NRWA and DEF CON Franklin launch Water Watch Center
Five MDR providers will deliver managed threat detection to water utilities serving under 10,000 people, the 91% of U.S. systems with the least budget and the most exposure after Iran-linked attacks hit 12 states.
TL;DR
The National Rural Water Association and DEF CON Franklin launched the Water Watch Center, a threat intelligence and managed detection hub for the 91% of U.S. community water systems that serve under 10,000 people. Five MDR providers (Rapid7, Defendify, Legato Security, L1 Secure, and Sentinel Technologies) will deliver detection-and-response services through the NRWA hub. The launch comes days after Iranian-linked attacks on operational technology at water utilities expanded to at least 12 states. DEF CON Franklin's earlier volunteer model couldn't scale across 50,000 community systems; the WWC is the fix.
The volunteer model proved the concept but couldn't scale. That's the arc from DEF CON Franklin's pilot (450 volunteers paired with utilities in seven states) to the Water Watch Center announced Friday. The new program shifts from donated expertise to a hub-and-spoke architecture: the NRWA operates the center, and five MDR providers deliver detection and response to utilities that pay nothing or nearly nothing for the service.
The providers aren't cybersecurity generalists parachuting into an unfamiliar sector. "We hand-picked cyber providers who already support water utilities," DEF CON Franklin co-founder Jake Braun told The Record. "These folks walk in the door knowing the intricacies of cybersecurity in a water utility environment." That matters. Water OT environments are unlike enterprise IT, PLCs, SCADA, and aging field hardware don't respond to the same playbooks that work in a corporate SOC.
The timing is not subtle. Two days before the announcement, water utilities in South Dakota and Georgia joined the expanding list of Iranian-linked victims, now at 12 states. Two New Jersey towns disclosed attacks the same day as the launch. The WWC has already started work in Maryland, identifying rural utilities near military facilities.
None of this resolves the regulatory question that's hung over the sector for years. The NRWA has historically opposed federal cybersecurity mandates, arguing they'd force rate hikes on customers. The WWC operates in that gap, a voluntary model that provides actual detection capability without rulemaking. Whether voluntary coverage holds up against a state-sponsored campaign is the question the next six months will answer.
Published ·Deep Fathom