Skip to content

Solutions · Utilities and critical infrastructure

The meter outlives the cryptography it shipped with.

AgilePQ’s experience is that IoT deployments stay in the field for decades. In July 2026 alone, CISA saw attacks on internet-exposed systems at more than 100 US water utilities, and US agencies have reported controllers whose safety logic was switched off. AgilePQ licenses SLiM to the makers of meters, pumps and sensors, so every reading is encrypted and checked at the source.

Talk to AgilePQSee a fake reading
TANKPUMPMETERS

01Real attacks

The attacks have reached the controllers.

Water, power and fuel. Each case is on the public record.

2021Fuel

Colonial Pipeline

After a ransomware attack, the operator shut down all 5,500 miles of pipeline. The line carries nearly half the fuel the East Coast consumes.

2023Water

Water-system controllers

Beginning in November 2023, attackers compromised at least 75 devices, at least 34 of them in US water and wastewater systems.

2024State actor

Volt Typhoon

CISA, NSA and FBI found state hackers pre-positioning to disrupt operational technology across critical-infrastructure sectors, through end-of-life routers.

2025Energy

Poland’s power and heat

On 29 December, coordinated attacks hit more than 30 wind and solar farms and a heat plant serving almost 500,000 customers. CERT Polska: the objective was “purely destructive”.

2025Energy

In through the cellular link

At a Polish heat and power plant serving 50,000 residents, attackers reached the control network through a private cellular network and shut down a steam turbine. CERT Polska called the route a first.

2026Industrial control

Shutdown logic disabled

US agencies reported attackers falsifying HMI and SCADA displays, then disabling shutdown and alarm logic so systems could enter unsafe conditions unnoticed.

2026Water

More than 100 water utilities

In July, CISA saw attacks on internet-exposed systems at more than 100 US water utilities, often controllers on cellular modems. Operators were locked out and boil-water notices followed. Minnesota alone reported more than 30 systems targeted in two days.

2026AI

AI-written exploits

FBI, CISA and partners warned of AI-generated exploitation scripts, disguised as monitoring tools, aimed at industrial controllers.

In IBM’s 2026 breach study, most AI-driven attacks, 62 percent, targeted critical-infrastructure sectors.

02A fake reading

The pump obeys the reading. Make sure the reading is real.

A controller cannot tell a fake reading from a real one unless the reading can prove where it came from. SLiM adds an integrity check to every packet, so a fake or altered one fails.

OVERFLOWRESERVOIRtrue level 92%Level sensor92%92%92%Fake reading18%18%REJECTEDintegrity check failedINTEGRITY CHECKPUMP CONTROLLERIF LEVEL < 20% RUN FILL PUMPLEVEL IN92%18%Fill pumpSTOPPEDRUNNINGOPERATOR SCREEN92%18%NORMALLOW · PUMP ONOVERFLOWtrue level 92%Level sensor92%92%Fake reading18%18%REJECTEDintegrity check failedCHECKPUMP CONTROLLERIF LEVEL < 20% RUN FILL PUMPLEVEL IN92%18%Fill pumpSTOPPEDRUNNINGOPERATOR SCREEN92%18%NORMALLOW · PUMP ON
The level sensor reports 92%. The controller keeps the fill pump stopped.A fake 18% reaches the controller. The pump starts, the reservoir overflows, and the operator’s screen shows the fake.With an integrity check on every packet, the fake reading fails and is dropped. The pump stays stopped.

An illustration of the principle, not a recorded incident. US agencies have documented attackers changing what operators see and switching off the logic meant to stop unsafe conditions.

03Service life

A meter that lasts decades. A public key with a deadline.

NIST’s draft transition plan deprecates 112-bit RSA and elliptic-curve algorithms after 2030 and disallows quantum-vulnerable public-key algorithms after 2035. A device installed in 2026 may still be in service in 2041 and long after.

20262030deprecated2035disallowed2041DecadesIN THE FIELD2026 → 2041
857.6million
smart electricity meters in Asia-Pacific in 2024
~1.3billion
forecast for 2030

A meter that relies on RSA or elliptic curves may outlive NIST’s draft dates for them. SLiM uses neither.

NIST IR 8547 is an initial public draft and may change.

04What AgilePQ does

Checked at the source. Small enough for the meter.

SLiM is AgilePQ’s encryption suite for sensors, meters and controllers too small for TLS. The device maker builds it in and keys each unit on the production line; every packet is encrypted and checked.

Every packet

An integrity check on each one

The check travels with the packet. Overhead is 2 to 10 bytes, with no padding to 16- or 32-byte blocks.

Every device

Its own keys

Each unit is keyed on the production line, and a key server issues fresh session keys. A key copied from one meter opens no other.

Every year in service

No public-key step

Symmetric end to end, with no RSA or elliptic-curve exchange for a quantum computer to break.

< 2KB RAM
about 800 bytes for the library, 1,500 for the full protocol
2–10bytes
of overhead per packet, including the integrity check
376bytes
to set up a session, against 2,728–3,478 for TLS 1.2: less airtime and battery per connection

Measurements are AgilePQ’s own (2021), on the platforms named in the notes. Speed and energy tests, with their scope, are on the technology page.

05Next step

Tell AgilePQ what is in the field.

Device type, network, service life and who makes the devices. AgilePQ will tell you whether SLiM fits and how your device maker can build it in.

Talk to AgilePQSchedule a demo

The other markets

01Device manufacturersBuild SLiM in once. Every device you ship carries it, into every market you sell to.02GovernmentSecrets with a long shelf life, sent from devices that stay in the field for years.03Network operatorsA fraction of a TLS handshake on links where every byte costs airtime.

All four markets · How SLiM works

06Sources

Sources and notes23 sources · 8 from AgilePQ’s own records
  1. 1AgilePQ’s 2020 white paper says IoT deployments may remain in the field for over 15 years; AgilePQ now describes that service life as decades.AgilePQ, SLiM Security for Cellular, Satellite, and Constrained Networks (2020), page 3.AgilePQ record
  2. 2CISA: “In July 2026, CISA observed malicious cyber activity targeting internet-exposed systems at more than 100 Water and Wastewater Systems (WWS) Sector entities, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem.” “Threat actors targeting exposed PLCs have modified passwords to lock out operators … This activity has resulted in boil water notices and sustained manual operations.”CISA, Internet Exposure Reduction Guidance; CISA alert (30 July 2026).Sourced
  3. 3FBI, CISA and partners: attackers manipulated “data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays”; in an update, “the changes disabled critical shutdown and alarm logic … allowing systems to enter unsafe conditions without notifying operators”.Joint advisory AA26-097A (7 April 2026) and its update (22 July 2026).Sourced
  4. 4AgilePQ licenses SLiM to device manufacturers, who build it into their products and take it into the markets they sell to.AgilePQ management (October 2026).AgilePQ record
  5. 5SLiM does not pad data to 16- or 32-byte blocks; per-packet overhead is 2 to 10 bytes depending on mode, including an integrity check. AgilePQ: SLiM “adds a 10-byte header per packet (which includes an integrity check)”.AgilePQ engineering documentation (2021); AgilePQ, SLiM byte savings (23 April 2021).AgilePQ record
  6. 6Colonial Pipeline’s CEO testified that after the May 2021 ransomware attack “all 5,500 miles of pipelines had been shut down”; the line “accounts for nearly half of the fuel consumed on the East Coast”.Joseph Blount, testimony to the US Senate Homeland Security Committee (8 June 2021).Sourced
  7. 7CISA: “Beginning on Nov. 22, 2023, IRGC cyber actors accessed multiple U.S.-based WWS facilities …”CISA advisory AA23-335A (originally published 1 December 2023).Sourced
  8. 8CISA: “The actors compromised at least 75 devices, including at least 34 in the WWS [water and wastewater] Sector in the United States.”CISA advisory AA23-335A (updated December 2024).Sourced
  9. 9CISA, NSA and FBI: Volt Typhoon is “pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors”, with access maintained in some environments “for at least five years”, using “end-of-life SOHO routers”.CISA advisory AA24-038A (7 February 2024).Sourced
  10. 10CERT Polska: “On 29 December 2025, in the morning and afternoon hours, coordinated attacks took place in Polish cyberspace.”CERT Polska, Energy Sector Incident Report – 29 December 2025 (30 January 2026).Sourced
  11. 11CERT Polska: attacks on more than 30 wind and solar farms and a heat plant serving almost 500,000 customers; “All attacks had a purely destructive objective.”CERT Polska incident report (30 January 2026).Sourced
  12. 12CERT Polska: at a smaller combined heat and power plant “supplying heat to 50,000 residents”, “a steam turbine and the water treatment system used to produce process water were shut down”; the attack did not disrupt heat supplies to consumers. “To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack.”CERT Polska, follow-up report on the December 2025 energy-sector incident (8 August 2026).Sourced
  13. 13Minnesota IT Services: attackers “targeted operational technology at more than 30 Minnesota community water systems” on 26–27 July 2026.Minnesota IT Services (28 July 2026).Sourced
  14. 14FBI, CISA and partners warned of actors “using AI-generated exploitation scripts disguised as legitimate monitoring tools” against industrial controllers.Joint advisory AA26-231A (August 2026).Sourced
  15. 15IBM gives “the global breach average of $4.99 million”. It reports that “Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit” and that “Most AI-driven attacks reported in the study targeted critical infrastructure sectors (62%)”.IBM, Cost of a Data Breach Report 2026 (29 July 2026; 602 organizations, breaches March 2025–February 2026).Sourced
  16. 16SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  17. 17NIST’s draft transition plan marks RSA and elliptic-curve algorithms at 112-bit strength “Deprecated after 2030” and quantum-vulnerable public-key algorithms “Disallowed after 2035”. It is still an initial public draft.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards (12 November 2024).Sourced
  18. 18Berg Insight forecasts smart electricity meters in Asia-Pacific to grow “from 857.6 million in 2024 to nearly 1.3 billion in 2030”.Berg Insight, Smart Metering in Asia-Pacific, product sheet (October 2025).Sourced
  19. 19RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  20. 20AgilePQ: “The most common way is to have the device manufacturer provision the device.” Devices are “programmed directly by the manufacturer with a unique device voucher”, which “can be replaced in the field at any time in the future if a device’s keys become compromised.” Devices can also be provisioned in the field by a provisioning server on first power-up.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  21. 21AgilePQ: with its key server, SLiM gives each device a unique key, so compromising one device compromises only that device, and authenticates a device before any data is sent.AgilePQ, SLiM Technical Overview v2.4.9 (January 2024); AgilePQ engineering note comparing SLiM and Ascon use cases.AgilePQ record
  22. 22AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  23. 23AgilePQ measured 376 bytes to set up a SLiM session (44 sent, 332 received), against 2,728 bytes (self-signed certificate) and 3,478 bytes (google.com) for an OpenSSL TLS 1.2 handshake, on a Raspberry Pi 3.AgilePQ engineering benchmarks (April and July 2021).AgilePQ record