The White House and Texas officials have launched Project Watershed 250, a six-month cybersecurity pilot in Texas designed to harden the defenses of as many as 250 water and wastewater utilities against escalating nation-state threats[1][2][3][5]. The initiative debuted in San Antonio, where Governor Greg Abbott joined National Cyber Director Sean Cairncross to unveil a program that will deliver free cybersecurity services and technology to local providers, with Texas serving as the testbed for a model the administration hopes to scale nationwide[1][2][6][8].
Project Watershed 250 is led by the Office of the National Cyber Director in partnership with federal agencies including the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency, alongside Texas Cyber Command and local authorities[1][2][3][6]. The pilot reflects a broader strategy by the cyber director’s office to launch state-based, industry-centric programs following the release of the national cybersecurity strategy, with Texas positioned as the first water-sector proving ground[6][8]. Officials have emphasized that the program is aimed particularly at rural and under-resourced utilities that lack in-house security teams and modern defenses, offering them advanced capabilities at no cost[2][3][5].
The rollout comes after a series of disruptive cyber incidents targeting water systems across at least a dozen states, attacks that many experts suspect may be linked to Iranian actors probing operational technology and legacy control systems[3][8][15]. Federal agencies, including the FBI, EPA and CISA, have warned that hostile states and criminal groups are increasingly focused on water and wastewater infrastructure, exploiting outdated software, weak remote-access controls and poorly secured industrial control systems[3][8][15]. Abbott has cast Project Watershed 250 as a way to make Texas utilities “harder targets” for China, Iran and other foreign adversaries, underscoring the geopolitical dimension of recent activity against critical infrastructure[5][8].
Under the pilot, participating utilities will receive red-teaming exercises, vulnerability assessments, remediation support and system-hardening guidance from a coalition of cybersecurity and artificial intelligence companies volunteering their services[1][3][6][7]. Firms such as Microsoft, Palo Alto Networks, Parsons, Dragos, Reflection AI, Fortinet, Google Cloud, Amazon Web Services, Cloudflare, Zscaler, Forescout, Abnormal AI, Tenable and Invicti are among those involved, bringing tooling that ranges from network and application security to industrial control system monitoring and AI-enabled threat detection[1][3][6][7]. The services are structured to stress-test utilities’ current defenses, identify exploitable weaknesses in both IT and operational technology environments, and help providers implement compensating controls and longer-term mitigation plans[1][3][6][7].
Officials have not publicly detailed specific vulnerabilities, CVE identifiers or CVSS scores tied to the pilot, instead framing Project Watershed 250 as a comprehensive effort to address systemic risks across aging legacy systems, remote-access infrastructure and poorly segmented networks[1][6][8]. While no exploit proof-of-concept code or active campaigns have been attributed directly to this program, federal and state partners say the goal is to move beyond incident response and toward continuous assessment, data-driven hardening and scalable defenses that can be replicated in other states if the Texas experiment delivers measurable risk reduction[1][3][6][8]. The six-month timeline is intended to generate enough operational lessons for a national rollout while providing immediate uplift to participating utilities’ security postures[1][3][6].
For water providers, the pilot arrives amid growing regulatory and operational pressure to treat cybersecurity as core to public health and safety, not an optional IT function[11][14][15]. Texas utilities are already required to report cyber incidents to state regulators, and CISA’s water-sector guidance urges operators to strengthen basic cyber hygiene, tighten remote access, segment industrial networks from business systems, and maintain tested backup and recovery plans[11][14][15]. State officials are encouraging eligible utilities to engage with Texas Cyber Command and Project Watershed 250 as an opportunity to obtain high-end assessments and tooling they could not otherwise afford, while non-participating providers are being urged to align with emerging best practices and prepare for a future in which similar pilots may expand beyond Texas[2][3][5][15].
References
- White House launches water cybersecurity pilot in Texas
- Gov. Abbott, White House launch cybersecurity project to secure Texas water
- White House Launches Water Provider Cybersecurity …
- Abbott, White House Cyber Chief Team Up to Safeguard …
- ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help
- Parsons selected for water infrastructure cybersecurity pilot
- White House to unveil program to protect water systems …
- [PDF] TCEQ Cybersecurity Water Utility Updates
- Homeland Security for PWS: Disaster and Recovery
- Water and Wastewater Cybersecurity
