Security Isn’t a Line Item. It’s a Decision.
Security Isn’t a Line Item. It’s a Decision.
As the CTO of a critical infrastructure platform, security is not something we can afford to waver on.
Sometimes, the most secure posture is not the cheapest line item in the supply chain and that’s a reality many organizations are still coming to terms with.
Part of my responsibility is overseeing our security initiatives and setting the bar for what “secure” actually means (end to end). When you’re serving customers that are highly visible and inherently targeted, you don’t operate under if something happens. You operate under when.
And that mindset shapes every decision.
The Supply Chain Problem Didn’t Go Away. It Evolved.
Since COVID, sourcing hardware from overseas has been unpredictable at best. We all lived through the delays, the cost spikes, and the logistical chaos.
But today’s threat is different.
It’s quieter, it's more subtle, and ultimately far more dangerous.
We’re not just dealing with delays anymore; we’re dealing with trust.
The New Threat: Silent Compromise
Our work with organizations like the U.S. Department of Homeland Security and Cybersecurity and Infrastructure Security Agency, combined with exposure to communities like DEF CON and Lonestar Application Security Conference (LASCON) forces us to see the landscape as it actually is, not how we’d like it to be.
The reality is this: Foreign adversaries are not always loud. They don’t need to be.
Sometimes, they ship.
This has driven a major shift inside our engineering organization because we now certify hardware before it ever touches our platform.
Not just for performance. Not just for durability. But for intent.
What We’re Actually Seeing
This isn’t theoretical.
Recently, we evaluated a hardware component already being used in municipal water systems (systems we actively compete in). It was presented to us as a potential fit.
We treated it like we treat everything:
- Isolate it
- Deploy it in a controlled environment
- Observe every behavior
What we found was not noise.
The device initiated outbound communication to foreign-hosted infrastructure... multiple times.
Not once. Not twice. Repeated behavior.
We are currently working through responsible disclosure channels with the relevant partners and federal entities before releasing deeper technical details.
But the takeaway is simple:
This is happening. Right now. In real systems that our cities are using today.
Why “More Expensive” Isn’t the Right Frame
We hear it often, and sometimes early that our hardware is more expensive than alternatives.
That may be true at face value.
Here’s the part that gets missed: You’re not just buying hardware. You’re buying confidence in what that hardware is doing when you’re not looking.
Our engineering and security teams invest real time validating:
- Behavior under extreme conditions
- Communication patterns
- Embedded intent
- Supply chain origin and risk
That cost is not overhead. It’s protection.
This Is Bigger Than One Company
City water systems in the United States cannot afford to be negligent in this area.
And this isn’t about winning deals.
It’s about raising the bar across the entire industry.
If a vulnerability exists in a competitor’s stack, that’s not “their problem”. That’s a shared risk to the communities we all serve and live in. Saving a few bucks on hardware that is compromised isn't worth the safety of our communities.
We have a responsibility to speak up.
The Bottom Line
Security is not a checkbox. It is not a compliance exercise, and it is definitely not a race to the lowest bidder.
It is a continuous, intentional posture.
At SitePro, that means:
- Treating hardware as a potential attack vector
- Investing in validation before deployment
- Operating under a “when, not if” mindset
- Strengthening governance through our ongoing SOC 2 attestation
Because in critical infrastructure, the cost of being wrong is not measured in dollars.
It’s measured in impact.
Beyond the Edge: A New Era of Integration, Innovation, and Possibility
SitePro Chief Technology Officer Dustin Brown walks through the journey of creating the SitePro Edge - and it's efficient monitoring capabilities.
AI Needed a Platform. So We Built One.
Build the foundation first. Then let AI do what it’s supposed to do.