By Ayo Onikoyi

As cyber threats increasingly target critical infrastructure, Scottish Water has emerged as a leader in operational technology (OT) security—and at the centre of that transformation is Femi Osasona, a Senior Business Analyst with deep expertise in cybersecurity governance, risk assessment, and intelligent automation.

At Scottish Water, Osasona led key aspects of the Digitally Securing Operational Assets (DSOA) programme. This landmark project aimed to strengthen cyber readiness across Scotland’s water and wastewater operations by introducing artificial intelligence and robust compliance frameworks.

“Water infrastructure is foundational to public health and national stability,” Osasona said. “We knew that protecting these assets required a proactive, technology-driven strategy—not just reactive patches.”

Working alongside IT security specialists, OT engineers, and vendor partners, Osasona oversaw detailed risk audits of critical systems such as SCADA, ICS, and Distributed Control Systems (DCS). These systems, responsible for monitoring and controlling water flow, treatment, and quality, presented unique security challenges due to their age and integration with modern IT platforms.

Using the NIST SP 800-30 methodology, he facilitated semi-quantitative risk assessments that identified gaps and ranked vulnerabilities. From there, Osasona introduced AI-powered monitoring tools capable of detecting anomalies in real time—shifting the organisation from a reactive security posture to a predictive one.

“We deployed machine learning models that could analyse behaviour patterns across OT networks and flag inconsistencies, whether they pointed to cyber intrusions or operational malfunctions,” he explained. “It was about creating a digital immune system for our water infrastructure.”

One of his major achievements was leading the migration from the Intelligent Control Center to a new Remote Operating Center, a transformation that enhanced both physical and cyber resilience. The move not only saved Scottish Water £500,000 annually, but also reduced latency in crisis response and improved system redundancy.

Beyond technology, Osasona drove cultural change. He created tailored cybersecurity awareness materials for frontline staff, engineers, and decision-makers—ensuring that every layer of the organisation understood their role in cyber defense. This bottom-up approach helped embed a security-first mindset into Scottish Water’s operational DNA.

To support long-term resilience, he authored and implemented a new Information Security Policy, which established clear rules for access control, vendor integration, and authenticator management. Importantly, he designed this policy with real-world operational constraints in mind—ensuring that compliance was achievable without disrupting service delivery.

Osasona also played a crucial role in streamlining incident response processes. By automating threat modeling and integrating it with real-time alert systems, Scottish Water drastically reduced its mean time to detect and respond to cyber incidents across high-risk facilities.

“We weren’t just building a safer network; we were building trust with the communities we serve,” he said. “Reliable water services depend on strong digital foundations, and our work ensured that the people of Scotland could count on both.”

Through his visionary leadership and strategic deployment of AI, Femi Osasona helped position Scottish Water as a model of cybersecurity and operational excellence in the utility sector—demonstrating how innovation and foresight can secure the lifelines of modern society.