For water utilities running aging SCADA networks with small security teams and tight budgets, finding a vulnerability is the easy part; fixing it is where the system breaks down. The federal move to introduce Project Watershed 250 is not an accident of timing. It is an admission. Officials recognize that utilities now under attack, from Texas to Minnesota, will not close those gaps without outside help.
Launched in San Antonio on Aug. 31, 2026, the six-month pilot program focuses on assisting water utilities in discovering and correcting cybersecurity vulnerabilities in their organizational environments before cyber attackers exploit them. The program brings together the White House Office of the National Cyber Director (ONCD), Texas Cyber Command, the Texas Governor’s Office, and private sector partners, along with the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency, who join in as partners. Participating water utilities receive red-team assessments, AI tools, threat intelligence, training help, help fixing problems, and defensive tools for free. The message is implicit: the market has failed, and small and mid-sized utilities cannot afford to fix themselves.
The scale is considerable. Texas has more than 7,400 public water systems and 3,000 wastewater treatment facilities serving 31 million people. So is the urgency. The federal measure follows a July 30 alert from the FBI and EPA warning that utilities in at least seven states had been hit since July 27. Attackers went after internet-exposed Rockwell Automation/Allen-Bradley MicroLogix programmable logic controllers (PLCs). Some incidents disrupted water operations. Device passwords and IP addresses were changed, leaving operators unable to monitor and control equipment.
The pilot will almost certainly work. Utilities will participate; the tools will reveal true weaknesses, and some repairs will be made. The administration will claim success and move on to plan nationwide expansion. While finding vulnerabilities is only step one, fixing them takes specialist skills, network upgrades, replacement equipment, and money, something that, especially for smaller utilities, they rarely have access to.
Funding is the sticking point, and the pilot’s end date sharpens it. Texas Cyber Command’s vendor requirements make providers disclose service limits, expiry dates, and any costs after the pilot, and automatic conversion to paid services is barred. That brings transparency. It does not answer who pays for ongoing protection.
Federal money is flowing elsewhere. On Aug. 31, the EPA announced $11.75 million in grants for 10 midsize and large drinking water system projects covering cybersecurity and extreme weather resilience. The awards include SCADA modernization, but they went to larger systems, not the smaller utilities most exposed, and they do not create a lasting funding model.
Watershed 250 will be judged by more than the vulnerabilities it uncovers. The real test is how many utilities can afford to fix them. That will take longer-term federal and state support and governance that gives utilities the authority and resources to act. Without it, the gap between spotting critical risks and closing them stays wide.
Water utilities face critical vulnerability challenges
Industrial Cyber reached out to experts to examine what determines whether a water utility can address critical vulnerabilities identified by federal partners during a red-team assessment before the Project Watershed 250 pilot concludes.
“From a program process perspective, I don’t honestly know the process of how federal partners identify, prioritize and support the remediation of critical vulnerabilities,” Andrew Ohrt, resilience practice area lead at West Yost, told Industrial Cyber. “However, if historical patterns of cyber-risk management apply. Some improvements likely require new hardware. Current supply chains may not allow for procurement and installation of new hardware in that relatively short time frame. Improvements also need to be done very thoughtfully. We don’t want to disrupt the performance and reliability of the system.”
He added that these utility staff who are receiving this assistance also have day jobs that may involve other public works responsibilities such as mowing public green spaces, coordinating road repairs, and engaging with the public. “This initiative has to include sufficient education to close the current knowledge gap and utility staff are able to make sustainable cultural and management improvements within their organization and their external contractors.”
“Available internal and external staff to implement the changes, procurement challenges for products and services, scheduling availability of stakeholders, technical hurdles and project dependencies (e.g., in order to implement a particular cybersecurity control, some change to the existing architecture is required,” Gus Serino, president at I&C Secure Inc., told Industrial Cyber. “There is some impediment being availability of contractor, competing priorities, operation priorities, extended project schedule requirements, etc.”
He added that cybersecurity improvements won’t survive as a point-in-time task. “Improvements need to be sustained for the life of the utility. This means a full program built out to manage and maintain a cybersecurity program, including staff allocation, budget, and policies.”
Ben Burke, president at Dispel, said that addressing vulnerabilities boils down to prioritization against a defensible architecture. “Automatically generated reports often list vulnerabilities in terms of CVE score, without regard for whether that particular risk is easy to exploit.”
He added that the goal of the pilot should be to establish a defensible baseline that addresses as many structural vulnerabilities as possible, and effectively mitigates several others. “From there, an adjusted vulnerability list can be prioritized and, if possible, addressed before the pilot ends. Prioritization should follow operational workflows – where operators are actively engaging with or creating risk – not based upon a raw CVE score.”
Funding gaps hinder utility cybersecurity improvements
The executives address the challenges utilities face in securing funding for remediation, particularly when technical requirements are clear, but the necessary investments fall outside existing capital budgets.
Ohrt identified that operating costs for water utilities, just like every organization and family in the U.S., have increased at unprecedented rates in the last seven years. “Just funding the non-negotiable costs, such as chemical supplies, has put significant strain on utilities. I have observed utilities overestimating the escalation of these required costs, which then creates some space for discretionary funding of other initiatives, which has been positive.”
“For utilities that are able to increase rates to accommodate new initiatives, they can secure funding as needed. However, escalating prices for hardware, software, and professional services are escalating,” according to Ohrt. “Several years ago, a friend asked me what to do to get started on securing his OT system. One of the things that I suggested to him was to create a line item in his budget for next year and every year afterward for cybersecurity investment and maintenance. He did, and it paid off for his utility. Every utility should be doing this. Our planning horizons are longer than private industry, but we can make space for tomorrow’s investments, today.”
“The Federal government’s primary recommendation is to support state and local funding for assessments and remediation, but this funding is subject to annual appropriations, which remains a challenge for the U.S. Congress. SRF supports two different efforts as far as funding goes: grants for non-construction work for diagnosis, planning, and training; and loans for physical and technical remediation,” Alycia Farrell, senior advisor at the Roosevelt Group, told Industrial Cyber. “EPA has stated that the latter part of this loan fund can be used to install cybersecurity measures. This funding mechanism takes the form of a low-interest loan that utilities must repay.”
Another challenge she noted with using SRFs is the 20% funding match required of the State. “This can be onerous for small, disadvantaged rural water utilities because of affordability. Finally, federal requirements attached to SRF money (like Buy America sourcing rules) add additional steps that can slow small IT and operational-technology purchases.”
Serino observed that cybersecurity regulations on many utilities are non-existent in most places and just emerging in some. “The regulations drive the ability to build cybersecurity costs into the operating budget. Without being budgeted, utilities are dependent upon grants which are increasing but sometimes challenging to get, don’t apply, require matching funds.”
“Hidden within the defensible architecture are the questions: ‘ How difficult is that architecture to implement? Can it be delivered atop legacy realities without an expensive overhaul?,” Burke asked.
He added that this pilot needs to establish a ‘give-and-take’ between utilities and the selected cybersecurity vendors. “What capabilities are non-negotiable, and how can the vendor community deliver that at a feasible price point + deployment complexity, recognizing the effective scale of the utility community? If utilities can deliver a clear plan, minimized cost, and point to the pilot for efficacy, then budgets can be established. This will require state and federal support, as price minimization is only possible at large deployment scales.”
Watershed 250: Free for Six Months—Then What?
The executives assess how Watershed 250 gives participating utilities tools and federal support at no cost for six months, what happens to remediation efforts once that support ends, and what funding options could sustain the work.
“I think an appropriate analogy is grant programs that fund physical infrastructure improvements through covered capital costs, but not operational costs. Historically, there have been many of these funding mechanisms, whether federal, state, or even through legal settlements,” Ohrt recognized. “They often result in wonderful new infrastructure but lack lifecycle planning and so the operations and maintenance costs are neglected. Over time, this has been one factor that has led to the relatively poor condition of the United States’ physical infrastructure as reported by the American Society of Civil Engineers.”
He added, “Unfortunately, I expect that the remediation efforts will likely end when the program does for most of the utilities. Certainly, they and the security of their organizations will benefit, but without a sustainable funding mechanism and/or set of regulatory requirements, new improvements are unlikely to be made after the program ends.”
“When the pilot ends, the donated services and tools become paid subscriptions or go away if there is no payment,” Farrell said. “This creates a funding problem that the capital programs don’t solve. Monitoring, threat intelligence (outside of MS-ISAC-provided services, which also have been severely degraded due to DOGE efforts), and managed detection are recurring operating costs, while most federal water money is built for one-time capital projects. Other challenges for additional funding, though they have seen limitations lately, include the SLCGP (State and Local Cybersecurity Grant Program).”
She added that Congress needs to reauthorize and fund this program, which may be more likely given the election results earlier this month. “Pending legislation could add additional options. Other options that may be viable for continuing these efforts include EPA’s Water Sector Cybersecurity Evaluation Program (no-cost assessments by EPA-approved evaluators), but these don’t pay for remediation; SRF financing for capital remediation, but subject to the timing and loan-repayment limits; resilience grants, but these are for systems serving 10,000 or more people only; and emergency assistance, which only supports after an incident (and is also expiring). The Safe Drinking Water Act (SDWA) emergency assistance authorization was $35M a year from FY2022 – FY2026, and lapses after this fiscal year.”
“6 months is just getting a project like this started. There is a scarcity of OT capable security professionals to do implementation. Many projects will barely be off the ground in 6 months,” Serino evaluated. “Security tools have licenses and other ongoing fees that need to be funded year after year. Security technology and controls require maintenance and ongoing support. After changes are made to critical industrial operations and inevitable failures occur, the security controls will be on the table for consideration of root cause.”
He pointed out that security practitioners will need to be present to work with internal and external parties to troubleshoot and restore services. All this takes time, requires expertise, and costs money.
“This needs to be a priority at the municipal, state, and federal level. The pilot should establish clear sustainment costs and should identify linked funding options across those layers of programming,” according to Burke. “Without proper sustainment, the project will simply cease after the program closes.”
Utilities confront barriers to OT security remediation
The executives explore what typically stands in the way when utilities have identified critical vulnerabilities but cannot secure approval to fix them, and whether the obstacle is mainly funding, decision-making authority, competing priorities or something else.
Ohrt said to some extent, it is all of those things, “but I like to focus on decision-making authority because I have personally observed that at many utilities. It is common, even for larger utilities, to do great things with the technology to secure their systems, but to lack the governance to make changes and quickly adapt to an evolving threat environment.”
“I have personally observed utilities identify serious vulnerabilities within their system, but lack a process that allows them to cooperatively work with internal staff and contractors to characterize the risk to the system because of the vulnerabilities, describe compensating controls to enable a risk-based decision process, and elevate the risk-based discussion to the leadership team for consideration,” he detailed. “I believe that when the leadership team is presented with the opportunity to manage the risk proactively, they will. Many of these teams are continuously making risk-based decisions on behalf of their organization.”
Fundamentally, Ohrt added that this is a governance issue. “In these cases, the technology is present to identify the vulnerability, staff is acknowledging it, but the decision-making process isn’t in place to support timely remediation.”
“It can be a lack of funding. It can also be a lack of trust for the firms who will inevitably alter the operation of systems that have legacy technology that is required to be continuously operational,” Serino said. “Decision-making authority can also weigh in because of a lack of awareness that the threat is real. It can also be that with limited staff and competing priorities from regulations, other important efforts, etc.”
“Simply put, Friction,” Burke said. “There is the friction between security and operating teams – does that remediation require downtime? How significant is that downtime? Then there is the friction between security and governance/compliance teams – How are you able to inspect what you expect? And finally, the friction between operating and governance/compliance teams – How long does standing up the proper process take? Does it get in the way of getting your job done, when every minute matters?”
He added that remediation, or mitigation where appropriate, is rarely about funding. “It is the friction between teams that slows down decision-making until inaction makes more sense than action, leaving the system ultimately vulnerable.”
Reforming water sector cyber funding and governance
The executives consider whether changes to funding and governance of water utilities would help close the gap between identifying security risks and addressing them, particularly for smaller utilities with limited resources.
“Most small utilities rely on local or regional integrators to support the reliability and performance of their systems,” Ohrt identified. “These integrators need to build cybersecurity into their services so that while they are focused on the reliability and performance of these systems, cybersecurity is also prioritized.”
At the same time, he added that water utilities need to require integrators and fund these improvements. For many utilities who are stuck with a low-bid approach to procurement, cybersecurity is something that they.
“Both the integrators and utilities need to value cybersecurity as much as they value performance, reliability, and safety of their systems,” Ohrt said. “As our adversaries become more aggressive and willing to compromise critical infrastructure in the U.S. to seek physical consequences, cybersecurity is key to maintaining performance, reliability, and safety of our water systems.”
Providing just a few suggestions to start, though the reach can be significant, Farrell said that there are cyber authorities that lack funding: this is common throughout the Federal Government, so this isn’t unusual, but in these instances, there is an actual appropriation for authorities such as SDWA’s Section 1433 (g) and SDWA Section 1459G.
She added, “SDWA Section 1433(g), which reaches small systems, expired in 2021 without ever receiving funds. SDWA Section 1459G (technology grant) expired in 2026, also without ever receiving money. The only funded program (Section 1459F) supports only systems that serve 10,000 people or more. If Congress were to reauthorize these critical sections, they would also need to fund them going forward to help address these shortfalls in State and Local water utility cybersecurity.”
“A State can look to combine small systems in their region into one project and advocate for their remediation all at once rather than competing against each other. This can also help with any cost-sharing,” according to Farrell. “Use loan forgiveness for disadvantaged small systems, turning ‘loans’ into grants.”
Serino said primacy agencies will need to adopt reasonable, doable, risk-based cybersecurity requirements that produce the required outcome while leaving enough room for agencies to install solutions that meet the goal without overly prescriptive requirements.
“Out of the gate, regulations cannot solve every vulnerability. We need to allow for the utilities to address the basics before they make follow-on changes,” he added. “Also, cybersecurity improvement can be costly, and the full cost should not be put on the rate payers; there should be supplemental sustained funding and support from the state and federal government for some time period.”
Pointing out that this needs to be addressed on two levels, Burke said that first, grant resources need to be made available for ongoing sustainment. These programs are not build-and-forget; they are evolving efforts that require annual reinvestment. Grant funding should not be a one-time grant, but a five-year grant with annual installments. “This shifts from a CapEx to OpEx construct, but securing water systems requires recurring effort, not a one-time fix.”
“Second, governance needs to respect realities on the ground. Governance should grow to accept mitigation-on-the-path-to-remediation plans,” he added. “Can you solve the problem immediately? Not always. Can you adapt to effectively minimize risk, buying you time to address the root cause systematically? Almost always.”
The post Project Watershed 250 puts water utility cybersecurity under scrutiny, though long-term funding remains unresolved appeared first on Industrial Cyber.
