One County, Multiple Points of Failure: When Crumbling Infrastructure Meets Cyber Exposure | ControlSystemsSecurity

One County, Multiple Points of Failure: When Crumbling Infrastructure Meets Cyber Exposure

August 11, 2026 |<br>Author: Jeff Gray, Cyborama |<br>Source: ControlSystemsSecurity.com

OT Security<br>Infrastructure Risk<br>Dam Safety<br>ICS Exposure<br>Converging Threats<br>Alabama

The Hidden Risk: The National Inventory of Dams tracks ~92,000 structures — but a vast category of water-control infrastructure (retention gates, spillway valves, small locks, stormwater systems) is neither classified as a dam nor tracked by any unified framework. We can't quantify how many exist. Many of them have internet-facing control systems that anyone can find with a search engine.

The Pattern: In a single geographic area, aging physical infrastructure with known safety concerns intersects with internet-exposed industrial control systems. Neither problem alone is unusual. Together, they create a risk profile that neither the dam safety community nor the cybersecurity community is equipped to see.

Aging infrastructure: rusted spillway controls overlook a dry riverbed. No active reconnaissance required to see what's exposed.

The Spark

A retention lake in a Birmingham-area community drained suddenly. The city's statement noted that the overflow system was "compromised" and the property owner engaged a contractor to evaluate the situation. The structure was on private property, outside municipal maintenance.

We don't know what happened at that lake. In the end, it is of little consequence — a lake was drained, a repair will be affected. But that incident sparked a question: "Hmmm?"

A moment of extrapolation. If a single private retention structure can fail quietly, untracked and unregulated, what does the broader landscape look like? That question led to a passive survey of Alabama's dam safety data, its industrial control system exposure, and the intersection between the two. The big picture that emerged is what matters — not the individual incident that sparked the curiosity.

The Physical Layer: Crumbling Dams

Alabama has approximately 2,260 dams in the National Inventory of Dams. Of those, 227 are classified as high hazard — meaning failure would likely cause loss of life. Six are in poor or unsatisfactory condition. Two are both high-hazard and in poor condition.

The NID assigns each dam an Impact Level based on potential consequences of failure:

Alabama Dam Impact Levels — 2,262 dams in the National Inventory of Dams

Impact Level<br>Definition<br>Alabama Count<br>% of Total

High Hazard<br>Failure would likely cause loss of life<br>227<br>10.0%

Significant Hazard<br>Failure would cause significant property damage<br>443<br>19.6%

Low Hazard<br>Failure would cause minimal property damage<br>1,592<br>70.3%

The 227 high-hazard dams are the ones that keep dam safety officials awake at night. Combine a high-hazard rating with a poor condition assessment, and you have a recipe for disaster. Logan Martin Dam in St. Clair County is exactly that: high-hazard, 142 feet tall, hydroelectric, completed in 1964, and rated in Poor condition. It sits in a region where downstream communities depend on its integrity every day.

In one urban Alabama county, the state's third-tallest dam stands 158 feet tall. Its condition is listed as "Not Rated."

These are structures that hold back millions of gallons of water. They have emergency spillway systems, gate controls, monitoring equipment, and automated valves. They were built in the mid-20th century and are now reaching the age where maintenance becomes not just costly, but critical.

Alabama only recently established a formal state dam safety program (2026). For decades, there was no statewide program to coordinate inspections, track condition assessments, or ensure compliance with federal guidelines. This history helps explain why many dams — even high-hazard ones — carry "Not Rated" condition status in public records.

The Digital Layer: Exposed Control Systems

In the same state, a passive survey using the Shodan search engine revealed:

Alabama data: passive Shodan search results as of August 11, 2026. These devices are internet-reachable; ownership and function cannot be confirmed without active reconnaissance, which was not performed. Alabama counts validated across multiple scans from May through August 2026.

National context: Third-party research (Forescout/Vedere Labs, Censys, 2026) has reported between 4,100 and 5,200 internet-facing Rockwell/Allen-Bradley controllers globally, with approximately 75% located in the United States. Modbus exposure estimates vary widely by platform and methodology.

Internet-Facing OT Devices — Alabama (Passive Shodan Search, August 2026)

Exposed does not mean vulnerable.

A device visible to a search engine is not necessarily exploitable. Authentication may be enabled. Access controls may be properly configured. But exposure is the prerequisite — a device cannot be attacked...