American water companies are turning to volunteer hackers, small cybersecurity firms, and a Vanderbilt University AI program to shore up defenses after a wave of suspected Iranian cyberattacks, and after federal assistance programs that once backstopped them were scaled back.
The shift marks a striking admission from an industry that supplies drinking water to hundreds of millions of Americans: the nation's water infrastructure remains dangerously vulnerable to foreign adversaries, and the utilities responsible for protecting it increasingly lack the federal support they once counted on. NBC News reported that some water companies are now relying on an AI tool developed at Vanderbilt University and on smaller private-sector cybersecurity outfits to fill the gap left by reduced government programs.
The problem is not hypothetical. Over the past two years, cyberattacks linked to Iran have struck water systems across multiple states, exposing how thin the digital defenses around critical public infrastructure really are. The attacks targeted operational technology, the computerized systems that control water treatment and distribution, rather than just stealing data. That distinction matters. A breach of operational controls can affect the quality and safety of the water that flows from the tap.
The current scramble did not start in a vacuum. Federal authorities, including the FBI and EPA, have warned repeatedly that hackers tied to Iran's government have probed and penetrated municipal water systems from coast to coast. Those warnings followed confirmed intrusions that hit water systems in at least seven states, forcing local operators to assess whether their treatment processes had been tampered with.
Two New Jersey water systems were among the targets, raising alarms in a densely populated corridor where even a brief disruption could affect tens of thousands of residents. In Minnesota, the damage was broader, hackers struck roughly 30 water treatment plants, prompting federal officials to issue nationwide warnings about the vulnerability of small and mid-sized utilities.
The pattern is clear enough. State-linked hackers from Iran identified American water infrastructure as a soft target, and they were right.
With federal cybersecurity assistance programs cut back, water utilities have had to improvise. One answer has come from Vanderbilt University, which developed an AI-driven tool designed to help smaller utilities detect and respond to cyber intrusions they lack the in-house expertise to handle on their own.
That tool, along with volunteer cybersecurity professionals and smaller private firms, now forms a patchwork defense for systems that were never built with sophisticated digital threats in mind. Many municipal water plants run on aging industrial-control systems that predate modern cybersecurity standards. Their operators are water-treatment specialists, not network engineers. When a foreign intelligence service targets their systems, they are often the last to know, and the least equipped to respond.
The reliance on volunteers and academic programs underscores a basic failure of federal policy. Washington spent years warning about the threat to critical infrastructure from hostile nation-states. Federal investigators probed possible Iran connections to the multi-state attacks. Yet the assistance programs that were supposed to help local utilities harden their defenses were cut rather than expanded.
Large metropolitan water authorities typically have dedicated IT departments and cybersecurity budgets. Small and mid-sized utilities, the ones that serve rural communities and smaller cities, do not. They are the systems most likely to run outdated software, least likely to have intrusion-detection tools, and most dependent on whatever help the federal government or outside volunteers can provide.
When that help dries up, those communities are left exposed. The consequences are not abstract. A compromised water-treatment system could alter chemical dosing, disrupt service, or contaminate drinking water before anyone notices. The attacks on 30 Minnesota plants showed how quickly a coordinated campaign can overwhelm small operators who share the same vulnerabilities and the same lack of resources.
Infrastructure neglect is not limited to cybersecurity. Some communities have seen their water systems degrade to the point of failure for reasons that have nothing to do with hackers, governance collapse, funding shortfalls, and simple abandonment. But the cyber threat adds a new and more dangerous dimension. A town that cannot keep its water safe from ordinary neglect has no chance against a state-sponsored hacking operation.
For years, the EPA and the Cybersecurity and Infrastructure Security Agency urged water utilities to adopt basic cyber-hygiene measures, changing default passwords, segmenting networks, monitoring for unusual activity. The guidance was sound. The follow-through was not. Federal programs that offered technical assistance and on-site assessments to small utilities were scaled back, leaving operators to fend for themselves at precisely the moment the threat was escalating.
The result is a system in which the most critical piece of civilian infrastructure, clean drinking water, depends on the goodwill of volunteer hackers and an AI program from a university lab. That is not a cybersecurity strategy. It is an improvisation born of neglect.
Water utilities did not ask to become targets of Iranian intelligence operations. They were thrust into that role by a threat environment that evolved faster than the federal bureaucracy was willing to adapt. Cutting the programs that helped them defend themselves was not a cost savings. It was a transfer of risk, from Washington's budget to every family that turns on a faucet.
When a foreign adversary can reach into an American town's water supply and the only thing standing in the way is a volunteer with a laptop, the federal government has not streamlined its operations. It has abandoned its responsibilities.
