DEF CON Franklin and the NRWA announced the Water Watch Center, aiming to bring cyber defence services to US water utilities.

The programme was announced during the DEF CON conference in Las Vegas and aims to give small utilities direct access to managed detection and response services after what the organisations described as a potentially widespread nation-state cyberattack on US water systems.

NRWA CEO Matthew Holmes said: “Water systems are facing increasing cybersecurity risks, and with the Water Watch Center, we’re providing rural systems with trusted resources to secure our nation’s water infrastructure.”

The programme targets a large, fragmented part of the sector. Water systems serving fewer than 10,000 people account for 91 percent of the roughly 50,000 community water systems in the US, according to the announcement.

DEF CON Franklin and NRWA have not disclosed the alleged Iranian incident’s affected systems, technical method, timeline, or operational consequences. The release also does not identify a named government agency that attributed the activity. Its central claim concerns the service model now being assembled for utilities with limited cybersecurity capacity.

A managed detection model for rural water systems

Under the Water Watch Center model, an initial group of five managed detection and response providers will deliver cyber services directly to qualifying water utilities. Defendify and Legato Security form part of the initial provider group. L1 Secure, Rapid7, and Sentinel Technologies also joined the effort.

The providers will exchange threat information through a dedicated collaboration mechanism. NRWA will receive that information as the national hub, though the announcement does not specify the technical platform, data formats, alert-routing process, retention rules, or the conditions under which utilities receive incident notifications.

That, of course, leaves core operational questions unanswered. Utilities need to establish who monitors alerts outside business hours, who can access operational technology environments, and who has authority to contain an incident once a provider identifies suspicious activity.

DEF CON Franklin co-founder and former White House acting Principal Deputy National Cyber Director, Jake Braun, said the providers already support water utilities. He said the programme selected firms familiar with cybersecurity in water utility environments and will use DEF CON Franklin volunteers to help lower costs for financially-constrained utilities.

“These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry and national security officials to date,” said Braun.

“Our incredible Franklin volunteers will support the effort to keep costs down for cash-strapped utilities fending off adversaries like the Iranian Red Guard or Chinese Military. To further accelerate the effort, we hand-picked cyber providers who already support water utilities. These folks walk in the door knowing the intricacies of cybersecurity in a water utility environment.”

Two years of utility engagements informed the programme

DEF CON Franklin spent two years recruiting nearly 450 volunteer cybersecurity experts and pairing many of them with water and wastewater utilities. The work covered utilities in Arizona, Indiana, Oregon, Utah, Vermont, Washington, and Wyoming.

Those engagements strengthened defences at individual utilities, the organisations said. The release provides no before-and-after security results, incident counts, or details about the controls that the volunteer teams deployed.

Scale remained the central constraint. DEF CON Franklin said its work exposed the problem of extending security support across 150,000 water and wastewater utilities.

Jeff Moss, DEF CON’s founder, said the volunteers worked with under-resourced utilities to analyse data and test hypotheses. He added that many of those hypotheses did not work. The release does not identify the tested approaches or explain why they failed.

That admission carries practical value for prospective participants. A centralised service can reduce the need for every small utility to independently source specialist cybersecurity staff, though each system still needs to define local access, escalation, and operational ownership before an outside provider connects to its environment.

Maryland outreach adds a national security dimension

Water Watch Center staff have begun working with Cyber Maryland to identify and engage rural utilities across Maryland. The partnership extends outreach beyond the seven states covered by DEF CON Franklin’s earlier volunteer effort.

The release places special attention on civilian utilities that support military and intelligence assets. Cyber Maryland Board Chair Roger Austin linked resilient water infrastructure to Maryland’s national security missions, although the announcement does not name the relevant facilities or water systems.

A utility’s location alone does not describe its cyber exposure. Water Watch Center’s service model will need to account for each participating system’s network design, operational processes, existing suppliers, and incident-response authority. The announcement offers no deployment architecture for those connections.

NRWA will operate as the national information hub. That role puts the association at the centre of the programme’s proposed threat-information flow between service providers and rural water systems.

Digital twins will test automated defences

Vanderbilt University will work with the Water Watch Center on research drawn from the DARPA Cyber Agents for Security Testing and Learning Environment programme, known as CASTLE. The partnership plans to create digital twins for a select number of water and wastewater environments.

Researchers will deploy red-team and blue-team agents within those simulated environments. The stated aim involves testing automated defensive approaches against cyberattacks, then refining them before seeking broader deployment of AI defensive tools across US water and wastewater systems.

Dr Daniel Balasubramanian, principal investigator for Vanderbilt’s CASTLE team, said digital twins can emulate complex environments and train AI-driven defensive agents to detect and neutralise attacks.

“By leveraging digital twins, we can safely emulate these complex environments and train AI-driven defensive agents to detect and neutralise attacks,” explains Balasubramanian. “Our ultimate goal is to translate this rigorous testing into robust, real-world protections for water systems across the nation.”

The release does not identify the systems selected for digital twin work. It also does not describe the source data, model validation process, automated-agent permissions, or safety controls that would govern a later deployment into an operating utility.

What utility leaders should establish before enrolment

The Water Watch Center offers a route for smaller water utilities to obtain managed detection and response support without building a full in-house security operation. Its announced design combines provider services, cross-provider threat exchange, NRWA coordination, volunteer support, and research into automated defences.

Participation still requires local decisions. Utility leaders should establish the boundaries for provider access to business networks and water operations, then document who receives alerts and who authorises containment actions.

They should also ask how the dedicated collaboration mechanism handles utility data. The announcement does not state whether participating providers share raw telemetry, indicators of compromise, incident summaries, or another form of threat information with NRWA and each other.

Cost requires the same scrutiny. Craig Newmark provided seed investment for the initiative, and philanthropic and government organisations support its establishment, according to the release. No source details long-term funding, participant fees, or the point at which volunteer assistance gives way to contracted services.

Water Watch Center’s first operational test will come through its five managed detection and response providers serving water systems with fewer than 10,000 people.

See also: Manufacturing cybersecurity needs tested recovery plans

Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including IoT Tech Expo and the AI & Big Data Expo. Click here for more information.

IoT News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.