A new White House pilot is putting Texas water utilities in the cyber hot seat, using AI and private-sector tools to find weaknesses before hackers do.
The Trump administration launched Project Watershed 250 on Aug. 31 in San Antonio, bringing federal agencies, Texas officials and cybersecurity companies together for a six-month effort to protect water and wastewater systems.
According to the White House, the pilot will test utilities’ defenses through red teaming, vulnerability assessments and system hardening. Participating companies will provide cybersecurity and AI capabilities to the utilities at no cost.
The Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency are federal partners, while Texas Cyber Command is overseeing the state effort. Companies participating include Microsoft, Google Cloud, Amazon Web Services, Palo Alto Networks, Dragos, Reflection AI, Cloudflare, Fortinet, Forescout, Tenable, Zscaler, Abnormal AI and Parsons.
National Cyber Director Sean Cairncross said the program is intended to identify and fix weaknesses before they can be exploited.
“U.S. companies are providing world-class cyber capabilities, red teaming that tests utilities’ current defenses, system hardening using the latest private sector cyber tools and AI tooling that helps utilities’ frontier cyber defenders to protect Texas water systems and scale proven solutions across the country,” Cairncross said at the launch, according to CyberScoop.
Why Texas is the test bed
Water utilities are particularly difficult to secure because many smaller and rural providers lack dedicated cybersecurity staff, funding and technical expertise. Recent attacks have added urgency. More than 30 community water systems in Minnesota reported malicious activity during a broader campaign affecting water systems across at least 12 states. Separately, a 2024 cyberattack in Muleshoe, Texas, caused a water system to overflow and was later attributed by researchers to a Russian-aligned hacking group, according to CyberScoop.
Still, the White House says Watershed 250 was being developed before the latest attacks.
“However, these recent attacks have reiterated the need for this modernization and focus on water systems,” a White House official said, per Fox News. Texas Gov. Greg Abbott emphasized the resource gap facing smaller providers.
“Texas is under perpetual cyberattacks, including cyberattacks on our water systems,” Gov. Abbott said during the launch, according to Axios. “The need for cyber resilience is overwhelming.”
The real test is whether it can scale
The most important part of Watershed 250 may come after the six-month pilot ends. Finding vulnerabilities is useful, but the harder challenge is determining which fixes small utilities can actually maintain once outside experts leave.
The program’s reliance on donated private-sector support also raises questions about long-term costs and whether utilities can maintain the protections after the pilot ends. Utilities gain access to expertise and technology they may otherwise struggle to afford. Still, the approach will need to demonstrate that those tools can work across systems with different equipment, budgets, and levels of technical maturity.
That makes Texas less a one-off cybersecurity project than a practical experiment: If the federal government can turn the lessons from Watershed 250 into a repeatable playbook, the model could give smaller water providers nationwide a clearer path to improving their defenses.
Cairncross summed up the approach, saying: “We are going to find out what works. We’re going to target that, and we are going to scale off of this and learn lessons,” according to CyberScoop.
For water utilities, the results should reveal more than which security tools work. The larger test is whether the pilot produces affordable protections, remediation guidance and ongoing support that smaller providers can maintain without relying permanently on outside experts.