How an Australian water utility built cyber resilience across converging IT, OT infrastructure.

A major Australian water utility was facing a challenge familiar to critical infrastructure operators across Australia: as IT and OT systems increasingly converged, so did the risks.

The organisation needed a way to gain clear visibility over its vulnerability landscape, prioritise what mattered most, and act – without putting the water services that Australians depend on at risk.

That’s when the utility turned to Kinetic IT for guidance.

THE CHALLENGE

SECURITY COMPLEXITY IN A CRITICAL ENVIRONMENT

Water utilities operate differently from most organisations. The technology controlling water treatment, distribution, and wastewater services infrastructure is the backbone of Australian communities. Any disruption carries consequences that go well beyond system downtime.

For years, the utility’s OT systems operated in relative isolation from traditional IT networks. That separation offered a degree of natural protection. But as IT and OT environments converged to support smarter, more connected operations, the attack surface grew.

Several challenges stood out:

• Limited visibility across a geographically dispersed environment, with no unified view of vulnerabilities spanning both IT and OT systems.
• No consistent framework for prioritisation, making it difficult to determine which risks posed the greatest threat to operational continuity.
• Fragmented remediation processes, relying on manual effort and increasing the risk of gaps or delays.
• Growing obligations under the Security of Critical Infrastructure (SOCI) Act 2018, requiring a more structured, evidenced approach to risk management.
• The organisation needed a solution that would elevate its security capability without adding operational complexity – or creating new risks in the process.

THE SOLUTION

HOW KINETIC IT HELPED

Kinetic IT, a ServiceNow Elite Partner, collaborated with the utility to implement ServiceNow Vulnerability Response in a way that aligned to how the organisation actually worked.

“The goal wasn’t just to provide more data,” explains Dan Spada, Kinetic IT’s Head of Service Integration.

“It was to give response teams the right data, structured in a way that directly highlighted risk to focus remediation activities across a live, operational environment.”

Before any configuration began, the team worked closely with the utility’s IT and OT teams to understand the operational context of their assets – what they control, what the consequences of an outage would be, and how vulnerabilities should be prioritised as a result.

Key activities included:

• Configuring business-critical prioritisation to triage vulnerabilities based on operational impact, not just severity score.
• Deploying automated workflows to streamline remediation, manage approvals, and handle risk exceptions consistently.
• Integrating the solution with the utility’s existing technology landscape to ensure a smooth transition with no gaps in coverage.

WHAT WE FOUND

Once ServiceNow Vulnerability Response was operational, the scale of what was now visible – and manageable – came into focus:

• 87,300 active vulnerabilities across IT and OT infrastructure, now centrally monitored in real time.
• 420 vulnerabilities identified and prioritised across 20 OT sites, with clear risk categorisation across each.
• An average of 12 vulnerabilities per asset detected and resolved systematically.
• 350 governance approvals processed, covering risk exceptions, false positives, and escalations.

With the right visibility in place, the team could move from reactive to proactive – identifying and addressing risks before they reached critical systems.

THE OUTCOMES

A STRONGER SECURITY POSTURE, BUILT TO LAST

By partnering with Kinetic IT, this utility now has the visibility, structure, and confidence to manage cyber security risk across one of Australia’s most complex critical infrastructure environments – without compromising the reliability of the services it delivers.

The shift was meaningful: from a fragmented, manually intensive approach to a centralised, risk-based model that operates at scale and adapts as the environment evolves.

The results speak for themselves: A 10-day average remediation time from detection to resolution.

Vulnerabilities that once took weeks to surface and address are now managed within days.

• 87,300 active vulnerabilities monitored continuously, providing a comprehensive and always-current view of the threat landscape.
• 350 governance approvals processed, with a consistent, auditable record of risk decisions across the environment.
• Alignment with SOCI Act 2018 obligations, supported by governance controls and audit traceability embedded into everyday operations.

Beyond the metrics, the utility’s security and operations teams now share a common view of risk and a common language for acting on it.

THE NEXT PHASE

FROM PROACTIVE TO PREDICTIVE

Building on the foundations now in place, Kinetic IT and the utility will continue to evolve the program from proactive risk management toward a more predictive security capability. The next phase will focus on extending automation across additional remediation workflows, using analytics to identify patterns and emerging risks earlier, and refining risk assessment processes so the organisation can make faster, more informed decisions in a changing threat landscape.

This next phase will also build on the trust and confidence established between Kinetic IT and the utility throughout the program. With a shared focus on business outcomes and a strong understanding of the utility’s operational environment, Kinetic IT will continue to support the organisation in extending the value of its ServiceNow investment and developing capabilities that support future operational resilience and strategic priorities.

Find out more about Kinetic IT’s ServiceNow solutions.