Water Utilities Partner With DEF CON Offshoot for Cyber Help

Executive Summary

The National Rural Water Association (NRWA) on Friday launched the Water Watch Center (WWC), a partnership with DEF CON Franklin that pairs five managed detection and response (MDR) providers with small U.S. water utilities to deliver threat intelligence and cybersecurity services. The program targets the more than 50,000 community water systems that serve fewer than 10,000 people — 91% of all community systems — many of which lack the budget and staff to defend against a rising wave of attacks on operational technology.

Technical Analysis

The WWC will see Rapid7, Defendify, Legato Security, L1 Secure, and Sentinel Technologies share threat information and vulnerability patch data with the NRWA, which will operate as a central hub. The providers were selected because they already support water utilities, according to Jake Braun, co-founder of DEF CON Franklin and former cyber official in the Biden administration. "These folks walk in the door knowing the intricacies of cybersecurity in a water utility environment," Braun said.

The program emerged as water utilities in at least 12 states — including Minnesota, Michigan, Georgia, and South Dakota — reported cyberattacks on their operational technology, part of a campaign allegedly linked to Iranian hackers. On Friday, two New Jersey towns also came forward as victims. The WWC has already begun work in Maryland to identify rural utilities in need, particularly those supporting military facilities.

DEF CON Franklin, which grew out of the annual security conference, had previously recruited 450 volunteer cyber experts to work with utilities in Arizona, Indiana, Oregon, Utah, Vermont, Washington, and Wyoming. That effort proved the demand but exposed the difficulty of scaling services to the country's 150,000 water and wastewater utilities — a number that includes 100,000 public water systems serving schools, factories, office buildings, and hospitals, plus thousands of systems at gas stations and campgrounds.

The WWC is also collaborating with Vanderbilt University and the U.S. military to build digital replicas of water and wastewater environments, allowing experts to test and refine automated defensive approaches.

Mitigations & Recommendations

Defenders at small water utilities should monitor NRWA communications for threat intelligence and patch data distributed through the WWC hub. Given the active campaign targeting OT systems, utilities should prioritize network segmentation between IT and OT, enforce multi-factor authentication on remote access points, and review logs for anomalous connections to SCADA devices. For utilities that cannot yet join the WWC, engaging a third-party MDR provider with water-sector experience is a practical interim step.