Small water, wastewater, electric and natural gas utilities just got a new option for OT security help, and the timing is not an accident.
On 20 October, Accenture, Dragos and the SANS Institute launched the Community Cyber Resilience Foundation, a nonprofit that will provide OT security software, hardware, deployment services and SANS ICS/OT training at no cost to under-resourced U.S. utilities. Phase one carries an initial combined commitment of about $10 million and aims to onboard up to 500 utilities. U.S. water, wastewater, electric and natural gas utilities with less than $100 million in annual revenue are eligible. According to the announcement, that is more than 97% of utilities, or more than 50,000 organizations.
The launch comes after this summer's wave of attacks on water systems. CISA reported that in July 2026 it observed malicious activity targeting over 100 internet-exposed water and wastewater systems, commonly through PLCs connected directly to a cellular modem. Attackers changed passwords to lock out operators and changed IP addresses to disconnect the PLCs, which led to boil water notices and sustained manual operations.
What eligible utilities can expect, per the foundation:
• Access to the Dragos Platform and services to see what is on the OT network, with Elastic providing the log storage and search underneath.
• Accenture deployment services: configuration, integration and ongoing support.
• SANS ICS/OT training for in-house staff.
• Hardware and infrastructure funding, plus a peer community of utilities.
Where this lands, from the plant floor to the cloud:
• Field: PLCs, RTUs and lift stations, often reached over cellular modems an operator, vendor or integrator installed.
• Control room: SCADA servers and HMIs, where monitoring sensors need a clean view of the traffic.
• Plant perimeter: the remote access paths that should go through a VPN or gateway, not straight to a PLC.
• Enterprise and cloud: the platform, its logs, and the people who have to act on its alerts.
What the Red Tiger team recommends for small utilities now:
1. Check eligibility and apply. If your utility is under $100 million in annual revenue, review the program at ccrfoundation.org.
2. Fix exposure first. A monitoring tool does not take a PLC off the internet. Find every cellular modem and internet-facing controller, remove direct exposure, change default passwords, and allowlist remote access, as CISA urged in its 30 July alert.
3. Plan a plant-safe deployment. Decide where the sensors go, what traffic they need to see, and how the install moves through change control without touching live operations.
4. Decide who watches and responds. Free technology still needs someone on the alerts and an incident response plan that covers manual operations and calling the vendor, integrator and authorities.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Announcement: https://newsroom.accenture.com/news/2026/accenture-dragos-and-sans-institute-launch-foundation-to-strengthen-cyber-defenses-for-u-s-utilities
Foundation: https://www.ccrfoundation.org/
CISA water PLC alert (30 Jul 2026): https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
Check out our resources and book a follow-up call with our team.
