"We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses," Jake Braun told The Register during an interview at DEF CON.
The Water Watch Center: structure, mission, and scope
At DEF CON Franklin on Friday, the hacker-run initiative and the National Rural Water Association (NRWA) announced the Water Watch Center (WWC), a program designed to deliver managed cybersecurity to small water and wastewater utilities. The WWC will initially fund five managed detection and response (MDR) providers to help utilities that serve fewer than 10,000 people detect and mitigate breaches. The NRWA will sit at the top of the program’s operational pyramid, receiving shared threat information and providing technical assistance and operational support to small utilities across all 50 states.
Five initial MSSPs — and a plan to map the regions
The first five providers contracted through the Water Watch Center are Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies. Those firms' sensors will hunt for vulnerabilities across participating utilities’ networks and exchange threat information with each other and the NRWA. Jake Braun described the arrangement as a pyramid: NRWA at the top, MDR providers in the middle doing continuous detection, and Franklin volunteers below who will help fix issues or respond to alerts as needed. Braun said the program will expand to 10 MSSPs eventually, "based on the 10 CISA regions."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDigital twins, DARPA CASTLE research, and Vanderbilt partnership
The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. That work will create digital twins for a few WWC water and wastewater system environments. Researchers will deploy both red-team and blue-team agents across those digital duplicates: red-team agents will attempt to hack the models while blue-team agents test automated detection and response. The stated eventual goal is to train AI-based defensive agents for later deployment across water and wastewater facilities nationwide.
Recent intrusions and the limits of manpower
The announcement comes amid reports that suspected Iranian hackers have hit numerous water systems in recent weeks. The source material says most of those victims were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. The reporting notes there is no indication the attackers used AI to plan or carry out those disruptions, but the consensus among experts cited at Black Hat and DEF CON is that AI-enabled attacks are only a matter of time. Braun framed the challenge starkly: "There's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things."
What this means for small water utilities, NRWA, and volunteer defenders
- Small water utilities: For systems serving fewer than 10,000 people, the WWC offers a delivery mechanism that combines MDR sensors, shared threat intelligence, and volunteer operational support — intended to move beyond one-off alerts toward active remediation and connection to managed services.
- NRWA and MSSPs: The NRWA will serve as the program hub in all 50 states, aggregating threat data from the initial five providers and coordinating expansion to additional MSSPs aligned with the 10 CISA regions.
- Franklin volunteers and researchers: Volunteers who have already worked "in the trenches" will be used to fix issues and follow-up on alerts, while the Vanderbilt/DARPA CASTLE work will test and iterate AI defenders inside digital twins before any real-world rollout.
The Water Watch Center is explicitly an attempt to build a scalable delivery mechanism for cybersecurity to a dispersed set of roughly 150,000 mostly small utilities — an initiative that pairs commercial MDR services with volunteer labor and academic research into AI-driven defenses. The announcement stitches together practical detection work, a plan to regionalize provider coverage, and an experimental pipeline for AI defenders trained inside digital twins. Whether that mix can be scaled to the full set of utilities, and whether AI-based blue teams will reliably outpace future AI-enabled attackers, are concrete operational questions the program is designed to confront.
