Smart metering is set to play a central role in the next phase of water sector transformation in the UK. As AMP8 accelerates the rollout of smart meters, network sensors and IoT devices, water companies have an opportunity to gain a richer, more granular view of demand, consumption, leakage and network performance.
But, as the energy sector has shown, value does not come from the meter itself. It comes from how the data is used.
In this episode, CGI Utilities experts Rich Hampshire, Stuart Brand and Luke Eeles explore how water companies can move beyond data collection to deliver actionable insight, improve operational performance, build customer trust and make better long-term investment decisions.
They discuss the lessons water can learn from energy smart metering, and why operating models, data governance, standards, privacy and customer engagement need to be considered from the start – not added on later.
Key takeaways from the episode
1. Smart metering value comes from actionable insight, not meters alone
Smart meters will give water companies access to more granular data, but the value lies in how that data is used. The discussion explores how smart meter data can support better planning, maintenance, workforce optimisation and customer-facing services.
“Leading with value rather than talking about meters or data. For me, value accrues from actionable insights that can be created from the data produced and generated by smart meters,” says Rich Hampshire.
2. Water companies need to think beyond rollout and focus on the operating model
Smart meter deployment is only one part of the challenge. To unlock value, water companies need to consider the operating model around the data, including how it supports leakage reduction, demand management, customer service and capital planning.
“The meter is about the data or it creates the data, but it’s really about the operating model. So, if we’re talking about value creation, it’s the operating model. It has to be considered on an end-to-end basis,” explains Stuart Brand.
3. The water sector can learn from energy — but should not copy it directly
Energy smart metering offers valuable lessons, but our experts explore why water may have more in common with downstream gas than electricity, and why the sector needs to apply lessons carefully.
“I would suggest that for the water sector, there’s possibly more similarities with the downstream gas sector. The dynamics of the system are similar. Both are fluids. For starters, both can be stored,” says Rich Hampshire.
4. Decisions made now could shape future innovation
Some of the most valuable use cases may not be fully visible at the start of the rollout. The episode draws on experience from energy, where future uses such as flexibility and greater network visibility emerged over time. For water, this means today’s decisions on architecture, standards and access should not limit tomorrow’s opportunities.
“An important thing to consider at this stage we’re at now is to make sure we don’t design out those opportunities. So decisions we make now mustn’t preclude some of the things that we may not believe today, but are very likely to happen in the fullness of time,” says Stuart Brand.
5. Standardisation will be critical to avoiding siloed data
The discussion highlights the risk of water companies rolling out smart metering in different ways, creating fragmented implementations and data sets. Establishing common standards for data access and control will be important if the sector is to maximise value from the rollout.
“There is a risk that we end up with siloed implementations or siloed data sets,” explains Stuart Brand. “These meters are going in the ground today. So, we’re building up that meter debt, that infrastructure debt.”
6. Privacy, security and trust need to be designed in from the start
The podcast closes with a strong message on governance. Data access, consent, privacy, cyber security and customer trust are not secondary considerations. They need to be built into the ecosystem early, so consumers understand how their data will be used and why it matters.
“Some of these harder questions are not technically about the technology. They’re about access, consent and standards, and ultimately consumer trust,” says Stuart Brand.
Learn more
CGI works with utilities organisations to transform operations, improve customer experience and drive cost efficiencies across the sector. Our UK utilities experience spans electricity, gas and water, with decades of involvement in major market and technology change.
Visit our Utilities, Water and Energy Networks pages for more insights.
Get in touch with our Utilities team to discuss how we can help your organisation deliver for PR24 and beyond.
- Transcript
-
Luke
Welcome back to the CGI Smart, Secure, Sustainable Water Podcast Series. I'm Luke Eeles, Lead SME at CGI, and in our last episode we explored the growing role of data, smart metering and digital technologies across the water sector.
One of the themes that came through strongly in that discussion was that as water companies become more connected and more reliant on data & technology, cyber security becomes increasingly important.Water utilities operate critical national infrastructure, and with great connectivity comes great responsibility to protect systems, services and customers from evolving cyber threats.
So, today we're going to discuss some of the key cyber challenges facing the UK Water sector, including operational and cyber resilience. To help us unpack all of that, I'm joined by our Cyber SME, Kunle Anjorin.
Kunle, thanks for joining me. Before we get started, do you want to give everyone a quick introduction and tell us a little about your role at CGI?Kunle
Thank you Luke and it’s definitely good to join you on this podcast. I’m a director in CGI UK’s Cyber practice with a management focus on helping organisations think and take appropriate action about cyber resilience in the context of critical services and digital transformation.
My focus is on how organisations like water companies, that we’re talking about today, can modernise safely — using data, connected systems, automation and, indeed, emerging technologies such as AI, while still protecting the essential services that their customers and our communities rely on every day.Luke
That’s absolutely right, thanks Kunle - because the need for the water sector in general to balance modernisation with protecting their services is especially important. Cyber security is not just about protecting IT systems; it’s about protecting operational resilience, public trust, environmental performance and the continuity of a critical national service.
So, I guess the question is why does cyber matter in water now? When people turn on a tap, cyber security probably isn't the first thing they think about. But, from your perspective Kunle, why should cyber security matter to every water company in the UK right now?Kunle
That’s a very good question, Luke. Cyber security matters in the UK’s water sector because water is now a digital utility as much as it’s a physical one. The public experience is simple, you turn on the tap and expect safe water, but behind that experience are several connected systems, sensors, connected control environments, suppliers, cloud platforms and most importantly, data.
Now, If those systems are disrupted, the consequences are not just technical. They can affect service resilience, they can affect customer trust, it can even be an environmental performance effect and it could have regulatory confidence.
Customers may not think about cyber when they turn on the tap, but water companies absolutely need to.Luke
Yes, that’s really interesting. Having worked in the sector for a long period of time, I’ve recently seen reports around several cyber-attacks across the US, targeting water infrastructure, where programmable logic computers, better known as PLCs in the industry, have been targeted and in some instances even hacked. So gaining control of PLCs enables an aggressive players to potentially operate critical assets, so when you think of water, think of things like pumps controlling how much water moves around a system or network valves that direct that flow of water from one area to another or customer to customer. So gaining control of these kind of PLCs and equipment enables an aggressors to do so much harm to our water network..Kunle
That’s an interesting point, Luke. What can our UK water sector learn from such an incident, like you’ve described?Luke
I think, in the UK, Kunle, for us it’s about adapting, right? So swiftly identify our asset estate, so what assets do we have out there in the field, determining what the systems are [that] we’re using and the protocols we have in place to mitigate such events.Kunle
Absolutely. Cyber security protects the invisible systems behind a very visible public service. This is not just about preventing attacks. It is about keeping essential services running when something goes wrong. The more the sector depends on data, automation and connected assets, the more cyber resilience becomes foundational.So the real message is this:- Cyber security is not separate from the water sector’s mission – no not at all. It is one of the things that protects safe supply, public trust and the ability to modernise. Which means it is an operational issue that must be properly managed.
Luke
And that operational issue aspect, Kunle, is really interesting isn’t it? So, I suppose what does cyber risk look like when it does become an operational issue, so we’re not just talking about technology?Kunle
Cyber risk becomes an operational issue when it moves from affecting systems to affecting service. This is the crucial shift for the water sector and this matters because drinking water supply and distribution is designated as an essential service under the UK’s Network and Information Systems (NIS) Regulations, and water is part of the UK’s Critical National Infrastructure. So cyber resilience in water is not just a technology concern; it is directly linked to the continuity of a service that our society depends on.In practice, a cyber incident can affect visibility of the network, it can affect confidence in telemetry data, or the control of operational assets – these are systems that are controlled through operational technology (OT), like you were talking about, the PLCs a minute ago. In addition a cyber incident can affect coordination of field teams that the water companies deploy for work or even their supplier access to their critical sites, indeed it can also affect customer communication with the water companies as well as how incidents are responded to.
Luke
That’s really interesting. So these examples show that the impact could be wide ranging and it could become real-world very quickly. If operators cannot trust the data that’s in front of them, or if they lose visibility of critical assets, the issue is no longer just technical. It becomes an operational resilience issue.Kunle
That’s correct. There are actually useful lessons I think that I see that can be learned from the telecoms sector another critical national service. So the telecoms has had to design for service continuity right from the start.Luke
That’s interesting and why is that Kunle, why have they had to do that?Kunle
Well, they had to do this because connectivity is at the heart of our modern life with examples such as IOT internet-of-things, driverless cars and even just speaking to people all over the world, Ofcom…Luke
… you mean Ofcom, the regulatory body within telecoms sector?Kunle
That’s correct Luke. Ofcom’s resilience guidance for the telecoms sector focuses on robust architecture, operational models and keeping services available and working well, not just on preventing security incidents.
So, I think the water sector can actually apply this same mindset, and this is what I mean by that.Firstly, the water sector needs to design for degradation, this means if a system is unavailable or performance is reduced, can the service still continue to run safely?
That’s the first question, the second one is about mapping dependencies. Water companies rely on power, rely on telecoms, cloud platforms, their suppliers, their field teams and they rely on operational sites, and those dependencies all need to be understood well before an incident happens.
The third aspect that I think the water sector can learn from the telecoms sector is actually practising incident management as an operational capability, not just a cyber response. Telecoms reporting highlights incident management as critical to maintaining service continuity during cyber threats and operational disruptions.
So, all of these put together, is why the NIS regulation is such an important lens for the water company. It encourages water companies to think about the resilience of the network and information systems that support the essential services.So the real question is, not only, ‘are our systems secure?’ The real question is ‘Can we continue to operate safely if systems are degraded, unavailable or untrusted?’ That is what makes cyber part of operational resilience. It is about protecting the ability to keep a critical national service running, even under pressure.
Luke
Thanks, Kunle. That’s really interesting. I think there’s a few really important messages to take away from today’s conversation.So, for me, as the UK water sector becomes more connected, as we spoke about, cyber security and operational resilience; they increasingly go hand in hand. It’s not simply about protecting the technology alone, it’s about protecting the essential services that technology enables.
We’ve talked about the importance of understanding our assets and dependencies, being able to operate safely when systems are degraded or unavailable, and making sure our people and processes are prepared to respond when incidents occur.
And perhaps the key question for the sector isn’t just, ‘Are we secure?’ but, ‘Can we continue to deliver a safe and reliable service when something goes wrong?’
Kunle, thanks very much for joining me, it’s been a great discussion.
Kunle
Thank you, Luke, I’ve enjoyed this conversation with you today
Luke
And if you’d like to learn more about cyber security at CGI, visit CGI.com/UK/cyber-security
