From the Utility Management edition of November 10, 2026
Project Watershed 250: free red-team and AI tools for Texas water utilities expose a remediation and funding gap once the six-month pilot ends
Industrial Cyber (features desk); programme partners ONCD, Texas Cyber Command, Texas Governor's Office, EPA, CISA · Drinking water and wastewater cybersecurity (municipal and small systems) · Texas, United States, with national funding implications
- Publisher
- Industrial Cyber
- Original publication
- 2026-11-10
- Source retrieved
- 2026-11-11
- Event date
- 2026-08-31
What happened
Feature on Project Watershed 250, a six-month pilot launched 31 Aug 2026 by ONCD and Texas Cyber Command with EPA and CISA. Participating utilities get red-team assessments, AI tools, threat intelligence, training, remediation help and defensive tools free. Texas has more than 7,400 public water systems and 3,000 wastewater facilities. Practitioners from West Yost, I&C Secure, Dispel and the Roosevelt Group say finding vulnerabilities is easy but fixing them needs hardware, scarce OT staff and money. They note six months is barely enough to start, tools carry recurring licence fees, and governance and team friction often stall fixes. Texas Cyber Command bars automatic conversion to paid services after the pilot. Federal funding is fragmented: SRF loans need a 20% state match; SDWA 1433(g) and 1459G expired unfunded; resilience grants reach only systems serving 10,000+ people; EPA's $11.75M in August grants went to 10 midsize and large systems.
Why it matters
Independent scrutiny of the dominant federal response to the 2026 PLC attacks, published the day the NARUC water-cyber resolution is pending. It shows that free assessment and AI tooling without remediation funding and governance may not change outcomes for small municipal systems.
Evidence and measured results
Feature with named experts and programme facts; no measured outcomes from the pilot yet. Funding figures are attributed to EPA announcements and a Roosevelt Group adviser. Author opinion ('the pilot will almost certainly work') is commentary.
Limitations and uncertainty
Trade press with commentary; includes a vendor executive (Dispel). Pilot is ongoing with no published results. Texas-specific programme.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Water utilities receive vulnerability findings but lack money, OT staff and decision processes to fix them before free support ends.
- Stakeholders
- Utility manager
- City council or board
- OT integrator
- State cyber agency
- Finance director
- Discovery questions
- Which findings from recent assessments remain open and why?
- Who has authority to approve downtime for remediation?
- Which pilot-provided tools expire, and when?
- Is there a recurring cybersecurity budget line?
- Value hypothesis
- A costed, prioritised plan could convert assessment findings into funded fixes and reduce exposed attack surface within budget cycles.
- Potential engagement
- Remediation-planning sprint that maps findings to costs, owners and named funding sources (SRF, state programmes, operating budget).
- Unsupported claims
- That Project Watershed 250 has reduced incidents (no results yet)
- That AI tools alone close vulnerabilities
- That federal funding is available for small systems in the near term
Pre-sales engineering
Role takeaway
- Fit
- Small and mid-sized municipal water and wastewater systems with legacy SCADA and limited staff.
- Architecture and integration
- Defensible baseline: remove internet exposure, segment OT, secure remote access, then layer monitoring.
- Prerequisites
- Assessment findings
- OT asset inventory
- Integrator contract terms
- Constraints
- Hardware supply-chain lead times
- Limited change windows for continuous operations
- Buy America and SRF match rules slow purchases
- Security
- Rank by exploitability and workflow, not CVE score; verify tool licensing and data handling.
- Proof of value
- Count of exposed devices before and after
- Percent of critical findings with funded plans
- Post-pilot tool continuity confirmed
Delivery
Role takeaway
- Work
- Translate findings into funded, sequenced remediation with leadership decisions recorded.
- Dependencies
- Integrator availability
- Funding approvals
- Downtime scheduling
- Ownership
- Utility manager with OT lead or contracted integrator.
- Skills and adoption
- Ongoing training for multi-role public-works staff; integrator security responsibilities written into contracts.
- Governance checkpoints
- Leadership risk review for unfixable items
- Budget approval for recurring line
- Pilot exit review of tool continuity
- Acceptance criteria
- Every critical finding has owner, cost and date
- Recurring cybersecurity budget adopted
- No pilot tool lapses without a decision
- Risks
- Pilot tools expire
- Staff turnover
- Fixes cause operational disruption
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Remediation often requires architecture changes (segmentation, replacement of exposed controllers) that cannot be completed in six months given supply chains and change windows.
Governance
Who approves, reviews and stays accountable for outcomes?
Practitioners identify decision-making authority, not technology, as the common blocker: utilities find vulnerabilities but lack a process to characterise risk and escalate to leadership.
Security and privacy
What data, permissions and controls need testing?
CVE-score-driven reports can misprioritise; experts recommend a defensible baseline architecture and prioritisation by operator workflow and exploitability.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small-system staff have other public-works duties; training must be sustained for changes to stick.
Procurement
What should contracts, pricing and exit terms secure?
Pilot vendors must disclose service limits, expiry and post-pilot costs; low-bid integrator contracts rarely include cybersecurity.
Operating model
Which teams own the service once it runs?
Utilities are advised to create a recurring cybersecurity budget line and require integrators to build security into maintenance work.
Publication history
- 2026-11-10Utility Management · Issue 126 resources
Stable resource ID: project-watershed-250-water-cyber-pilot-remediation-funding-gap-2026