Researchers recently discovered critical security flaws impacting infrastructure—bridges, traffic systems, radiation monitoring, dams, power grids, etc.—in major U.S. and U.K. cities.

Many cities lack the resources to repair roads and subways and they are woefully behind in building cybersecurity programs to prevent attacks. Every year, cybercriminals target critical infrastructure and facilities around the world and threaten to potentially disable dams, power plants and traffic lights.

In 2018, it was publicly acknowledged that Russia targeted critical infrastructure sectors in the U.S., including the power grid—though efforts to gain access started in 2016. They succeeded in gaining access to a power plant’s control system.

Late in 2017, security firm FireEye discovered a new form of malware called Triton, which had taken control of an energy plant in the Middle East. In a separate attack, hackers targeted Ukraine’s power grid, using malware called Industroyer.

Cybersecurity company Symantec warned that hackers have already penetrated the U.S. power grid, exploiting staff at nuclear energy facilities with phishing attacks. The U.S. Computer Emergency Readiness Team issued a sternly-worded notice which was the extent of their punitive capabilities, but without any enforcement, companies and utilities managing our critical infrastructure haven’t yet been jolted into action.