspection before the weekend, while it's still a work order and not a callout.
Runtime per cycle, last 24 hours — Pump 2 vs Pump 1 (minutes)
Open itemSiteStatusWindow
Chemical feed setpoint drifting from baselineWTP No. 1AdvisoryVerify against bench test this week
Pump 2 runtime anomaly (this alert)Lift Station 4AdvisoryInspect before weekend
Tank telemetry gap, 02:00–02:40Elevated Tank 2ResolvedRadio path logged & closed

Resilience Scorecard Improving

Utility-wide · 30-day view · demo data
84/100
Resilience score
7 of 12
Assessment findings closed
11 min
Median time to spot an anomaly
100%
Evidence items with proof attached
Risk-assessment findings closed, trailing 6 months
FindingAction takenEvidenceStatus
No independent visibility into remote-site telemetryPassive monitoring across 4 stationsLive dashboard, 90-day historyClosed
No documented anomaly-response procedureRunbooks tied to each alert typeRunbook library, drill logClosed
Aging pump fleet, unknown conditionRuntime & health baselines per pumpHealth trend per assetIn progress

Every finding from your last risk assessment, tracked to closure, with evidence attached. When the next recertification cycle opens, the submission is already written.

Architecture review Read-only

Data flows one direction. There is no path back. · demo data
PLCs / SCADAuntouched, unchanged
Passive tap / SPANlistens, never speaks
Collectorread-only, out-of-band
Observability platformcorrelation & history
Dashboardscockpit & scorecard
0
Agents on control hardware
0
Inbound connections to OT
0
Writes, setpoint changes, commands
Full
Access & change audit trail
Review itemAnswer
Can this platform change anything in the control system?No. Collection is passive (network taps) or read-only (historian / API pulls). There is no write path.
What happens if the platform goes down?Nothing, operationally. It observes the process; it is not part of the process.
Who administers it?Delivered as a managed service. IT reviews architecture and access; operations consumes the outcome.
Demonstration only — all facilities, readings, and events shown are illustrative
How it's delivered

A managed outcome, not another system to run

Delivered by an established public-sector integrator: sensors and taps installed by a proven network bench, the platform run for you, detections and dashboards tuned to your plants, thresholds set by your operators. Your staff consume an outcome, not a science project.

Principles that make it work

  • Your operators set the thresholds. They correct scenario cards drawn from real, publicly documented utility incidents; nobody hands them a blank questionnaire.
  • Reliability first. The cockpit earns its keep on pump health and drift. Security evidence falls out of the same data, quietly.
  • The utility owns its data. Full history, exportable, yours.
  • Built on a mainstream platform, not a niche tool that disappears in three years.

How it's bought

  • Cooperative purchasing vehicles most utilities already use (state contracts and national co-ops), so a pilot doesn't wait on RFP machinery.
  • Start small: one plant or a handful of stations proves the method before anything scales.
  • Budget-realistic: priced for operating budgets. No grant dependency, no rate-case drama.
  • Already own the platform? If your city runs Splunk today, the cockpit lands on what you have. Faster still.
Getting started

One plant first. Then a program.

Prove the method where it's cheap to be wrong, with your operators grading our homework at every step.

01 · SCENARIO WORKSHOP

Come shoot holes in our list

A working session with your operators around 15 scenario cards drawn from real utility incidents. They correct the cards with your plants' normal numbers. Those corrections become the detection thresholds.

02 · REFERENCE PILOT

One site, passively instrumented

Taps and read-only pulls at one plant or station group. Roughly 30 to 60 days of baseline, with the cockpit live from week one. Nothing touches the control loop.

03 · SCORECARD TO LEADERSHIP

Findings become a funded plan

Your risk-assessment findings mapped to what the pilot proved, presented as a resilience roadmap your council or board can fund line by line.

04 · MANAGED STEADY STATE

Runs for you, grows with you

Thresholds tuned as seasons change, new stations added to the rollup, evidence accumulating for the next recertification cycle. Multi-site from day one if you run more than one system.

Who it's for

Built for the utility you actually run

Mid-market systems

10,000 to 100,000 served

Big enough that a bad week makes the news, small enough that nobody's hiring a data team. The core fit.

Multi-site

Authorities & districts

River authorities, regional districts, and utilities running many plants and dozens of remote sites on thin windshield time.

Door one

Cities that already own Splunk

The platform is already bought and IT already trusts it. The cockpit is an expansion, not a procurement.

Post-assessment

Fresh findings in hand

Just finished a risk and resilience assessment? The findings list is a funded to-do list. This is how it gets worked.

Growth cities

Systems scaling fast

New subdivisions, new stations, same crew. Visibility is how a growing system stays ahead of its own map.

Weather-exposed

Flood & storm country

When the water shows up all at once, a live rollup of every station becomes emergency situational awareness.

FAQ

The questions that come up first

Is this a cybersecurity project?

No. It's reliability visibility for operations. The same passive data does produce security-grade evidence, and your IT and security folks will like what they see, but the cockpit is built for the people who keep the water moving. If someone tries to sell you this as an IT project, they've misunderstood the job.

Does anything touch our SCADA, PLCs, or control loop?

Never. Collection is passive (network taps or SPAN ports) and read-only (historian or API pulls). There are no agents on control hardware, no inbound connections, and no write path. If the platform disappeared tomorrow, your process wouldn't notice.

We already have a SCADA integrator we trust.

Keep them. This doesn't replace controls work, programming, or panel builds. It watches the outputs of what they build and often hands them better work orders. Integrators tend to like it once they see it isn't aimed at them.

We already run Splunk on the city side.

Then you're most of the way there. The cockpit is delivered as content on the platform you own: dashboards, detections, and compliance mappings tuned for water. Existing licensing conversations are usually simpler than a new purchase.

How does this relate to our federal risk-assessment obligations?

The current certification deadlines have passed sector-wide, and the next recertification cycle arrives on a five-year clock. The findings from your last assessment are the working list; continuous evidence means the next certification is a printout, not a project. State-level rules are moving too, and this puts you ahead of them.

Do we need a grant for this?

No, and you shouldn't wait for one. The program is priced for operating budgets, and pilots start small on purpose. If grant money shows up later, it accelerates the rollout instead of gating the start.

Who sees our data?

You own it. Dashboards live in your environment, history is exportable, and the audit trail shows every access. The managed service operates it; it doesn't own it.

Bring us your worst week.

A 30-minute working conversation, not a pitch: we walk through the scenario cards, you tell us which ones are wrong, and we both find out fast whether this fits your system. If it doesn't, you keep the scenario list anyway.

Prefer email? info@utilitycockpit.com

We use your information only to respond to your request.
Source notes

Context and verification

  1. Sector scale: the US has roughly 50,000 community water systems; the minority serving 10,000+ people covers the large majority of the population (EPA community water system statistics; verify current figures at epa.gov).
  2. Federal resilience requirements: America's Water Infrastructure Act §2013 requires risk and resilience assessments and emergency response plans on a five-year recertification cycle; all current-cycle certification deadlines have passed, and sector reporting indicates a substantial majority of systems behind on requirements. Verify current status with EPA before relying on any figure.
  3. Incident grounding: the scenario library draws on publicly documented utility events, including Oldsmar, FL (2021), Aliquippa, PA (2023), Maroochy Shire, AU (2000), and the American Water incident (2024). Cards describe process symptoms, not attack tutorials.
  4. Regulatory landscape: no federal cybersecurity mandate for water systems is currently in force; federal and state rules are in motion and statuses change quickly. Nothing on this page is legal or compliance advice.
  5. Demo data: every facility, reading, and event shown on this page is illustrative and does not represent a real site or measurement.