Project Watershed 250 pilot tests water utility cyber defenses, but post-pilot remediation funding stays unresolved
Project Watershed 250 is a six-month, no-cost pilot launched on Aug. 31, 2026 in San Antonio by the White House Office of the National Cyber Director, Texas Cyber Command and the Texas Governor's Office, with EPA and CISA as partners. It offers water utilities red-team assessments, AI tools, threat intelligence, training and remediation help (txcc.texas.gov describes it as a no-cost pilot that uses Texas as its testing ground). The pilot follows a July 30 FBI and EPA alert on attacks against internet-exposed Rockwell Automation/Allen-Bradley MicroLogix PLCs that hit utilities in at least seven states from July 27, with some incidents disrupting water operations. The article's core argument is that finding vulnerabilities is the easy part, while funding, specialist staff, procurement and governance decide whether fixes happen. The experts it consults warn that donated services become paid subscriptions or lapse when the pilot ends, and that the EPA's $11.75 million in grants mainly went to larger systems. The article reports no new CVE and no vendor patch, so the criticity is medium: the PLC attacks are active, but the piece itself is analysis of funding and governance.
Detalhes técnicos
According to the article, attackers targeted internet-exposed Rockwell Automation/Allen-Bradley MicroLogix programmable logic controllers, changed device passwords and IP addresses, and left operators unable to monitor and control equipment. The article does not describe the initial access method or name a CVE for these incidents.
Remediação
The experts quoted in the article recommend budgeting cybersecurity as a recurring operating cost, requiring integrators to build security into their services, and funding multi-year sustainment rather than one-time grants. They also suggest that states group small systems into joint projects, use loan forgiveness for disadvantaged small systems, and accept mitigation while the root-cause fix is pending. The article does not describe a vendor fix for the MicroLogix campaign.
Linha do tempo
-
Project Watershed 250 pilot tests water utility cyber defenses, but post-pilot remediation funding stays unresolved
ler a análise desta fonte ocultar
Project Watershed 250 is a six-month, no-cost pilot launched on Aug. 31, 2026 in San Antonio by the White House Office of the National Cyber Director, Texas Cyber Command and the Texas Governor's Office, with EPA and CISA as partners. It offers water utilities red-team assessments, AI tools, threat intelligence, training and remediation help (txcc.texas.gov describes it as a no-cost pilot that uses Texas as its testing ground). The pilot follows a July 30 FBI and EPA alert on attacks against internet-exposed Rockwell Automation/Allen-Bradley MicroLogix PLCs that hit utilities in at least seven states from July 27, with some incidents disrupting water operations. The article's core argument is that finding vulnerabilities is the easy part, while funding, specialist staff, procurement and governance decide whether fixes happen. The experts it consults warn that donated services become paid subscriptions or lapse when the pilot ends, and that the EPA's $11.75 million in grants mainly went to larger systems. The article reports no new CVE and no vendor patch, so the criticity is medium: the PLC attacks are active, but the piece itself is analysis of funding and governance.
Technical Details
According to the article, attackers targeted internet-exposed Rockwell Automation/Allen-Bradley MicroLogix programmable logic controllers, changed device passwords and IP addresses, and left operators unable to monitor and control equipment. The article does not describe the initial access method or name a CVE for these incidents.
Remediation
The experts quoted in the article recommend budgeting cybersecurity as a recurring operating cost, requiring integrators to build security into their services, and funding multi-year sustainment rather than one-time grants. They also suggest that states group small systems into joint projects, use loan forgiveness for disadvantaged small systems, and accept mitigation while the root-cause fix is pending. The article does not describe a vendor fix for the MicroLogix campaign.