Federal officials gathered at the University of Texas at San Antonio's downtown campus on Sunday to unveil Project Watershed 250, a six-month pilot program designed to shield the nation's drinking water systems from an escalating wave of hacking attempts. The initiative brings together a roster of major cybersecurity firms in a single Texas test bed, offering water utilities free access to tools and expertise many of them could never afford on their own.
National Cyber Director Sean Cairncross announced the pilot, telling those gathered that the federal government had spent too long simply admiring the problem instead of acting on it, according to the San Antonio Express-News. Texas Governor Greg Abbott, who also spoke at the event, said China, Russia and Iran launch daily cyberattacks on critical infrastructure, including water treatment facilities, per the same report. The White House said Project Watershed 250 had been in development since 2025 and was not launched in response to a wave of cyberattacks in July, the newspaper's report notes.
That July surge was serious enough to draw a joint federal alert. Malicious cyber actors targeted internet-facing programmable logic controllers at water utilities across at least seven states, including more than 30 facilities in Minnesota, remotely changing IP addresses and passwords to lock operators out of critical system controls, according to a joint alert from the FBI and EPA. Abbott separately said an Iranian-backed cyberattack had hit more than 30 municipal water utilities across 12 states in July, per the Express-News account, a somewhat different tally than the federal alert's seven-state figure, though both describe the same broad wave of intrusions.
A Familiar Threat to Texas Systems
The threat is not new to Texas. State officials pointed to a January 2024 attack on the public water system in Muleshoe, Texas, which followed a December 2023 Iran-linked attack on Pennsylvania's Municipal Water Authority of Aliquippa, according to the Governor of Texas Press Office. Water systems make an inviting target for hackers precisely because so many are small operations running aging equipment with limited cybersecurity staff, the Express-News reported.
Those vulnerabilities are not isolated incidents but a nationwide pattern. Of the roughly 49,500 community water systems in the United States serving 324 million people, 81% are small utilities serving 3,300 or fewer residents, according to Congressional Research Service data. A separate CRS report found more than 70% of community water systems inspected by the EPA since September 2023 failed to comply with basic cybersecurity assessment standards required under Section 1433 of the Safe Drinking Water Act, which mandates risk and resilience assessments every five years for systems serving over 3,300 people.
Why San Antonio Was Chosen
Texas Cyber Command, based at UTSA's downtown San Pedro I campus, will coordinate the Watershed 250 effort within the state. The agency was created when Abbott signed House Bill 150 into law in June 2025, establishing it as a state entity administratively attached to UTSA to centralize public-sector cybersecurity operations, according to the Governor of Texas Press Office. Texas lawmakers committed about $135 million to launch the command through 2027, with the agency's total cost estimated at roughly $345 million over its first five years.
San Antonio has a major federal cybersecurity presence that made it a natural fit for the pilot. NSA Texas and the 16th Air Force have worked alongside government agencies, universities and private industry on cyber threats, and the city hosts the second-largest concentration of cybersecurity expertise in the country outside the Washington, D.C. metro area, according to a UT San Antonio announcement. Timothy “TJ” White said the initiative aims to move utilities from reacting to attacks toward finding weaknesses before hackers do, adding that the posture toward cyber threats had until now been largely reactive, per the Express-News.
Private Firms Step In With Free Tools
Project Watershed 250 includes Microsoft, Fortinet, Tenable, Zscaler, Dragos, Palo Alto Networks and Forescout, according to the seed reporting. Those participating companies will provide AI tools and technical support, helping utilities find weak spots, test defenses, detect suspicious activity and respond to attacks. Engineering firm Parsons Corporation also joined the pilot, offering red teaming, vulnerability assessments and AI-enabled cyber defense tools while drawing on its existing support for more than 400 U.S. electric and water utilities, per Stock Titan.
The scale of need those firms are stepping into is stark. Dragos CEO Robert M. Lee reported in August that approximately 97% of U.S. water utilities lack the financial and technical resources needed to defend against sophisticated cyber threats without outside state or federal help, according to CYBR.SEC.Media. Reporting from Nextgov/FCW frames Project Watershed 250 as the first state-based, industry-centric pilot launched under the Office of the National Cyber Director's national cybersecurity strategy, intended to test utility defense models over six months before any potential national expansion.
A History of Federal Action, and an Open Question
This is not the first time Washington has tried to shore up water cybersecurity. President Trump signed a 2018 law requiring larger water systems to assess cybersecurity risks, and the Biden administration launched a water-sector cyber action plan in 2022 that included pilot projects and technical resources, per the Express-News. In May 2025, Senators Ruben Gallego and Tom Cotton introduced the bipartisan Water Cybersecurity Enhancement Act, aiming to expand federal grant opportunities and technical assistance for local water systems, as Hoodline reported in earlier coverage of the bill.
Project Watershed 250's stated goal is to identify approaches that could scale across national water and wastewater infrastructure and eventually expand nationwide. But the central question hovering over the pilot is whether a six-month program offering free private-sector assistance can realistically extend to thousands of underfunded rural water providers once the federal pilot support runs out, a tension flagged in Nextgov/FCW's reporting on the launch.
