A scoping review of human-governed agentic AI for SCADA cybersecurity in water and wastewater treatment systems

Abstract Water and wastewater utilities increasingly depend on Supervisory Control and Data Acquisition (SCADA) systems, operational technology, sensors, programmable controllers, and data analytics to maintain safe treatment and reliable service. This scoping review synthesises evidence on vulnerabilities, threat pathways, mitigation strategies, and human-governed agentic artificial intelligence (AI) for SCADA-based water and wastewater systems. Searches in Scopus and Web of Science covered literature published from 2020 to 2026. The searches identified 2346 records, comprising 2257 from Web of Science and 89 from Scopus. Five duplicates were removed before screening, leaving 2341 records for screening against the review questions. Twenty-five studies were included in the thematic synthesis. The evidence indicates that water-sector cyber risk is not only a network-security problem but a cyber-physical resilience problem involving exposed human-machine interfaces, insecure remote access, weak segmentation, limited asset visibility, sensor manipulation, ransomware, scarce labelled attack data, and insufficient validation of AI-based detection models. The synthesis further shows that supervised, semi-supervised, unsupervised, graph-based, digital-twin, and reinforcement-learning approaches each have value under specific data and deployment conditions, but none should be treated as a complete substitute for operator judgement. The review contributes a structured synthesis, a mapping of threats to controls, a phased implementation approach for resource-constrained utilities, and a conceptual safety-constrained agentic AI framework in which intelligent systems observe, detect, learn, and recommend while final operational approval remains with qualified human personnel.