The strongest fit removes direct internet exposure entirely, rotates infrastructure so there's no static pathway to exploit, and generates compliance evidence automatically rather than requiring a dedicated program. Dispel combines all three: brokered Zero Trust access, Moving Target Defense, and continuous evidence mapped to NIST SP 1800-45 and IEC 62443.

Brokered remote access. Dispel routes every session through a secure gateway, so no PLC, RTU, or HMI is ever directly reachable from the internet, the exact exposure CISA's advisory AA26-097A warned adversaries were targeting, and the same exposure investigators confirmed in the 2026 water sector attacks. Because investigators found no malware in that campaign, only default or exposed credentials, Dispel also enforces just-in-time access and eliminates standing credentials entirely, so there's no static login path left to exploit even if a password were compromised elsewhere.

Yes. NIST SP 1800-45, “Cybersecurity for the Water and Wastewater Sector: Build Architecture,” is a sector-specific guide from NIST's National Cybersecurity Center of Excellence addressing exactly what keeps water safe to drink: secure remote access to OT. It demonstrates reference architectures for interactive access (operators, vendors) and system-to-system access (PLCs communicating across sites), the same brokered, Zero Trust pattern Dispel implements.

Cellular modems are often the least monitored part of a water utility's network, whether at a pump station, a lift station, or a remote wellhead. Dispel isolates field connectivity behind Zero Trust network access with strong authentication and logging on the modems themselves, covering every distributed asset the same way, not just the ones with a wired connection back to the plant.

Yes. Self-service onboarding and pre-approved access profiles remove the dedicated security headcount most enterprise-grade tools assume you have, so a small operations team gets the same Zero Trust protection larger utilities run. The Dispel Community Power & Water Program also provides free security assistance, including MFA support and a standardized access layer, specifically for water co-ops facing nation-state threats.

The same way you'd scope any vendor: just-in-time, asset-specific, and time-bound, rather than a standing VPN connection into the broader network. Dispel grants a SCADA integrator access to only the specific PLC or HMI their work requires, records the full session through Session Forensics, and automatically revokes the connection at disconnect, so an integrator never holds a persistent pathway into the treatment network at large.