The FBI Told You to Unplug. Now Who Answers the Phone at Two A.M.? 

In late July, the FBI, the EPA, and CISA advised water utilities and other critical infrastructure operators to disconnect their control systems from the public internet. Utilities in multiple states had reported attacks, and in some cases, plant operations were degraded badly enough to force a return to manual control.

The advisory is right: a controller running a pump, a valve, or a chemical feed should not be reachable from the open internet. However, most of these systems were not exposed by accident. An internet connection is how these plants have been getting help when a system is down. Most utilities do not have a large team of controls engineers on call. More often, it is one person, or a contractor, who logs in after hours to figure out what the system is doing. The same connection that lets a remote operator in to help the plant does not distinguish between them and an intruder.

What the advisory did not address is what happens the next morning, after the connection is gone.

When a fault occurs at 2 a.m., the hard part is not fixing it; it is knowing what to fix. An alarm and an HMI screen tell you something went wrong, not why. The answer is usually a level down, in the controller logic behind the alarm, which is not accessible through the panel. Without remote access, many utilities will go from getting something fixed in a 20-minute phone call to waiting 3 hours for someone to drive to their facility.

Closing the connection is the right security decision, but it costs the plant its fastest route to an answer. Under pressure to get back online, the temptation is to reopen it just for tonight — which puts the plant right back where the advisory said not to be.

This is the problem we built RAMP AI to solve. RAMP AI reasons over PLC logic, alarms, and fault history to guide a technician toward the root cause, without a live connection between the plant floor and the outside world. The architecture is air-gap compatible by design: no live OT connection, and no agent running on the controller itself. Your expert still gets what they need to diagnose the problem. The system does not open a path back in for anyone else to use.

If the guidance to disconnect has left your team deciding which of those two things you can afford to give up, we would like to talk with you about it. We will be attending AIMST in Atlanta, August 18 to 20, and would welcome the chance to meet in person and walk through how this works.