[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-a-one-second-triage-tool-for-water-system-cyberattacks":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},9572,"a-one-second-triage-tool-for-water-system-cyberattacks","A one-second triage tool for water system cyberattacks","Jev, a training-free model, screens water-network SCADA alarms in about a second and scored higher than a hand-built rule tree in tests.","A fast, training-free screening tool just outscored a hand-coded rule tree at spotting cyberattacks in a simulated water utility's control system.\n\nResearchers tested a model called Jev against a hand-written rule tree, a supervised classifier, and seven cloud LLMs on a four-class attack-attribution benchmark built on the C-Town water network in the EPANET simulator. Jev needs no training data and makes a decision in about a second, using only a label-free statistical correction to its priors. Across four sealed, pre-registered test rounds, it posted a macro-F1 of 0.62-0.64, consistently above the rule tree's 0.56-0.61. It also beat the supervised classifier by 0.36-0.42 on attack types that weren't in its training labels, and ran 20-40 times faster than the cloud LLMs.\n\nThat speed and label-free design matter because water utilities rarely have enough documented cyberattack incidents to train a reliable classifier, and manual review by a human analyst is slow. Plugging Jev in as a first-pass filter, only escalating flagged cases to the rule tree and then a human, spared a simulated LLM reviewer 35-38% of its workload on fresh test sets without hurting accuracy, and the setup held up when transferred to two other water networks.\n\nStill, this is one simulated benchmark on one open-source network model, not a live utility feed with real sensor noise and real attackers. The gap between a one-second screen and a confirmed intrusion is still a human reviewing an alert, and a third less workload is useful triage, not a replacement for it.","[\"scada security\",\"water infrastructure\",\"ai triage\",\"critical infrastructure\"]","2026-10-02T04:00:00.000Z","2026-10-03T01:09:32.215Z","2026-10-03T01:09:38.308Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"publisher-r1","publisher",1,"The body claims Jev 'matched' the rule tree's accuracy but then cites non-overlapping macro-F1 ranges (0.62-0.64 vs 0.56-0.61) showing Jev scoring consistently higher, an internal inconsistency that needs correction before publishing.","resolved","security",[32,33,34,35],"scada security","water infrastructure","ai triage","critical infrastructure",[37],{"name":38,"url":39},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.02048",0,{"sections":42},[43,47,50,54,59,63,67,72,77,82,87,92,97,102],{"name":44,"slug":45,"count":46,"latest_published_at":18},"AI","ai",5896,{"name":48,"slug":30,"count":49,"latest_published_at":18},"Security",837,{"name":51,"slug":52,"count":53,"latest_published_at":18},"Policy","policy",438,{"name":55,"slug":56,"count":57,"latest_published_at":58},"Deals","deals",317,"2026-10-01T22:00:00.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":18},"Hardware","hardware",199,{"name":64,"slug":65,"count":66,"latest_published_at":18},"Science","science",171,{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",155,"2026-10-01T19:54:10.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Dev Tools","dev-tools",96,"2026-10-01T16:57:03.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",93,"2026-09-30T21:41:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",90,"2026-10-01T21:55:22.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Gaming","gaming",53,"2026-10-02T02:50:39.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",50,"2026-09-30T21:37:54.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"How-To","how-to",7,"2026-10-01T09:00:00.000Z"]