Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Cybersecurity Risk Management and Strategy Disclosure	Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	The Company’s Cybersecurity Program The Company’s cybersecurity program is an integral part of the long-term sustainability and effectiveness of the Company’s operational and technology environment. To protect the integrity of its data and operational and technology systems, the Company employs a “Zero Trust” strategy that uses multiple security measures. This strategy aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. The Company periodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants. The Company’s cybersecurity program includes the following areas of focus: •Technology that includes, among other things, encryption, threat management, monitoring, investigation support and backups for physical devices, such as mobile phones and computers, connected to the Company network; •Identity and access management controls that include, among other things, multi-factor authentication and safeguards associated with granting elevated privileges; •Proactive cybersecurity processes, including vulnerability scanning, penetration testing and periodic program assessments by outside security consultants and assessors; •Reactive cybersecurity processes that are regularly evaluated using various incident response and disaster recovery exercises; •Employee cyber risk awareness and training, including regular simulation exercises with employees, that covers cybersecurity threats and actions to prevent and report attacks; and •Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring and contractual obligations, and periodic review of third-party control environments to align the Company’s risk exposure with its business requirements and risk tolerances. Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations and has implemented a third-party risk management program to understand the cybersecurity risks to the Company that may arise out of these third-party relationships. The Company categorizes third-party relationships by risk level, which is determined primarily by the service provided by the third-party and its level of access to the Company’s data. Each category has specific cybersecurity controls, data privacy and documentation requirements, which are outlined in the agreement between the Company and the third-party service provider. In addition, the Company evaluates the online security footprint for its service providers at the time of agreement, and on a regular basis, thereafter, depending on the provider’s risk level. The Company reviews its agreements with third-party service providers periodically related to terms and conditions governing cybersecurity controls and data privacy. The Company also monitors, as appropriate, risks relating to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols. Cybersecurity Risks Cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and information technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving and increasingly complex nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. To date, the Company has determined that it has not experienced a cybersecurity incident that has resulted in a material impact to the Company’s financial condition, results of operations, cash flows, or business strategy. For additional information concerning cybersecurity-related risks, see Item 1A—Risk Factors—Risks Related to Our Industry and Business Operations—We have been, and may in the future be, subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured. Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company’s Chief Information Security Officer (“CISO”), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company’s internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company’s Chief Security Officer, and holds the Certified Information Systems Security Professionals from the International Information Systems Security Certification Consortium. The CISO serves on several working groups within the Water Information Sharing & Analysis Center and across the water industry. The CISO reports directly to the Company’s Chief Technology and Information Officer, who is responsible for the Company’s information technology program. The Company’s cybersecurity unit conducts annual and ongoing cybersecurity awareness training and education for the Company’s employees. In 2025, 100% of the Company’s active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce. The Company’s cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company’s cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company’s existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company’s information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company’s data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company’s customers. The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company’s cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company’s internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company’s exposure to material cybersecurity threat risks.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Board of Directors Oversight [Text Block]	Cybersecurity Governance The Board of Directors is responsible for oversight of the Company’s cybersecurity program and the Company’s responses to cybersecurity risk. The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company’s operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company’s cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company’s system of internal controls and the Company’s risk assessment and management strategy, including with respect to cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	The Board of Directors is responsible for oversight of the Company’s cybersecurity program and the Company’s responses to cybersecurity risk.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities.
Cybersecurity Risk Role of Management [Text Block]	The Board of Directors is responsible for oversight of the Company’s cybersecurity program and the Company’s responses to cybersecurity risk. The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company’s operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company’s cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company’s system of internal controls and the Company’s risk assessment and management strategy, including with respect to cybersecurity risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company’s operational performance or risk profile.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company’s Chief Security Officer, and holds the Certified Information Systems Security Professionals from the International Information Systems Security Certification Consortium. The CISO serves on several working groups within the Water Information Sharing & Analysis Center and across the water industry.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company’s cybersecurity program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

American Water Works Company, Inc. 10-K