Volunteer hackers at DEF CON announced a new initiative Friday that will provide no-cost managed detection and response services to small water systems serving fewer than 10,000 people across the United States. The Water Watch Center, launched jointly by DEF CON Franklin and the National Rural Water Association, will initially fund five security providers—Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies—to help detect and stop breaches at tiny utilities that lack dedicated cybersecurity staff. The program aims to protect roughly 150,000 water facilities nationwide, 98 percent of which operate as small businesses.

The new center will function as a three-tier structure with the National Rural Water Association coordinating from the top, managed security providers deploying sensors to hunt for vulnerabilities across utility networks in the middle, and Franklin volunteers responding to alerts and fixing problems at the base. The initiative plans to expand from five to ten security providers eventually, aligning with the ten regions designated by the Cybersecurity and Infrastructure Security Agency. Some 350 people signed up in 2024 to donate their expertise to securing water facilities when the Franklin project launched at DEF CON two years ago. Recent weeks saw suspected Iranian hackers target numerous water systems—most of them small, community operations that left programmable logic controllers exposed online with default or weak passwords.

Co-founder Jake Braun explained that two years of fieldwork revealed a fundamental gap in protecting the nation's water infrastructure. "There's just not a scalable delivery mechanism for cyber for these utilities when there's 150,000 of them, and 98 percent of them are small businesses," Braun said. He added that the program will "take the alerts that CISA and the ISAC put out, and deliver cybersecurity," filling what he called "the missing piece" in national-scale protection. The report notes there's currently a 500,000-person shortage of cybersecurity professionals, making the idea of finding 150,000 new staff for these utilities unrealistic.

The Water Watch Center also partnered with Vanderbilt University to deploy artificial intelligence defenses drawn from DARPA's Cyber Agents for Security Testing and Learning Environment program. Researchers will build digital twins of several water and wastewater systems, then pit red-team attack agents against blue-team defenders in repeated simulations to determine which defensive strategies succeed. The goal is eventually rolling out AI-based protection to facilities across the country as both cyber and national security experts told The Register it's only a matter of time before attackers themselves use AI to plan and execute disruptions against critical infrastructure. Braun described the approach as letting AI agents "fight each other a gazillion times" to train defenders that can later be deployed to the 150,000 water utilities, arguing there's no other realistic way to counter coming AI-powered attacks. The scarcity of cybersecurity talent combined with the fragmented nature of America's water systems creates a structural vulnerability that traditional hiring simply can't address, forcing a shift toward automation and volunteer networks to close gaps before adversaries exploit them at scale.