The City and Borough of Juneau, Alaska operates water and wastewater infrastructure comparable in scope to utilities serving up to 400,000 people ... with a team of three managing water production. Their system serves Alaska’s population, state legislature, a significant U.S. military presence, a major international shipping hub, and 1.7 million cruise passengers annually. They supply freshwater directly to ships and process wastewater so vessels can operate inside the Inside Passage without environmental violation.
When Chad Gubala, Juneau’s Production and Treatment Manager, first reached out to Dragos, he wasn’t looking for a pitch. He wanted to know if Dragos could actually help and what OT cybersecurity could realistically look like for a community like his.. That question took on new urgency shortly after, when a supply-chain incident involving a widely used remote access tool brought Juneau within hours of shutting off water to roughly half the city.
When Chad brought that near-miss to a city committee meeting, a committee member pulled him aside with a candid suggestion: “If you want the resources you need, you have to let it fail.” His answer was unambiguous. “I told them: I can’t do that. We don’t have that option.” Yet that’s the operating reality for utilities across the country. Security investment competes with aging infrastructure, lean staffing, and climate pressures. And at the same time Chad’s team was navigating that near-miss, they discovered a distribution operator had been using default passwords across every field in their xOT logon system.
MFA came first. Then came visibility.
Juneau’s OT environment had been assembled incrementally over decades with no system-wide architectural plan. The result: approximately 50 remote nodes communicating in ways no one had fully documented, undocumented paths, and institutional knowledge living in the heads of two or three veteran operators.
When Chad first ran the Dragos Platform, he got something his team had never had: a real inventory of their asset base and an accurate map of how those nodes were actually communicating.
“Over the years, we lost track. There are only a couple of operators who had institutional knowledge as to how our systems actually functioned.” With that map in hand, Juneau’s team redesigned their architecture deliberately. They isolated network compartments, eliminated undocumented failure paths, and gained the ability to quarantine specific nodes if an attack occurs. Architecture decisions grounded in real information, not memory alone.
The operational impact was direct. System uptime on critical infrastructure improved from roughly 85% to approximately 99.99%. Before the Dragos Platform, any anomaly triggered the same first question: who do we dispatch to physically go look? With Dragos, that question has an answer before anyone reaches for a truck. “The improved visibility and deep situational awareness we gained through Dragos has been a game-changer for our day-to-day operations. This visibility has enabled our team to make data-driven decisions, improve our incident response times, and maintain reliable and secure infrastructure for our community.”
OT security expertise is scarce. For small utilities, the gap between responsibility and available resources isn’t just staffing problem; it’s a structural one. Juneau carries the same threat surface as a major regional utility, yet the team size does not reflect that.
Dragos EmberAI changes that equation. Built on the Dragos Intelligence Fabric that contains over a decade of OT-specific telemetry, adversary research across 26+ tracked OT threat groups, vulnerability analysis, and frontline incident response, Dragos EmberAI puts that intelligence directly in an analyst’s hands regardless of their OT background.
For Chad’s team, that means every shift starts with a direct query into the system:
“My first course of action is to go to the Dragos Platform, open it up, go to the AI and ask: ‘What is the current status of our system with regards to probability of incursion?’ That’s now an SOP. Number one, two, and three.” One of his operators put it plainly: “Having an AI component on Dragos, at least for public utilities, is a huge thing. A humble chemist trying to assess cyber threats on a daily basis while doing everything else takes a lot of time.”
Dragos EmberAI also solves a problem that doesn’t make it into most security conversations: what happens when the people who know the system leave? Chad describes the capability simply:
“I want basically a keeper of information combined with a strong trove of data so that any operator or any new person coming in can operate like a seasoned pro and can ask almost any question and receive specific information that is relevant to our site”. When experienced staff retire or transition, their decision-making context stays. New operators inherit a deep bench of OT knowledge, specific system knowledge and the institutional framework the team built. Dragos EmberAI does not replace analysts. It elevates them.
Chad brings decades of context to this problem, from post-Soviet nuclear inspection work earlier in his career, through the era of OT-targeted cyber attacks against electric grids, to what state-sponsored threat groups are doing against water infrastructure today. “Target rich but cyber poor” is how he characterizes the sector: utilities running 40-year-old pipes and decade-old control systems, managing glacial outburst floods and supply chain delays, with no dedicated OT cybersecurity staff. Juneau had a near-miss. Many utilities don’t know yet that they’ve already been accessed.
Chad applied to the Dragos Community Defense Program shortly after the supply-chain incident. He had simultaneously applied for a quarter-million-dollar state grant, which Juneau was awarded, but the paperwork had stalled it entirely by the time he spoke at DISC, Dragos’s Industrial Security Conference.
The Community Defense Program was operational while state bureaucracy wasn’t. The Program gives qualifying water, electric, gas, and wastewater utilities perpetually free access to the Dragos Platform, Neighborhood Keeper, and Dragos Academy. Not a trial. Not a pilot. Permanent access, because raising the baseline security level for these communities is the mission.
The people running OT environments are not abstractions. They’re operators carrying institutional knowledge that lives in two or three heads. They’re managers explaining to city officials why they need to spend money on something that hasn’t broken yet. They’re teams who care about their communities and are quietly holding the line on public safety every day.
Chad calls it “the pinnacle of my career.” Managing the lifeline for a section of Alaska. When you’re responsible for potable water, the population counting on you to keep the taps running. The Dragos Platform gave Chad’s team the visibility, security and control they needed to stop guessing. Dragos EmberAI gave them OT intelligence that would otherwise take years of experience to develop.
Many OT security teams face the same challenge Juneau did: expert-level responsibility without unlimited resources. The Dragos Platform combined with Dragos EmberAI gives teams the visibility and intelligence to close that gap, and get new analysts operating with confidence from day one. Qualifying water, electric, gas, and wastewater utilities can get perpetually free access to the Dragos Platform, Neighborhood Keeper, and Dragos Academy through the Community Defense Program.
