The **Community Cyber Resilience Foundation**, a joint venture by global services company **Accenture**, cybersecurity firm **Dragos**, and training organization the **SANS Institute**, has been launched to address the critical cybersecurity gaps in smaller U.S. utilities. The three organizations are collectively investing $10 million into the foundation, targeting utilities with less than $100 million in annual revenue – a demographic that accounts for 97% of all U.S. utilities. ### Addressing a Critical Gap This program is specifically designed for U.S.-based water, wastewater, electric, and natural gas utilities. For years, cybersecurity experts have warned that many smaller utilities lack the financial resources, specialized staff, and technological capacity to implement robust cybersecurity defenses. This leaves thousands of essential operational technology (OT) components – including pumps, valves, substations, and distribution networks – vulnerable to attack. ### Comprehensive Support Package Participating utilities will receive a multi-faceted support package: * **Dragos** will provide access to its cybersecurity tools, which offer network device visibility and highlight actionable vulnerabilities within operational technology environments. * **Accenture** will lead the deployment and configuration of these tools, offering ongoing support as utilities integrate them into their daily operations. * The **SANS Institute** will deliver essential training programs, building the internal capacity and skills of utility employees to effectively manage and protect their systems. ### The Growing Threat Landscape The initiative comes in the wake of numerous cyberattacks targeting U.S. critical infrastructure. Recent incidents include breaches affecting over 100 water utilities, alongside persistent warnings from government agencies regarding sophisticated cyberattacks from groups linked to China and Russia, targeting energy utilities, telecoms, and other vital sectors. **Dragos** CEO **Robert Lee** emphasized the urgency of the situation, stating that cybercriminals and nation-states are "aggressively targeting utilities, attacking the operational environments that provide life-sustaining services to millions of Americans." He added that the foundation will grant "the utilities that need it most access to cybersecurity resources and training at no cost." ### Collaborative Resilience and Future Expansion Beyond technical and training provisions, the program fosters a collaborative environment, allowing participants to share best practices and operational experiences. **James Lyne**, CEO of the **SANS Institute**, underscored the importance of human capital: "The best security technology in the world won’t protect a utility if its staff are not able to use it. The foundation puts training and skills in the hands of the people protecting the water, power, natural gas, and wastewater treatment systems that communities rely on.” The first phase of the program will encompass 500 utilities, with potential for expansion based on its success. While there is no federal or state government involvement in this particular program, the cybersecurity company **Elastic** will also provide technical support to help scale the initiative. There is no time limit on participant access, and **Dragos** has indicated that other companies are already expressing interest in joining to further expand its reach. This private sector-led effort complements other recent initiatives, such as the **National Rural Water Association (NRWA)**'s program launched after July's water utility attacks. That initiative involved five managed detection and response providers – **Rapid7**, **Defendify**, **Legato Security**, **L1 Secure**, and **Sentinel Technologies** – collaborating to share threat intelligence and vulnerability patch data. These programs highlight a growing recognition of the need for robust, accessible cybersecurity solutions for critical infrastructure, particularly given the stagnation of federal efforts and the increasing reliance on state-level frameworks to protect essential services.