The biggest threat in my opinion are suppliers to these Utilities. Most of this equipment is treated like a black box which nobody can interfere with or touch. Who knows how much of it has been compromised already. I don't believe for a minute these networks are truly segmented from the Corporate network. The people in corporate IT are still providing equipment and support to the OT environment.
I actually gave myself a scare a few weeks ago. I was monitoring a process and noticed our security camera system (a small form cpu and server) disappeared like always. I did some digging, since we’re in a new building, and pulled out the new computer wondering if it was the weird mess of a cable adapter. I did some research on box to see if it was prone to overheating. I realized that it was a Chinese brand! Lmao. I opened it up and asked some questions. Basically our IT dept just bought cheap, empty boxes and locally sourced components from micro center. I let the box sit half-way out of the cabinet and we’ve stopped losing camera feeds now lol. That one is also separate from our process systems. The overall control is independent of everything because a contained AI makes things happen based off our calculated input. Our most dangerous production stages have their own small cabled intranet. Our main control room can override each station through a larger cabled intranet. Our internet conected computers are separated completely a mistake doesn’t happen lol. It’s crazy how all these small things, out there, can leave a huge door wide open to take over systems. Our municipality stays under the microscope And constantly gets funding for security upgrades because of our production nature, source, and we’re one of the few in the country. Our central (admin over police, fire, etc) is always under attack.