Tony opens with the question his CTO asked him when he first joined Gilbert six years ago, what is the town’s greatest risk, and his immediate answer: critical infrastructure. He explains that these operational technology systems were never built with the same security assumptions as IT, and that while they once sat in environments that were not noteworthy targets, nation-state actors, hacktivist collectives, and cyber syndicates now treat them as low hanging fruit, partly because intrusion detection and system monitoring rarely exist on the OT side. He notes that attacks have often been discovered by a plant worker who spotted something odd on a SCADA screen, and that the old air gap defense has been undone by service and subscription models in which vendors require remote access for support and patching. The result is what he calls a convergence between IT and OT that forces plants to adopt IT best practices.
The middle of the conversation is a clear-eyed look at why OT security lags and what actually works. Tony explains that plants have traditionally avoided antivirus because scans can knock over sensitive systems like historians, rely on SCADA monitoring that watches the process rather than the network, and sometimes run default logins, thin segregation of duties, and weak backups. He adds that critical infrastructure leans hard on availability, targeting six nines where IT balances confidentiality, integrity, and availability, which he describes as a scalene triangle with availability stretched out. He recalls presenting on IT and OT convergence at a Southwest utilities seminar in Las Vegas in 2023, where the room looked at him like he had four heads, and he was then swarmed with questions in the hallway for up to two hours. Gilbert’s answer has been partnership: educating public works, being candid that his team knows nothing about SCADA, and bringing in the best vendors in the marketplace as trusted third parties who speak the language of the plant, covering network segregation, asset and supply chain management, ongoing vulnerability assessment, and full time system monitoring.
The final stretch moves from technology to policy and public trust. Tony makes the case that critical infrastructure needs a federal minimum standard, noting that water and wastewater operators work from IEC 62443 and the Purdue model while each industry follows its own frameworks, and he explains why states push back on unfunded mandates. He argues that a million dollars of security spending is small next to the billions of dollars of buried infrastructure and the public trust at stake. He then brings it home with Gilbert’s own story: aging infrastructure in acidic soil forced a dramatic water rate increase, and when a resident raised it at an AI symposium in downtown Phoenix, Tony chose to explain exactly what the town was facing and how smart meters might someday help residents find leaks. Afterward, the resident thanked him and said he now understood why the increase was required, even though he was still not happy about it. Tony closes by honoring plant operators as rock stars who keep the water flowing, and urging them to bring in experts for what they do not know they do not know.
Resources mentioned in this episode
This episode is brought to you by CyberLynx.
CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection.
We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO.
Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.
Human or Agent? Eight Identity Scenarios to Test Any AI Vendor with Marina Kelly - Ep 243
Why You Can't Commit to One AI Provider Anymore with Matthew Sanders - Ep 242
Your Internal Network Is No Longer Trusted with Michael Foster - Ep 241
Guest: Tony Bryson, CISO of the Town of Gilbert, Arizona (return episode) Host: Matthew Connor
Matthew Connor: Matthew Connor here, host of the Cyber Business Podcast. Today we're joined once again by Tony Bryson, CISO of the Town of Gilbert, Arizona. Tony, welcome back.
Tony Bryson: Nice to be back.
Matthew Connor: Well, before we get too far in, as always, a quick word from our sponsors.
Sponsor Break — CyberLynx: Hackers are using AI to conduct machine-speed attacks. Is your security keeping up? CyberLynx sells industry-leading AI-powered cybersecurity solutions that detect threats in real time, so you know about an attack before the damage is done, not after. Learn more at cyberlynx.com. That's cyberlynx.com.
Matthew Connor: And now, back to our show. Tony, that is actually a really great segue into today's discussion, because I think nothing is more relevant and timely than these AI machine-speed attacks that are happening, especially, I should say, on critical infrastructure. This is a real problem, it's an actual physical, life-threatening danger, and it affects small towns all the way up to large municipalities. So let's dig in. Let's start with you, right there in the Town of Gilbert, boots on the ground, where you're at. Obviously not getting into your stack and all of that, but I think it's a real challenge, it's a real issue, and I'd like to dive in and discuss it with you.
Tony Bryson: Yeah. When I first started with the Town of Gilbert six years ago, my CTO asked me directly, what's the greatest risk that you think we have as a town, or even as a nation? And I immediately pointed to critical infrastructure. For the Town of Gilbert, that would be water, wastewater, water collection systems, traffic operation systems. That's the type of critical infrastructure we run, and it's something municipalities across the nation run. Private interests run critical infrastructure too, everything from food production to transportation to energy, oil and gas, electricity generation, all of these various systems run on operational technology systems, OT systems. And traditionally they have not been run the same way IT systems have, just because they've operated in environments that have not been noteworthy targets. Well, now nation-state actors, hacktivist collectives, and cyber syndicates are targeting critical infrastructure. They're low-hanging fruit, because they don't employ a lot of complex security systems to identify attacks or attackers inside the system. A lot of times you're going to find out that attacks against these particular systems were discovered by a plant worker who noticed something on their SCADA system that pointed to some erroneous behavior that had to be investigated, and that's how those bad actors have been discovered. It's not like IT systems, where we have all sorts of intrusion detection systems and system monitoring. A lot of that doesn't exist over on those OT systems, because in the past they've operated in an air gap, and air gaps just don't exist anymore because of the way industry has evolved. It's a spillover from IT. IT has gone to service models, subscription models, where vendors require remote access into the system. So that old air-gap mentality is defeated right out of the gate by your vendor, who says, well, no, I need remote access to your system to provide you third-party support, do patching as needed, provide those updates. And that is something new to that world that they're not used to, and they're trying to play catch-up. What we're seeing is really a convergence between information technology and operational technology, and those two worlds come crashing together at a point where OT must now adopt some of those IT best practices to protect their infrastructure.
Matthew Connor: Yeah. It's funny, because that whole air-gap issue is so old, how old is it now? It's so old that what's really funny is it was Iran, with their nuclear facility, that's what we did to them.
Tony Bryson: Exactly.
Matthew Connor: And so how are we going to think, oh, it's fine, it's air-gapped? What are you talking about, are you kidding me? That's an old playbook that we know can be run, and you can't rely on that. And I get how, oh, but it's all US-manufactured, you don't know that, it's just ridiculous. So we can't take this head-in-the-sand approach anymore and think it's fine because we're in the US. The unfortunate part is, with most enterprise and business on the commercial side, it's monetary gain that people are after, and that's a much easier opponent than a nation state. These advanced persistent threats are real, they're dangerous, they're well funded, they're motivated, they're persistent, and it's almost like a David and Goliath situation. It's not the US government versus other foreign powers, where this is the new cyber battlefield, that's not what's happening here at all. Now you've got Goliath, some foreign government, going after the little town of Gilbert, even against a city, even against New York City, it's not the same fight. So this isn't nation state against nation state, it's nation state against municipality, and that is a real, real concern. And as you rightfully pointed out, it's the confluence of OT and IT, and it's finally coming to a head and we have to finally address it. You hear even Microsoft, it's very clear it's a real issue for them, they have a lot of great products on the IT side, and it is a weakness on the OT side. And we're starting to see some cool products coming out, like Darktrace OT, a fantastic product that leverages AI, machine learning, to secure OT, a great example of leveraging the right kind of technology in the right way to help fight this fight, because I don't know, without something like that, how do you fight a nation state? It's extremely difficult, you need all the tools that are available.
Tony Bryson: You really do. You have to do a deep dive into your cyber stack and leverage it, and the problem is that over on the OT side, that cyber stack doesn't exist. They have traditionally not used antivirus, because it's intrusive and the scans can knock over certain systems, like their historians. They don't like to engage in any type of firewalls beyond establishing that air gap. They don't like leaning into that technology because it's beyond their skill set, they're not prepared to take those challenges on. They don't have any type of intrusion detection systems, and they don't do system monitoring outside of their SCADA system. They've always got eyes on the SCADA system to see what's going on as far as their process flows, but when it comes to what's happening on the wire within their own network, a lot of them are completely oblivious, because they don't have the tools, they have not made the investments to help them understand what is happening within their own networks. They also rely on some really old, bad practices. I don't know how many times people have come across system administrators setting up products using default passwords, default login IDs, not having appropriate segregation of duties, not making sure you've got appropriate backup solutions in play. All sorts of things that, from the IT side, we would look at and go, oh my God, that's a horrible practice to leverage. But that's the way that industry has been for so many years. I had a conversation with a colleague from another municipality about it, and we both commented that it's kind of like you're dealing with technology from the eighties or nineties, put in play, set and forget. And we all know you have to do updates these days, you have to do patching. Unfortunately, the way critical infrastructure systems operate, they lean heavily into availability, while for IT we rely heavily on the whole CIA triad: confidentiality, integrity of data, and then availability, and we try to maintain that equilateral triangle. With OT systems, they tend to lean into more of a scalene triangle, with that vertex extremely stretched out. They want to make sure availability is the most important thing, and that's what they rely upon. Confidentiality, we can deal with that, and data integrity, we can deal with that, but availability, we have to be up, six nines. They don't even target five nines, they're looking at six nines. And I get it, I understand when you're providing services to the public, the public's expectation is, when I turn that tap on, I want water, and if it isn't on, all hell is going to break loose. So I get that, and I understand where they're coming from, but we also have to understand the evolution of the threat surface they're now living in, and how we can help them protect their systems. In 2023, I went and presented at the Tri-State Seminar in Las Vegas, a collective of utilities and public interests from the Southwest, and I presented on the convergence of technologies between IT and OT. And let me tell you, as I'm up there giving my presentation, people were looking at me like I had four heads, they just didn't get it. I finished my presentation, went out into the hall where all the vendors are, and I just got swarmed by people asking questions. I stood out there for probably another hour and a half, two hours, just answering questions on what I meant by convergence and how the threat surface was changing. It was kind of good to have all those people come up and ask those questions, because they at least wanted to educate themselves on it and become aware of it. But while we were in the main presentation hall, yeah, man, I felt like I was persona non grata up on that stage, like I was telling a really bad joke up there or something. So it was good to begin getting that information out there, and I know, talking with people who have gone to subsequent seminars, that it's becoming more and more of a conversation, how are we going to protect this critical infrastructure the same way you IT nerds do for your municipal or enterprise networks. So it's at least a step in the right direction.
Matthew Connor: Yeah, no, it certainly is. And I think you painted the picture really well of the way they see the world, and what they've been used to over the last two or three decades or longer. To me it's so interesting, because if you think about it in terms of a casino heist, let's say Ocean's Eleven, it's kind of like that, you're looking at the security screens, we've all seen it in so many movies, I think it's analogous. You could be sitting there looking at the SCADA and be like, yep, everything is fine. Meanwhile, everything is not fine, because you're just seeing what they want you to see, despite things actually being different. And I think that's the level of technology that exists today, with the help of AI, that is no longer some sort of Hollywood science fiction, for sure. Those types of attacks can and will happen. So when you're taking this old-school approach of, well, I'm looking at it and it's fine, meanwhile it is a hundred percent not fine, what do you do when you can't trust your instruments? That's the problem, they're relying a hundred percent on that, and that is problematic, right?
Tony Bryson: Very, very much so. It's really important, if you are working with critical infrastructure and OT systems from an IT perspective, to really understand the concerns of, for us, your public works partners. We have invested just a ton of time working with them, educating them on what the risks are, what the threat surface is starting to look like, and how we can provide protections for what they want to do, but to do it from an operational technology context more so than an information technology context. Our solution was to work with the best vendors in the marketplace, bring them in as trusted third parties, and make sure they are speaking the language of the guys in the plant, so the guys in the plant can buy in and say, oh yeah, this makes sense, we want to do it this way. So we've got them to understand that you have to have proper network segregation, proper inventory and asset management, proper supply chain management, proper ongoing vulnerability assessment, and, most importantly, full-time system monitoring. If you're not doing that full-time system monitoring, you won't know what's happening until that ransomware screen flashes on your monitor and you're owned completely, at which point you're just burning everything down, and you'd better have a good resiliency strategy in play.
Matthew Connor: And I would argue that in today's day and age, monitoring is no longer enough, because I think traditional monitoring relies on everything, the firewall, the applications, and everything in between, functioning normally and being properly patched, and the logs are very verbose, there's tons of it. And we have seen time and time again, if monitoring alone were enough, there would be no such thing as a breach for a medium-to-large company, because they have tons of monitoring in place. So how did they get past it, with all this monitoring in place? Because they're using advanced techniques we weren't looking at, we didn't see that. And I think we are in a new era. Obviously, 2026 looks nothing like 2020, it's an entirely new world. Cars are driving themselves, and they're eight times safer than human drivers thanks to AI. We live in the future, we're basically all space people living in the future with self-driving cars and AI right on people's computers. So now that we're living in that kind of sci-fi future, I don't think we can rely purely on the traditional methods. You've got to go back to basics, you've got to keep those straight, but I don't think that's the ultimate solution. I don't think you can go into this gunfight with even the greatest knife, and even if you're the best, heck, make it a sword, you're great with the sword. It reminds me of that Indiana Jones clip. That's where we're at today, and we need to be properly armed. And I think the challenge is that, with AI on the adversary side, we need to have clear, usable, powerful AI on the defense. The challenge for a lot of organizations is that they're drinking from the firehose, they've got a day job, they're very busy, and oh, by the way, you need to be up on all the happenings in the industry, and you've now got to filter through and pick a product, or products, that are going to help you. I think it's a real challenge, just the human aspect of balancing your day and your time, because it's finite, with all these new products. If you go with the startups, forget about it, you've got hundreds of them, and where do you even find them? Now you're asking everybody, have you heard about this group, what do you think about this, are they backed, what kind of backing? And then you're gambling your time on whether they'll make it, or whether they'll be bought up and put on a shelf. And if you go with the big guys, the established industry leaders, okay, fine, you still have to go through that process of finding and selecting. Which I think is part of the problem today, a lot of people are just freaking overwhelmed by the speed and the choice, and it creates a bit of analysis paralysis, where people are like, yeah, I know I've got to, but jeez, where do I even start? They know it's an issue, but how do I even start eating this elephant?
Tony Bryson: For us, it was establishing that partnership with our public works division, helping educate them on the challenges they're facing, and giving them context as to what we're trying to do for them. We don't want to do anything with the SCADA solution, we know nothing about SCADA, it's not in our wheelhouse. But some of that other stuff really is, and we can help you by looking at the solutions you need to put in play to secure that operational technology network, and then help find the right business partners to engage with and give them the proper terms and framework to work from, to put in play the proper security solutions. That's kind of what our approach has been, to work with our public works division as a partner and then go out and find trusted third parties that can come in and act as a force multiplier for them. All of a sudden they've got a bench of subject matter experts they can reach out to, pick up the phone and say, hey, we're seeing this, what do you guys see in the SOC, what is it telling you, if they have not already reported it back? So on your comment on system monitoring, I agree for the most part, but you also have to look at it in the context that operational technology has always had system monitoring. That's what SCADA solutions are for, but it's only for the business process, not for what's happening on that network, where a bad actor is actually going to infiltrate the system, get in, and move laterally. That's where additional system monitoring, which you traditionally get through intrusion detection systems, through a SOC as a service or a SOC, is going to provide for you. They're going to notice those types of variances in behavior and help you pinpoint them, so that a bad actor can't really get a foothold in there and do a lot of damage.
Matthew Connor: Totally agree, and I think that's why you have that win. When you partnered in, that was really the win, because, going back to the picture you paint of the operator there, that's the real challenge, and you've got the expertise, and that partnership is so critically important to help bridge that knowledge divide, bring the expertise, bring the partners in. And so you don't need a nation-state budget to secure your municipality's critical infrastructure, what you need is the right partnerships, the right vendors, the right support. So as you said, you've got that bench of experts who can help you. And not to poo-poo SOCs and monitoring, just to clarify, I do think it's critically important that every organization, at any level, have that in place. My thinking is more that, with the shifting landscape, with AI, I think we need to see a shift in how the SOC is built. I think it needs to be rebuilt as an AI-first SOC, and the products and services that support it need to be rebuilt as AI-first. And I wouldn't have said this six months ago, but I think we're in a place now, in September of 2026, where it's a real, viable solution. I think any organization that isn't looking at how we become an AI-first organization, and let's say take humans out of it, not by any stretch, I think the new standard of work, of quality, of speed, is what we see from these frontier models. And I know they've been getting all kinds of flak in the media right now, because, oh, OpenAI, let's go with Hugging Face. Okay, first of all, I think that was clearly a felony, and they should be held accountable for that, because you created something, and then it hacked. If your kid went and hacked, guess what, you're responsible. Your dog bites somebody, you're responsible. So I think they need to be held accountable for what those models do, especially when they're the ones controlling and guiding it, just like an organization needs to be. If you give it commands, and say whatever, and it goes out and does something illegal, guess who's responsible. I think we need to start implementing those laws. However, going back to the point, while they're getting a lot of flak for that, the frontier models over the last couple of months have become so much better at security, at implementing their own guardrails, at committing to that. When you're not pushing a model to its extremes and giving it ridiculous guidelines and ridiculous things to try to see what it can do, boy, in the middle, does it do an amazing job of looking at things you've overlooked, of finding where you've set things up improperly in day-to-day operations, and seeing gaps. It's pretty spectacular, and I think it's a glimpse of the future. Even if AI doesn't get exponentially better than where we are right now, which it will, boy, do we have an amazing tool in the palm of our hands to really help when it comes to security and operations. So, to get back to the point, I think SOCs need to be redone as AI-first, and I think every organization needs to be looking at how we become an AI-first organization, with compliance and governance in mind. The cool part is the models now help you do it right. They will guide you through that thought process as well and hold themselves to it. So I think we're seeing huge advances that are being overlooked in the media today, and I think that's a problem.
Tony Bryson: Well, I think you hit the nail right on the head, and that was the mention of governance. As far as operational technology goes, it is a little bit of the Wild West. Yes, each of the various industries has their own framework that they expect you to comply with and work towards, but I don't think there is a good, solid standard that operational technology should be measured against, so that we can protect the entirety of it together. We really do need some type of regulation from the feds that says, here's how you need to secure your critical infrastructure. We've seen a couple of executive orders come out, but we saw lots of lawsuits pushing back against those particular executive orders. We need that guidance from the federal government that says you need to meet or exceed this minimum standard. For US water and wastewater, we look at IEC 62443 as our framework to work from, and the Purdue model for how we pull everything together. But the reality is that it would be much better if the feds produced something, gave us a US law that says this is the minimum standard you will meet, these are the protections you'll have in place. Now, of course, the reason that hasn't happened is a lot of states have pushed back and said you can't give us an unfunded mandate like that, it passes an undue burden on to the states, or back on to the municipalities, to follow. But in reality it is something we ultimately need, so everybody does things in a consistent manner and we have the appropriate protections in place, because nation-state actors recognize that it is the Wild West, and they can leverage all sorts of zero-day attack vectors that are out there, and there's nothing we can do because we don't have any type of foundation to fall back on. It'd be nice to have that, so if we run into a situation like Minnesota or Michigan, they can reach out to the feds immediately and get expert help from either the Department of Defense or the intelligence community, whoever, to help them combat the attack that's going on and defeat the adversary that is trying to take down that service to the public.
Matthew Connor: Yeah, no, I'm a little conflicted. On the one hand, it's a hundred percent true that it would be great if the federal government could simply mandate, these are the standards, meet them. I see it from the states' and municipalities' point of view too, like, hey, you can't just tell us what to do and give us no money at the same time. I'm a little torn, because as an entrepreneur and a businessman, I think, okay, if my product and service is, let's say, water treatment, great, guess what, you don't have a lot of choice in what water treatment facility you're going to use when it comes to the water in your town or city. You get the water that you get, because it's all pipes, the pipes are there and that's what you're going to get. So if there's now a mandate, or just a need for more security, okay, great, so I need to spend, I don't care, a million dollars a year now on OT security, cool, but I don't have it in the budget. Well, how much more do I have to raise the price of water, in water treatment and wastewater, to cover that bill? Not a lot, right? If everybody's water bill goes up ten dollars, or whatever it is, that's going to cover this. I don't see the problem there, but again, I'm not in it. So for me it's like, why is that not what these water treatment facilities are doing, when they say, you know what, we're going to have to raise the rates a little bit to cover it?
Tony Bryson: Yeah, these businesses and municipalities and state governments kind of have to look at the investments they have in the ground and say, okay, I've got two, three, four billion dollars of buried infrastructure, is spending a million bucks to secure that a bad investment? If that two to five billion dollars of infrastructure becomes a huge brick, then what, you have to rebuild that? Oh man. And the absolute trust you're going to lose from the citizens, from the electorate, that's not a good day for anybody. So a million bucks is not a lot of money when you consider the alternative and what your investment buried in the ground is. It's a good investment to spend that money, secure that system so it remains up, and achieve that six-nines status you're looking for.
Matthew Connor: Well, now we're talking about critical infrastructure, how do you put a price on human life? That's what gets me. Hold on, because at the end of the day, that is exactly the calculus you've done when you've decided, I'm not going to invest in this, or I just want to bury my head in the sand and keep doing what I'm doing because it's fine. Hold on, you're gambling with people's lives, and you're telling me you won't raise the price, you won't find a way to finance it? I think if you put it up to the people, they'll very clearly say, yeah, raise my water a dollar a month so that I will be sure not to be poisoned and killed. That's a no-brainer. Even on the tightest of household budgets, I don't think that dollar is going to, of course, that's a bit of a generality, but in general, it's not like the price of water in the United States is exorbitantly high and it's a real problem for people to afford. So I don't understand. Is it just that we're not telling the story properly?
Tony Bryson: On the nose. I think that's the biggest problem, because that is something we're facing at the Town of Gilbert. We have had a dramatic rate increase in water, because we traditionally charged very low rates for water. Our infrastructure has been in the ground for twenty-five to thirty years, and we live in an environment where the ground is extremely acidic, so it eats away at that infrastructure much quicker. So we're now at a point where we have to begin replacing that infrastructure, and we've had to increase our water rates as a result. Our citizens are not happy with that, and I don't blame them. Who wants to see an increase in a cost you've kind of budgeted for and think you have under control? Nobody wants to see that, but the reality is that we have to replace this infrastructure. It costs money to do that, and the only place we can get it is through service fees. We make sure that as we're putting these services in play, they can pay for themselves, that they're self-sustaining. I think the big problem is that we have maybe not been very good at getting out in front of this and having those conversations with the public, letting them know, hey, we've got all this infrastructure we have to replace. Did we have to replace it early? Yes. Is it anybody's fault? No, it's the environment we live in. We live in a part of the country where the soil is very acidic, the water that we see is very hard and very turbid, so we've got a lot of challenges, and our infrastructure ages a little quicker than in other parts of the nation, and we have to take that challenge on. So getting out there in front of it and telling the story to your constituent base, letting them know what the facts are, is extremely important. If you're not doing that, I think you're doing your municipality a disservice, you're doing your customers a disservice, and you're doing your overarching system a disservice. You have to continually have conversations with your constituents, let them know what is happening, the health of things, why we do things the way we do. And when you do that, I think you get a much better informed electorate, and they will give you a lot more support on some of the challenges you have to take on, especially the surprising ones.
Matthew Connor: I'm a big believer that everything makes sense with enough information. It just does. I've never known anybody who wasn't actually crazy to do something that was actually crazy. I might not understand it at first, but once you have all the information, it makes perfect sense. And I think people, given all the facts of what's going on, to your point, get out there and tell them, educate them, tell the story in a way they can hear it. And the reality is, it sounds like for twenty or thirty years they were getting subsidized water costs, we were helping you out, but now we have to start reinvesting and replacing all this infrastructure, and it's going to cost a little bit. We're going to do our best to keep the cost down as much as we can, but if we don't, you're going to be really upset when your water is constantly not working, or there's gross stuff in your water, you name it. So to keep everybody healthy and happy, this is just what we've got to do. And I think people get that. If you're upfront and honest with people, they will take you at face value.
Tony Bryson: I remember presenting at an artificial intelligence symposium in downtown Phoenix. I was on a panel, and they did question and answer, and the last person to ask a question was a citizen of my municipality, and they brought up water rates. It was like, oh boy, here we go. But I just listened to the question, and I said, I'll tell you what, I'm not going to run away from that, I'm going to tell you exactly what we have to do, and hopefully some of the things we can do in the future that will help with the challenges we're facing right now. And I leaned heavily into artificial intelligence, and I told them, basically, in the future, maybe we'll get to the point where we've got smart meters on your house that will help identify a leaky water line that is costing you hundreds to thousands of gallons a month and directly impacting your water bill. You're paying for it, and you don't even know you're paying for it. Again, very upfront and honest with them, I told him some of the challenges we're facing as a municipality, and he was like, oh, okay, I get it. Afterwards, as I was preparing to leave, he came up to me and said, hey, thank you for telling me that, I didn't know half the challenges you guys were facing, and I understand now why the rate increase was required. I get it, I appreciate that now. I'm still not happy about it, but I at least understand it.
Matthew Connor: Yeah, and I think a rate increase doesn't even compare to the price of a leaky faucet. I think probably everybody has experienced that, where some hose got left on, there was some leak, and you get hit with a massive bill and you're like, wait, what? It happened to us, and we installed this Flume device that sits on the meter, and the second there's a leak, it tells you. I can't tell you how many leaks, it's a pretty new house, and how many leaky toilets, I'm like, really? It's ridiculous. You find it, you fix it, fine, but those things add up, and that's a lot cheaper than getting hit with even one of those bills. So that's a great use of technology right there.
Tony Bryson: Well, and I also think some people don't think about downstream impacts of some of this stuff. Yes, we live in a desert, so water and water distribution is extremely important. You want someone to be upset, stop the water flow into their house. But what they don't understand is that the more important aspect of that is the wastewater removal. To me, that is actually the most important service we provide to the public, the reclamation of that wastewater that's coming out. Because frankly, if that stuff starts bubbling up into the streets, that's how cholera outbreaks happen. Living in a hot environment like this, that could turn into something just horrific really quickly. So critical infrastructure is an extremely important business, and making sure it's safe and secure is job one, in my estimation.
Matthew Connor: Yeah, I think you've done a really great job of painting the picture today. There are so many challenges facing every municipality of any size, and I think we've hit a lot of really good points. I don't know how we get everybody to move forward other than, as you were saying, the partnerships. I think you've nailed it, and it's clearly worked for you, and that's a playbook others need to be implementing as well, because I don't think it works any other way. They've been doing the same thing for decades, and it makes sense why they're still doing it. And I think the only way is for folks in your position to partner with them and start moving them in the right direction, to fill in those gaps and needs and move the ball forward, because otherwise, it's critical for a reason, right?
Tony Bryson: Yep. Hey, the guys in the plants are rock stars. They keep the system up and running, they keep the water flowing, they keep the bad stuff being reclaimed and filtered and put back into the hydraulic cycle. They're rock stars, but it's also extremely important that they understand that they don't know what they don't know, and reach out and get an expert who can step in, help them understand that, and put solutions in play that can secure that system they're so responsible for.
Matthew Connor: Nope, couldn't agree more. Tony, this has been an absolute pleasure. I think this is such an important conversation, and you've done such a great job of highlighting not only the situation, but also giving people ways of approaching it that are affordable and doable, not just pie in the sky, if you had an unlimited budget, which nobody does. So I think this is great, and I commend you for bringing these up and helping people to see it. I hope everybody starts adopting the same sort of practice, because I think the country will be in a much better place if and when they do, and I thank you for that. Before we go, can you tell everybody where they can find out more about you and more about Gilbert?
Tony Bryson: gilbertaz.gov is our website. Personally, the best way to get a hold of me is through LinkedIn, my profile is searchable there, easy to find. People found out from the last podcast.
Matthew Connor: That's right.
Tony Bryson: So yeah, just reach out to me on LinkedIn and you can connect with me that way.
Matthew Connor: Perfect. Tony, thanks again for coming on, and until next time.
Tony Bryson: You bet, thank you.