Cybersecurity for Small Water Systems: Why Every Tap Matters
Close the Cyber Gap. Volunteer Where It Matters Most.
Last week, the Environmental Protection Agency (EPA) announced $9 million in grant funding to help midsize and large water utilities strengthen cybersecurity protections. It’s a step forward after a series of high-profile hacks against water systems in Pennsylvania, Texas, and even Poland.
But here’s the catch: small water systems aren’t eligible.
That leaves tens of thousands of utilities, often serving rural, small-town, and under resourced communities, on their own. These are the very places most likely to fall below what experts call the “security poverty line.” Coined by Wendy Nather in 2013, the term refers to organizations that can’t afford the basics of cybersecurity. Communities below this line struggle with:
Insufficient funding for tools like intrusion detection or endpoint monitoring.
Workforce shortages, leaving operators without in-house cyber expertise.
Outdated technology that can’t be patched quickly.
Limited visibility or influence, making them less likely to attract outside help.
Small Systems, Big Risks
The vulnerabilities aren’t hypothetical. Hackers have already disrupted rural water utilities:
In Pennsylvania, an Iranian-linked group compromised a water facility’s system.
In Muleshoe, Texas, Russian hackers temporarily shut down a pump at a rural utility.
In Poland, officials foiled an attempt to disrupt a major city’s water supply.
A successful intrusion in a small U.S. system could be devastating. Without dedicated budgets or backup systems, a single breach could:
Disable pump monitoring, leaving operators blind.
Trigger overflows, damaging infrastructure and creating health hazards.
Cut off the entire water supply to families who have no alternative.
For the 46 million Americans who live in rural areas (14% of the population), these risks are not abstract. They are daily realities, compounded by systemic underinvestment. Despite growing populations and strong high school graduation rates (about 90% in rural communities), many small towns still face the same cyber inequities—underserved, not behind.
The AI Multiplier
As artificial intelligence accelerates, the risks grow sharper. AI-enabled malware can scan networks faster, identify vulnerabilities at scale, and even mimic the commands of human operators. Adversaries no longer need deep expertise to launch sophisticated attacks, AI tools lower the barrier to entry.
For small water systems already struggling below the cyber poverty line, this creates a dangerous equation: fewer defenses, more powerful attacks. A single unpatched sensor or unsecured remote login could be exploited automatically, giving attackers control in minutes. Worse, AI can also generate convincing phishing messages tailored to local staff, tricking operators who may have little to no cyber training.
At the same time, AI data centers are springing up in rural America, consuming millions of gallons of water per day for cooling. As we wrote in Digital Thirst: When AI Drinks the Well Dry, these facilities often sit in the very communities least equipped to absorb the strain. That makes small utilities not just vital for families, but also chokepoints for the AI industry.
Adversaries know this: targeting a rural system can now disrupt both households and global AI infrastructure.
The result: small utilities are already high-value, low-cost targets. The convergence of AI-powered hacking tools, limited rural cyber defenses, and new water stress from AI data centers only makes the threat worse.
Filling the Gap with People Power
That’s why the Cyber Resilience Corps and DEF CON Franklin are stepping in. Where federal programs fall short, volunteer cyber professionals are deploying across the country to help shore up small utilities.
Think of it as a modern digital fire brigade:
Auditing system configurations.
Patching vulnerabilities.
Training local operators to respond when an attack hits.
This isn’t a replacement for sustained federal or state investment, but it buys time for the communities most at risk. Until funding reaches every corner, volunteers are helping keep the taps flowing.
Why This Matters
Cybersecurity isn’t just about protecting big cities or billion-dollar systems. Every tap matters. Every family depends on it.
Leaving the smallest water systems exposed creates a dangerous two-tier model: urban areas with cyber defense, and rural communities left vulnerable. That’s both a national security problem and an equity problem.
The EPA’s $9 million is progress but without extending protection to the tens of thousands of utilities that keep rural America running, we risk drawing the cyber poverty line right through our nation’s water supply.
How You Can Help
If you want to learn more or volunteer your expertise to defend small water utilities you can visit defconfranklin.com. You can also reach out directly at defconfranklin@gmail.com.
Because cybersecurity isn’t just for the big players. Every tap matters. Every family depends on it.
Even if you don’t have cyber skills, you can still help—spread the word, support your local utilities, or connect them with volunteer groups like DEF CON Franklin. Every action strengthens community resilience. Have ideas, questions, or stories from your own community? Share them in the comments, we’d love to hear how you’re making a difference.