**Water Utilities Get a New Cybersecurity Shield: DEF CON Franklin and NRWA Launch the Water Watch Center**
In a significant move to bolster national infrastructure resilience, DEF CON Franklin and the National Rural Water Association (NRWA) have announced the establishment of the **Water Watch Center**. This initiative, unveiled during the recent DEF CON conference in Las Vegas, is designed to deliver managed cybersecurity defence services directly to US water utilities, with a particular focus on protecting small and rural water systems. The announcement responds to growing concerns over widespread nation-state cyberattacks targeting critical water infrastructure.
### A Managed Security Model for Rural Water Systems
At the core of the Water Watch Center is a managed detection and response (MDR) model aimed at bridging the cybersecurity resource gap for utilities that lack dedicated internal security teams. The programme specifically targets the vast segment of the US water sector composed of small, rural systems—those serving fewer than 10,000 people, which represent 91 percent of the approximately 50,000 community water systems nationwide.
An initial cohort of five managed detection and response providers will deliver these services. The group includes Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies. These providers will share threat intelligence through a dedicated collaboration mechanism, with NRWA acting as the national information hub. Defendify and Legato Security are part of the initial provider lineup, while L1 Secure, Rapid7, and Sentinel Technologies have also joined the effort.
Jake Braun, co-founder of DEF CON Franklin and former White House acting Principal Deputy National Cyber Director, explained that the selected providers already have experience working with water utilities. He noted that DEF CON Franklin volunteers would help reduce costs for financially constrained utilities, describing the model as a scalable solution that has long eluded water industry and national security officials.
### Two Years of Volunteer Insights Shape the Programme
DEF CON Franklin spent two years recruiting nearly 450 volunteer cybersecurity experts and matching them with water and wastewater utilities in states such as Arizona, Indiana, Oregon, Utah, Vermont, Washington, and Wyoming. These engagements reportedly strengthened individual utilities’ defences, though specific security metrics, incident reductions, or detailed control deployments were not disclosed.
Jeff Moss, founder of DEF CON, highlighted that many hypotheses tested during these volunteer efforts did not succeed, underscoring the complexity of securing under-resourced utilities. This candid admission, however, offers valuable insight for future participants: while a centralised service model can reduce the need for each small utility to independently source cybersecurity expertise, local decisions regarding access boundaries, alert handling, and incident containment authority remain essential.
### Adding a National Security Dimension
The Water Watch Center is also expanding its reach through a partnership with Cyber Maryland. This collaboration aims to identify and engage rural utilities across Maryland, extending beyond the seven states previously covered by DEF CON Franklin’s volunteer efforts. Special attention is being given to utilities that support military and intelligence assets, linking resilient water infrastructure to broader national security objectives.
### Using Digital Twins to Test AI-Driven Defenses
Vanderbilt University is contributing research expertise through a partnership with the Water Watch Center, drawing on the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) programme. The initiative plans to develop digital twins—simulated water and wastewater environments—to test automated defensive approaches against cyber threats. Researchers will deploy red-team and blue-team agents within these simulations to refine AI-driven defensive tools before broader real-world deployment.
Dr Daniel Balasubramanian, principal investigator for Vanderbilt’s CASTLE team, noted that digital twins enable safe emulation of complex environments to train AI-driven defensive agents. However, the announcement did not specify which systems would be used for digital twin testing, nor the source data, validation processes, or safety controls guiding future deployments.
### What Utility Leaders Need to Know Before Enrolling
While the Water Watch Center offers a practical route for smaller utilities to access managed cybersecurity support, participation requires careful local planning. Utility leaders will need to:
– Define clear boundaries for provider access to business networks and operational technology environments.
– Establish who receives alerts and who holds authority to approve containment actions.
– Clarify how the dedicated collaboration mechanism handles data, including whether raw telemetry, indicators of compromise, or incident summaries are shared among providers and NRWA.
– Understand long-term costs, as the model currently benefits from seed investment, philanthropic support, and government funding, but future participant fees and funding structures remain unspecified.
### FAQ
**What is the Water Watch Center?**
The Water Watch Center is a joint initiative by DEF CON Franklin and the National Rural Water Association (NRWA) that provides managed cybersecurity detection and response services to US water utilities, especially small and rural systems.
**Why was the Water Watch Center created?**
It was created in response to increasing cybersecurity risks faced by water systems, including potentially widespread nation-state attacks, to give rural utilities access to expert cybersecurity support they could not otherwise afford.
**Which utilities does the programme target?**
The programme targets community water systems serving fewer than 10,000 people, which make up 91 percent of the roughly 50,000 such systems in the United States.
**Which cybersecurity providers are involved?**
The initial providers are Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies.
**How will threat information be shared?**
Providers will exchange threat intelligence through a dedicated collaboration mechanism, with NRWA serving as the national information hub. Specific technical and operational details, such as alert routing and data formats, have not been disclosed.
**What role does Cyber Maryland play?**
Cyber Maryland is partnering with the Water Watch Center to identify and engage rural utilities in Maryland, expanding the initiative’s reach and linking water infrastructure resilience to national security missions.
**What are digital twins in this context?**
Digital twins are simulated water and wastewater environments that will be used to test and refine automated cybersecurity defenses using red-team and blue-team exercises before deploying AI tools in real-world systems.
**What should utility leaders do before enrolling?**
Utility leaders should define access boundaries for providers, document alert reception and incident containment authority, clarify data-sharing practices, and evaluate long-term costs and funding arrangements.
### Conclusion
The launch of the Water Watch Center represents a landmark step in addressing cybersecurity vulnerabilities within the US water sector. By pooling managed security services, volunteer expertise, and emerging technologies such as digital twins, the initiative offers a scalable model for protecting critical water infrastructure. While important operational and financial details remain to be clarified, the programme provides a timely and practical response to a rapidly evolving threat landscape. As more utilities evaluate enrolment, the decisions made today will shape the resilience of water systems for years to come.
