DEF CON Franklin and NRWA Launch Water Watch Center to Shield Rural Utilities

DEF CON Franklin and the National Rural Water Association (NRWA) have launched the Water Watch Center to scale cybersecurity defenses for small U.S. water utilities. The initiative creates a structured delivery mechanism to protect critical infrastructure that has historically lacked the resources to defend against sophisticated state-sponsored threats.

The program integrates five managed detection and response (MDR) providers—Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies—to provide continuous network monitoring. While these professional firms handle detection, volunteer hackers from the DEF CON community provide hands-on remediation. The center specifically targets small water utilities serving fewer than 10,000 people, a critical demographic given that 91% of the 50,000 community water systems in the U.S. fall into this category, out of 150,000 total water and wastewater utilities nationwide.

The Vulnerability Gap

The expansion of the Franklin project, which was co-founded roughly two years ago to connect volunteer experts with high-risk communities, comes amid a surge of attacks on rural water systems. These utilities have become prime targets for adversaries, including suspected Iranian hackers who have targeted programmable logic controllers (PLCs) exposed to the internet via weak passwords.

For many of these small-town utilities, the barrier to security is not just financial, but human. Jake Braun, co-founder of the Franklin project, noted that the industry faces a global shortage of 500,000 cybersecurity professionals. "The idea that we're magically going to find 150,000 new people is a fantasy," Braun said, adding that the project's previous two years of volunteer efforts revealed a lack of a scalable delivery mechanism for these utilities.

AI and Digital Twins

To bridge the staffing gap, the Water Watch Center is partnering with Vanderbilt University to implement research from DARPA’s CASTLE program. This collaboration focuses on creating "digital twins"—virtual replicas of physical water systems—which allow for AI-based red-team and blue-team training. By simulating attacks in a virtual environment, the project aims to develop automated AI defenses that can be deployed to real-world systems before AI-powered attacks become commonplace.

The Path Forward

By combining the oversight of managed security service providers (MSSPs) with the agility of volunteer labor and the foresight of AI simulation, the Water Watch Center attempts to create a national blueprint for critical infrastructure protection. The project now seeks to prove that this hybrid model can scale across the thousands of under-protected rural systems that maintain the nation's basic water security. Observers will be watching to see if the integration of AI digital twins can effectively preempt threats in an environment where traditional manual security is no longer viable.