Three major technology organizations have joined forces to establish the Community Cyber Resilience Foundation, committing $10 million collectively to shore up cybersecurity at smaller utilities across the United States. Accenture, Dragos and the SANS Institute announced the initiative on Tuesday, targeting up to 500 eligible utilities with free software, hardware, deployment services and staff training.
The program extends to any U.S.-based water, wastewater, electric and natural gas utility operating with annual revenues below $100 million—a threshold that encompasses roughly 97% of all utilities in the country.
Dragos will supply cybersecurity tools designed to identify devices connected to operational networks and pinpoint ways to remediate vulnerabilities. Accenture takes responsibility for tool deployment, configuration and ongoing operational support as utilities integrate these systems. The SANS Institute will deliver training programmes to strengthen the technical capabilities of utility staff.
Programme participants gain access to a peer network where they can exchange operational best practices and lessons learned. The initiative operates without federal or state government involvement, though Elastic will contribute technical support to help scale the effort. Dragos has indicated that additional companies are already signalling interest in joining the foundation to expand its reach.
The announcement arrives amid escalating threats to critical infrastructure. More than 100 water utilities have suffered breaches, while government warnings continue to highlight coordinated cyberattacks from Chinese and Russian actors targeting energy systems, telecommunications networks and related sectors. Dragos CEO Robert Lee stated that cybercriminals and nation-states are "aggressively targeting utilities, attacking the operational environments that provide life-sustaining services to millions of Americans."
Lee added that the foundation "gives the utilities that need it most access to cybersecurity resources and training at no cost."
James Lyne, CEO of the SANS Institute, emphasised the human dimension of security: "The best security technology in the world won't protect a utility if its staff are not able to use it. The foundation puts training and skills in the hands of the people protecting the water, power, natural gas, and wastewater treatment systems that communities rely on."
For years, cybersecurity experts have highlighted that the majority of U.S. utilities lack the financial resources, personnel and technical infrastructure to deploy adequate defences against ransomware operations, state-sponsored intrusions and other malicious actors. This resource gap leaves thousands of pumps, valves, substations and distribution networks exposed to compromise.
The foundation's initial phase will enrol 500 utilities, with potential expansion contingent on programme performance. Participation carries no time restrictions. Following water utility attacks in July, the National Rural Water Association launched a separate initiative involving five managed detection and response providers—Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies—who committed to sharing threat intelligence and vulnerability patch data.
Federal efforts to strengthen utility cybersecurity have stalled, prompting individual states to develop their own protective frameworks for water systems, electrical grids, telecommunications infrastructure and other critical assets.
