The U.S. administration is launching Project Watershed 250, a six-month pilot in Texas designed to identify and address cybersecurity vulnerabilities in water systems before adversaries can exploit them. The initiative brings together federal agencies, Texas Cyber Command, local governments and cybersecurity companies to test existing utility defenses and strengthen vulnerable systems using cybersecurity and AI (artificial intelligence) tools. The program will use red-team exercises to stress-test utility networks and identify weaknesses that hackers could exploit, with the administration planning to assess whether the approach can eventually be expanded nationwide.
The push comes as the federal administration races to build out U.S. data centers to fuel the AI boom, putting more attention on the water and power needed to keep them running.
The Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency will serve as federal partners, while Texas Cyber Command will work with companies including Microsoft, Reflection AI, Palo Alto Networks and Dragos. The pilot program builds on President Donald Trump’s June executive order on Promoting Advanced Artificial Intelligence Innovation and Security and his Cyber Strategy for America released in March.
The White House said the program is not a response to recent cyberattacks affecting more than 30 Minnesota water systems, although those incidents have underscored vulnerabilities in local infrastructure. The initiative, which will provide participating utilities with federal, state and private-sector cyber defenses at no cost, builds on the administration’s June executive order on artificial intelligence innovation and security and its March Cyber Strategy for America.
“Project Watershed 250 is another example of President Trump putting American families and communities first. President Trump is relentless in his work to secure our critical infrastructure against our most determined adversaries,” Sean Cairncross, National Cyber Director, told Fox News Digital. “President Trump has cemented America’s leadership in AI security and innovation and is now bringing those exquisite tools to local communities and utilities in Texas and ultimately, across the nation through the launch of Project Watershed 250 – a scalable cyber water pilot program.”
“Microsoft applauds the administration’s leadership in strengthening the cybersecurity of America’s water infrastructure and is proud to support the Project Watershed 250 effort in partnership with the Office of the National Cyber Director, the State of Texas, and Texas Cyber Command,” said Microsoft US Public Sector president Chris Barry. “By bringing together Microsoft’s cybersecurity expertise, threat intelligence, and AI-powered security capabilities, we aim to help water utilities strengthen their resilience against evolving cyber threats and develop scalable approaches that can enhance the security of water systems nationwide.”
Dragos CEO Robert Lee said U.S. water infrastructure faces active, documented threats, particularly among smaller utilities that often lack strong cybersecurity defenses. He added that Watershed 250 will help get technology, training and support to those vulnerable systems before an attack occurs.
“We’re not going to turn every water utility in America into a Fortune 500 security organization. But resource-constrained cannot mean defenseless,” Alison King, vice president of government affairs at Forescout, wrote in an emailed statement. “Project Watershed 250 is about giving operators capabilities that have traditionally been out of reach: the ability to see what’s connected, understand where the real risk is, and take action before a cyber incident becomes a physical consequence. We’re going to prove that model here in Texas and create a blueprint for protecting water systems and other critical infrastructure across America.”
Chris Day, Tenable Public Sector chief technology officer, joined Cairncross, Texas Governor Greg Abbott, Texas Cyber Command Chief Timothy James ‘TJ’ White and private sector cybersecurity leaders at the Project Watershed event at the Texas Cyber Command Headquarters in San Antonio.
Though the effort comes at a critical time for the water sector, following a series of cyberattacks affecting water and wastewater systems across multiple states, a White House official said Project Watershed 250 is not in response to recent cyberattacks that targeted more than 30 Minnesota water systems, though the incidents underscored vulnerabilities in local infrastructure. These incidents demonstrate how cyber risk can translate into operational consequences for the essential services communities depend on every day.
Water utilities face distinct challenges in managing this risk. Systems vary widely in size, resources and cybersecurity maturity, while many operators must secure increasingly interconnected IT and OT environments. Greater visibility across these environments can help participating utilities identify their most consequential exposures and focus limited resources on risks that could have the greatest impact on critical operations.
“Protecting the water systems Americans rely on every day is a shared responsibility,” said Tenable’s Day. “We applaud the administration and Texas leaders for taking action and bringing the right expertise to the table. Tenable is proud to support this effort and help water operators get ahead of cyber risk and manage exposures before they lead to disruption.”
Just last week, CISA published an advisory based on red team assessments at two critical infrastructure organizations to help improve detection, response, and protections across IT, cloud, and OT environments. The assessments simulated real-world cyber attacks to evaluate organizations’ ability to detect and respond to threats. The first organization failed to detect the red team after initial access and lateral movement across systems, while the second organization successfully detected and quarantined the red team’s initial access, forcing a shift in tactics.
