CIO strategic question — answered

33,000 miles of pipe, $6.4B of 2026 capex and a 400 MW hyperscaler go-live are converging on an IT/OT estate that sits mid-pack Band B — and the technology envelope must be locked in this year, not next.

Williams delivered a record $7.75B Adjusted EBITDA in 2025 and 2026 growth capex triples to $6.4B midpoint. Project Socrates (400 MW / $1.6B, Meta, late 2026 ISD) plus $5.1B committed Power Innovation drops Williams into hyperscaler-grade SLAs for the first time. A $180M foundational program (S2) closes the TSA floor; a $360M full program (S3) closes the Socrates and peer gap — roughly 4% of the 3-year growth capex envelope.

Company: Williams Companies (NYSE: WMB) Audience: CIO + IT Leadership Data: 2025 10-K, Q1-Q4 2025 releases, TSA SD-02F, peer filings Generated: April 8, 2026

33,000+

Pipeline Miles
Transco anchor

$7.75B

2025 Adj EBITDA
Record year

$6.4B

2026 Growth Capex
Midpoint

400 MW

Socrates Meta DC
Late 2026 ISD

$360M

S3 Tech Envelope
3-year ask

The inflection: growth capex tripled, Socrates imports hyperscaler SLAs

Growth capex has tripled from $2.1B (2022) to $6.4B (2026E). Socrates drops Williams into a behind-the-meter, tenant-facing operating model the current stack was not designed for.

Williams growth capex — $2.1B to $6.4B in 4 years

3.0x expansion. The capex wave arriving in 2026-2028 is the Power Innovation and LNG-adjacent buildout. Technology budgets that do not ride this wave get eaten by steel-in-the-ground.

Adjusted EBITDA compounding — $6.42B to $8.20B guided

9% 5-year CAGR. Provides the financial cover to authorize a $360M 3-year tech envelope without affecting dividend or leverage.

The pincer: Capex is tripling while the compliance surface is tightening (TSA SD-02F expires May 2, 2026; reissue expected) and the talent pool is shrinking (≈50% of midstream workforce retires within a decade). The CIO who does not lock a named technology envelope into the 2027 plan will spend the back half of the decade chasing Power Innovation with steel already in the ground. The Socrates go-live is not an operations decision — it is a technology operating model change.

Project Socrates + $5.1B Power Innovation — the new IT/OT adjacencies

Five projects, $5.1B committed, none of which the current IT stack is ready for. Hyperscaler telemetry, NERC CIP overlap, tenant APIs and multi-tenant segmentation all land on the CIO in the next 18 months.

Project / Commitment	Scale	Target ISD	New IT/OT Requirement	Ready Today?
Socrates North + South New Albany, OH — Meta AI DC	400 MW / $1.6B	Late 2026	Hyperscaler telemetry, tenant segmentation, behind-meter SCADA, OpenTelemetry-style exports	No
Additional Power Innovation (5 proj.)	$3.1B committed	Mid-2027+	Multi-tenant ops, NERC CIP overlap, customer API surface with external SLAs	No
Transco Power Expansion Virginia — data center load	Pipeline expansion	2027-2028	Load-following nomination, demand forecasting ML, second-level metering	Partial
Hydrogen / CCUS New Energy Ventures	~$50M+ invested	2027+	New sensor taxonomies, blended-fuel simulators, carbon-accounting pipelines	No
ION Clean Energy Venture equity	Venture	TBD	Carbon accounting data fabric, 45Q/45V tax-credit reporting pipes	Partial

Four CIO-specific Socrates shocks: (1) hyperscaler telemetry expectations — second-level metering, OpenTelemetry exports, MTBF reported like a cloud region; (2) behind-the-meter generation imports NERC CIP-002 through -014 into an estate that has been TSA/PHMSA-only; (3) tenant-facing APIs now carry external SLAs — belongs in enterprise IT governance, not a plant engineer's spreadsheet; (4) segmentation problem gets harder — behind-the-meter gen, customer telemetry, gas control and corporate IT must all be separable without breaking workflow.

The 10-domain CIO scorecard — where Williams is Band B today

Ten domains a midstream CIO must hold a view on. 4 High-risk (3 and 4 are twin findings); 5 Medium; 1 Low. All posture figures labelled est. are peer-inferred and must be validated before capital committee use.

#	Domain	Williams Posture (est.)	Peer Reference	Gap	Risk
1	Cloud Migration (Enterprise Apps)	~35-45% non-OT workloads	KMI / ENB ~60-70%; EPD ~40-50%	15-25 ppts to top quartile	Medium
2	SCADA Modernization	Mixed AVEVA OASyS + legacy	KMI unified SCADA; ENB AI integrity	Partial gap	Medium
3	IT/OT Convergence (Purdue L2/L3)	Partial segmentation; uneven across legacy	Top quartile 100% monitored boundaries	Meaningful	High
4	OT Cybersecurity Tooling	Lead CPS vendor not publicly confirmed	Peers publicly name Dragos / Claroty	Transparency + coverage	High
5	Digital Twin Coverage	PI System in place; twin not scoped	AVEVA enterprise twin customers full coverage	Scope + funding	Medium
6	AI / ML for Pipeline Integrity	CTO AI mandate; use cases private	ENB ML leak detection in prod; Shell PdM -25% downtime	Production use cases	Medium
7	ERP Modernization (SAP)	S/4HANA migration status not public	Peer migrations in progress through 2027	Public plan	Medium
8	Pipeline Integrity Management System	In use; PHMSA compliant	Peer universe comparable	None structural	Low
9	Data Center / Hyperscaler Readiness	Socrates operating model not yet proven	Utilities peers have hyperscaler tenant history	Full stack	High
10	IT/OT Workforce Pipeline	Tulsa concentrated; aging OT cohort	All peers face same retirement wave	Structural	High

The pattern: Williams is mid-pack across nearly every domain with no laggard Red Flags — but concentration of high-risk domains on the new operating surfaces (hyperscaler, OT cyber, Purdue segmentation, IT/OT workforce) is exactly the wrong shape for a Socrates go-live. Eight of ten domains are fixable with a named technology envelope. Two (compliance tax, safety-driven OT upgrade cadence) are structural.

Peer benchmark — silent on four CIO disclosures that peers publish

Six-way comparison: Williams vs KMI, EPD, OKE, ET, ENB. Williams is mid-pack on IT spend and cloud share — but silent on the lead CPS vendor, cloud target date, digital twin scope, and Socrates operating model.

Operator	Revenue ($B)	Cloud Share (est.)	OT Cyber Tier	Digital Twin Scope	AI/ML In Prod	IT % Rev (est.)
Williams (WMB)	~11	40%	Band B est.	PI + partial twin	Private	1.4%
Kinder Morgan (KMI)	~16	65%	Band A est.	Enterprise twin published	Published AI strategy	1.8%
Enbridge (ENB)	~40	62%	Band A est.	Enterprise twin published	ML leak detection in prod	1.7%
Enterprise Products (EPD)	~58	48%	Band A-B	Partial	Moderate	1.4%
ONEOK (OKE)	~22	45%	Band B est.	Partial	Moderate	1.6%
Energy Transfer (ET)	~83	35%	Band B-C	Limited	Limited	1.1%

Estimated cloud workload share — non-OT workloads

Williams at 40% trails KMI (65%) and ENB (62%) by 20-25 ppts. Same IT spend intensity as EPD — lower cloud progress.

Published AI/ML prod use cases + Digital twin coverage

Williams: 2 public AI use cases and ~40% twin coverage. ENB leads both dimensions.

What's missing from Williams' public posture: (1) a named lead CPS cybersecurity vendor, (2) a published cloud migration percentage or target date, (3) an enterprise digital twin scope statement, (4) a post-Socrates operating model description. Peers have published at least 2-3 of these. Silence on all four is the finding.

Root cause analysis — six drivers, four fixable, two structural

Why a company with Williams' financial strength is not publicly presenting a top-quartile technology posture. Approximately two-thirds of the gap is operationally addressable inside 18–24 months.

#	Driver	Nature	Fixability	Time to Address
1	No named enterprise CIO role in public org (post-Letzkus CTO function only)	Operational	Fixable	6 months
2	Technology spend embedded in project capex, not a standalone line	Structural + Operational	Partial	2027 plan cycle
3	Multi-regulator compliance tax (PHMSA + TSA + FERC + EPA + NERC + 14 states)	Structural	Inherent	Does not compress
4	Safety & availability risk aversion on OT — 20 Bcf/d cannot absorb normal upgrade cadence	Structural + Operational	Partial	Blue-green methodology
5	Tulsa-centred talent pool with limited hyperscaler adjacency	Operational	Fixable	18-24 months
6	Public tech narrative dominated by AI, not foundational modernization	Operational	Fixable	Next investor day

Fixability decomposition — where the gap to top quartile lives

Roughly 2/3 operationally addressable by the CIO/CTO function in 18–24 months. Roughly 1/3 structural — inherent to a multi-regulator, high-consequence, geographically dispersed operator.

OT cyber program maturity — Williams vs peer median (0–100)

Williams trails the peer median by 6 points at 68 vs 74 in 2025. The gap is not widening — but it is not closing either.

OT cyber Band A/B/C — and the May 2026 TSA SD Pipeline reissue

SD Pipeline-2021-02F expires May 2, 2026. Reissue historically tightens segmentation + CPS monitoring expectations. Williams sits in Band B; 30–60 day window to move publicly to Band A.

OT cybersecurity tiering — where Williams sits

Band A = published program with named CPS vendor + SOC runbooks. Band B = in-flight, no public narrative. Band C = flat network legacy.

Regulatory stack + action register — key exposures

TSA SD-02F reissue + CIRCIA + NERC CIP via Power Innovation = new compliance surface. All HIGH risk inside 12 months.

Williams-specific finding: the CTO's AI mandate and absence of a public lead-CPS vendor announcement (vs Enbridge/KMI) suggests Band B positioning. The 2026-2027 window is the right time to move publicly to Band A — not because disclosure is required, but because the reissue cycle rewards documented maturity. Post-Colonial Pipeline political appetite to prosecute OT cyber incidents is high — any DOJ/CISA-coordinated response lands on the C-suite in hours.

CIO SWOT — Williams Companies technology estate

Every bullet references a public metric from the 2024/2025 filings or a peer-anchored estimate. Audience: CIO and senior IT leadership team.

Strengths

• $7.75B 2025 record Adj EBITDA, 9% 5-yr CAGR gives the CIO financial cover to authorize $300–450M tech envelope without stressing leverage or dividend
• Transco 20+ Bcf/d design, 10,000 mi national footprint — largest single SCADA footprint in the peer set creates economies of scale for modernization
• AVEVA PI System historian already in place (midstream standard) — the digital twin precondition is already funded
• Tulsa HQ concentration provides deep midstream operational knowledge and a stable IT/OT retention story vs more dispersed peers
• Socrates + $5.1B Power Innovation places Williams inside the AI infrastructure value chain as a supplier — the CIO now has a business reason, not just a technical one, to build hyperscaler-grade telemetry

Weaknesses

• No named enterprise CIO role in 2025 public filings — technology reports through a CTO function (Naveen, post-Letzkus) with an AI mandate. Governance ambiguity at the top of a $170M-run-rate (est.) stack
• No publicly stated cloud migration target or date — KMI and ENB have published narratives. 40% est. cloud share trails top quartile by 20-25 ppts
• No publicly named lead CPS cybersecurity vendor — Band A peers publish Dragos or Claroty relationships. Audit evidence depth is the concern, not current compliance
• Technology spend embedded in project capex, not a named enterprise modernization line inside the $6.1-6.7B growth envelope — under-funds cross-cutting foundation work
• Socrates creates a new operating model (behind-the-meter, hyperscaler tenant, NERC-exposed) with no publicly visible IT operating model change to match — biggest known CIO gap in the portfolio

Opportunities

• ML leak detection playbook is mature: Enbridge has published production deployments; Shell has published −25% downtime from pipeline PdM. Williams can skip the proof-of-concept phase
• Enterprise digital twin on AVEVA PI + Enterprise SCADA unlocks compressor PdM, integrity ML, and Socrates telemetry simultaneously — one investment, three use cases
• Formally tiering to OT cyber Band A before May 2026 SD-02G reissue converts a compliance obligation into a reputational asset and audit accelerator
• Houston/Austin satellite engineering hub specifically for hyperscaler-adjacent IT/OT engineers de-risks Socrates operations and reduces Tulsa labor pool dependence
• Standardize IT/OT reference architecture across Power Innovation portfolio — the next Socrates is easier than the first

Threats

• TSA SD-2021-02G reissue (expected May 2026) will likely tighten segmentation + CPS monitoring. Band B operators face evidence-gathering pressure. Timeline: 30–60 days
• ~50% midstream workforce retires within a decade — IT/OT hybrid engineers are the scarcest archetype. Tulsa concentration amplifies the squeeze. Timeline: continuous, acute 2026–2030
• Hyperscaler SLAs on Socrates expose telemetry gaps publicly — a single Meta-visible incident in the first 12 months lands on the C-suite. Timeline: 12–24 months
• Post-Colonial political appetite to prosecute OT cyber incidents is high — DOJ/CISA response to any measurable event becomes a board-level matter in hours. Timeline: continuous
• Legacy ERP + SCADA technical debt compounds silently — each year of deferred S/4HANA + SCADA consolidation raises eventual replacement cost and blast radius. Timeline: 3–5 years acute

Four scenarios — $0 / $180M / $360M / $450M over 3 years

S2 is the minimum viable posture for the 2026 TSA reissue. S3 is the cost-of-doing-business in a Socrates-era operating model (~3–4% of 3-year growth capex). S4 adds the future-fuels data fabric.

Scenario	Key Variable	3-yr Investment	2028 Cloud Share	2028 Digital Twin	2028 OT Tier	Socrates Ready?
S1: Status Quo	No net-new program	$0	~45%	~45%	Band B	Partial
S2: Foundational	Cloud + SCADA + Segmentation	$180M	~60%	~55%	Band B+ to A	Yes (reactive)
S3: Full IT/OT/Twin	S2 + enterprise twin + AI at scale	$360M	~70%	~75%	Band A	Yes (proactive)
S4: S3 + H2/CCUS	+ future-fuels data fabric	$450M	~70%	~80%	Band A	Yes + future fuels

S3 $360M Technology Investment Bridge — 3-year allocation across 6 workstreams

Cloud + data platform is the largest single pool ($95M). OT cybersecurity is $55M. Socrates operating model is $35M — smallest line, largest strategic stake.

Scenario takeaway: Williams should not fall below S2 under any capital scenario. S3 is the cost-of-doing-business in a Socrates-era operating model and runs ~3–4% of the 3-year growth capex envelope — small relative to the strategic stakes. Skipping S2 and staying at status quo is the most expensive option measured against strategic risk. The financial savings (zero) are dwarfed by the exposure to a single Socrates incident, a TSA audit finding, or a pipeline integrity event that ML could have caught.

Workforce — one hybrid engineer per 3–4 open roles, Tulsa amplifies the squeeze

IT/OT hybrid engineers are the scarcest archetype in midstream. Williams' Tulsa concentration is a strength for operational talent but a constraint on hyperscaler-adjacent hiring. Four concrete moves within CIO control.

Role Archetype	Current Supply	2028 Demand Δ	5-yr Retirement Risk	Mitigation Priority
SCADA / Gas Control Engineers	Adequate (Tulsa deep)	Flat to +10%	High	Apprenticeship + knowledge capture
OT Cybersecurity (Purdue-fluent)	Scarce	+40%	Medium	Vendor training + external hire
Cloud / Data Platform Engineers	Thin in Tulsa	+60%	Low	Houston hub + remote
Pipeline Integrity ML / Data Science	Scarce	+80%	Low	University partnership + hire
ERP / SAP S/4HANA	Adequate	Flat	Medium	Partner-led migration
Hyperscaler Tenant Ops (new role)	Near-zero internal	+100%	Low (new)	Socrates residency + partner
NERC CIP Compliance Specialists	Near-zero internal	+80%	Low	Hire + external counsel
Retired Plant / Control Room Mentors	Declining	−20% supply	Very High	Formal ride-along program

Four CIO moves, none requiring org chart change: (1) formal Houston IT/OT engineering hub targeting 40-60 hybrid engineers over 24 months; (2) internal IT/OT hybrid apprenticeship program pairing cloud hires with retiring OT operators for 12-18 months (Aramco/BP model); (3) publicly commit to a lead CPS vendor (Dragos, Claroty, or Nozomi) and negotiate enterprise training inside the contract; (4) create a Socrates residency program — engineers rotate through New Albany build/ops to create a cadre of hyperscaler-ready staff before the next Power Innovation project goes FEED.

10-item decision framework — ranked, sequenced, ready to execute

H1 Protect & De-Risk (0–6 months) · H2 Commit & Build (6–18 months) · H3 Transform (18–36 months). Each item has a named owner archetype, a capital ask, and a time horizon.

The bottom line for the Williams CIO

Williams has the financial strength (record $7.75B 2025 EBITDA, 9% 5-yr CAGR, $8.2B guided 2026), the operational platform (33,000+ miles of pipe, 20+ Bcf/d Transco, one-third of U.S. gas), and the strategic mandate (Project Socrates 400 MW / $1.6B, $5.1B Power Innovation committed) to operate a top-quartile midstream technology estate. What is missing is a named enterprise CIO role, a published technology modernization envelope, a lead CPS cybersecurity vendor, and a Socrates IT/OT operating model. A $180M foundational program (S2) closes the TSA floor; a $360M full program (S3) closes the Socrates and peer gap at roughly 3–4% of the 3-year growth capex envelope. The capex envelope is expanding, the compliance cycle is tightening, and the talent pool is shrinking — all three trends favor acting in 2026, not 2027. Start this week with three moves that cost nothing: clarify the CIO role, name a lead CPS vendor, and write the four-slide technology appendix for the next investor day. Then authorize S2 in the 2027 capital plan. Technology that does not ride this capex wave will be eaten by steel in the ground for the rest of the decade.