Water and wastewater systems are among the most essential components of our nation’s critical infrastructure. Yet many utilities, particularly smaller and rural providers, lack the personnel, funding, and cybersecurity resources to defend against today’s sophisticated threat landscape.

Sophisticated nation-states are pervasively attacking American water systems to attack American national security. The bad actors’ use of artificial intelligence (AI) is accelerating the pace, scale, and sophistication of their attacks. Threat actors now use AI to speed reconnaissance, automate elements of an attack, and identify exploitable weaknesses more efficiently. Defenders must be able to operate at comparable speed while maintaining the dependability and security that operating environments require.

On August 31, Fortinet joined Texas Governor Greg Abbott, White House National Cyber Director Sean Cairncross, Texas Cyber Command Chief Admiral (Ret.) T.J. White, and other government and industry leaders in San Antonio to launch Project Watershed 250. This six-month pilot unites federal and state agencies, water utilities, and private-sector cybersecurity and technology companies to strengthen the resilience of water systems across Texas.

Fortinet is honored to participate in this important initiative and to contribute our cybersecurity expertise and innovation to help protect the infrastructure that millions of people depend on.

An Essential Service Facing Growing Cyber Risk

Water systems are becoming increasingly attractive targets for nation-state actors and other adversaries. Recent Cybersecurity and Infrastructure Security Agency (CISA) alerts have highlighted cyberattacks on more than 100 water systems across the United States. Governor Abbott also noted during the announcement that more than 30 municipal water utilities in 12 states were targeted in a recent Iranian-backed campaign.

These attacks go beyond threats to data or information systems. A successful breach of water system operational technology (OT) can disrupt physical processes, compromise water safety or availability, and result in significant damage to public health and well-being.

Smaller utilities face a particularly difficult challenge. Many rely on legacy equipment, lack visibility into their IT and OT environments, and have small teams managing cybersecurity alongside numerous other operating priorities. At the same time, they must defend this critical infrastructure against increasingly sophisticated adversaries who have ample resources and boundless reach. Absent assistance for these utilities, it isn’t a fair fight.

Building a Proactive Defense

Project Watershed 250 is designed to help participating Texas water utilities identify and tackle vulnerabilities and get ahead of the threats before adversaries can exploit them. The program will provide participating utilities with access to cybersecurity resources, including red-team testing, system assessments, hardening support, threat intelligence, and AI-enabled defensive capabilities.

This represents an important shift from a traditional reactive security model to a more proactive one. As Admiral White explained during the roundtable, cybersecurity is not something an organization simply has. It is something it must do deliberately every day, before an adversary acts.

That principle is especially important in operational technology environments. Water facilities must maintain continuous service, often while operating specialized equipment that was not designed for today’s interconnected threat environment. Improving their security requires more than simply adding new tools.

Project Watershed 250 will enable government, industry, and participating utilities to test these approaches in real-world conditions, determine what works, and develop a model that can be applied more broadly across the nation.

Public-Private Collaboration Built to Scale

The scale and sophistication of today’s cyberthreats make collaboration critical. No single company, utility, or government agency can address the challenge alone. Fortinet has said for years that cybersecurity is a team sport, and the importance of teamwork has never been bigger given the scale, sophistication, and persistence of today’s threats.

Project Watershed 250 unites the White House Office of the National Cyber Director, Texas Cyber Command, CISA, the Environmental Protection Agency (EPA), water utilities, and private-sector partners in a coordinated effort. Each participant contributes a distinct element of defense, including operational knowledge, threat intelligence, cybersecurity technology, AI capabilities, testing, training, and incident-response expertise.

Texas provides an effective proving ground for this model. The state has a large, diverse water infrastructure, substantial cybersecurity expertise, and the nation’s first standalone state cyber command. Governor Abbott and the Texas Legislature have prioritized protecting Texas’s critical infrastructure and have established the Texas Cyber Command to strengthen statewide readiness, improve coordination, and help protect critical infrastructure from today’s persistent cyberattacks.

Fortinet’s Commitment to Critical Infrastructure Security

For more than 25 years, Fortinet has worked to strengthen OT security and protect critical infrastructure and therefore human health and well-being. That experience has shown us how the risks facing water organizations have grown as IT and OT environments have become more connected and digital threats have become more persistent. Protecting water infrastructure and the communities it serves requires government and industry to combine their expertise, technology, and resources.

The collaboration model around Project Watershed 250 provides a functional framework for achieving this. By combining public-sector leadership with private-sector technology and expertise, the program will help utilities strengthen their defenses while generating lessons that benefit the wider water sector.