Medium & large utilities frequently do run their own fiber and/or microwave links. These places also tend to have some level of infosec awareness. Small munici

Medium & large utilities frequently do run their own fiber and/or microwave links. These places also tend to have some level of infosec awareness. Small municipal utilities (primarily water/wastewater treatment) frequently do very bad things* for convenience and because they don't know better or they take view that nobody would want to attack them. If a security audit was required along with the water quality testing they'd learn pretty quickly... * Things like not separating control and office networks, open wifi that is "secure" because DHCP is disabled, plain open wifi on the control network, etc.