Hackers scale up free water utility cyber defense

Rural water utilities across the United States have long been a soft target for attackers, but a new initiative unveiled at DEF CON aims to change that by bringing commercial-grade security monitoring to the smallest systems. The program, called the Water Watch Center, was announced Friday by DEF CON Franklin and the National Rural Water Association (NRWA), marking a significant expansion of the volunteer effort that began two years ago.

A Pyramid of Protection

The Water Watch Center is structured like a pyramid, with the NRWA at the top, managed detection and response (MDR) providers deploying sensors across utility networks, and Franklin volunteers at the base, ready to fix issues or respond to alerts. Initially, five providers—Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies—will help small water utilities serving fewer than 10,000 people detect and mitigate breaches.

The providers will exchange threat intelligence and share it with the NRWA, which offers technical assistance and operational support to small water and wastewater utilities across all 50 states. This coordinated approach aims to create a scalable delivery mechanism for cybersecurity, which has been lacking for the estimated 150,000 water utilities, 98 percent of which are small businesses.

Scaling What Already Works

Jake Braun, co-founder of the Franklin project, explained the rationale behind the new model during an interview at DEF CON. “We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses,” he said.

We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them

— Jake Braun, co-founder, Franklin project

Braun noted that the team “groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses - it’s MSSPs. So why don’t we just do that?” The Franklin project, launched at DEF CON in 2024, saw 350 people sign up that year to volunteer their time and skills to securing water facilities.

Expanding to Cover All Regions

The program will grow from its initial five providers to ten, aligning with the ten CISA regions. “We have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions,” Braun said. “And then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we’re not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That’s been the missing piece: there has been no delivery mechanism for cybersecurity that’s scalable nationally - that's what this is.”

The Threat Landscape

The urgency of this effort is underscored by recent attacks. Suspected Iranian hackers have hit numerous water systems in recent weeks, with most being small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. While there is no indication that the attackers used AI to plan or carry out these disruptions, cyber and national security experts told The Register on the sidelines of Black Hat and DEF CON that it is only a matter of time before such attacks become AI-assisted.

Preparing for AI-Powered Attacks

DEF CON Franklin has a plan for that scenario. The Water Watch Center has partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few water and wastewater system environments, allowing researchers to deploy both red- and blue-team agents across these digital replicas.

The red-team attack agents attempt to hack the water systems, testing the blue-team defenders’ automated detection and response capabilities. The ultimate goal is to deploy AI-based defense to water and wastewater facilities across the US. “They let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities,” Braun said. “There's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things.”

Why It Matters

The Water Watch Center represents a pragmatic response to a persistent problem: rural water utilities lack the resources and expertise to defend against increasingly sophisticated cyber threats. By leveraging managed detection and response providers, the program offers a scalable solution that can be replicated across the country. The integration of AI and digital twins is a forward-looking step that could prepare these utilities for the next generation of attacks. For the communities that depend on these small systems, this initiative could mean the difference between a minor disruption and a catastrophic failure. As the threat landscape evolves, this model may prove essential in closing the cybersecurity gap that has left rural America vulnerable.