On 20 October, Accenture, Dragos and the SANS Institute announced the Community Cyber Resilience Foundation. According to Accenture’s release and SecurityWeek, it starts with about $10 million in funding and services and covers at most 500 US water, wastewater, electric and natural gas utilities in its first phase. It is a welcome move. It is also a good moment to ask what a free monitoring platform does and does not buy a small operator.
Sourcing note: programme terms come from Accenture’s announcement, SecurityWeek and The Record. The three broadly agree on the headline figures, though not every figure appears in each. All of them repeat the companies’ own claims, and we did not find independent assessment of the programme as of 22 October 2026 in those pages.
What is on offer
Per the announcement, participants get free access to the Dragos Platform, with Accenture handling configuration, integration and ongoing support. Elastic is also supporting the initiative with technology. The foundation funds the hardware needed to run it, SANS provides ICS/OT security training so staff can run defences in-house, and utilities join a peer network. Eligibility is US-based water, wastewater, electric or gas providers with annual revenue under $100 million. The companies estimate that covers more than 50,000 organisations, or over 97% of US utilities.
It builds on the Dragos Community Defense Program, which Dragos announced in December 2023 for under-resourced utilities with under $100 million in revenue. Accenture’s release says Dragos’s programme already gives more than 100 utilities free access to the platform. Dragos’s 2023 release listed the same building blocks: asset visibility, detection, vulnerability management, threat hunting, the Neighborhood Keeper collective defence service, training and OT-CERT membership.
Why the target group matters
The companies describe small utilities as short of money and staff and running ageing technology, especially in rural communities. Accenture’s release cites a recent surge in attacks targeting more than 100 US water systems across more than a dozen states. We did not open a CISA report on this, so the figure is the companies’ claim. Our own coverage of the July Minnesota incident, where attackers reached internet-facing PLCs at more than 30 municipal water systems, shows what that exposure looks like.
Our assessment: visibility is the right first investment. A utility that cannot list its OT assets cannot tell whether a given vendor advisory applies to it. Rapid7’s Q3 data, as reported by SecurityWeek, says high-severity flaws were exploited within an average of three days of disclosure (across all sectors, not OT-specific), which is faster than most small operators can even read an advisory.
What a platform does not fix
Staff time. Detection tooling produces alerts. A two-person operations team still has to triage them, and the foundation’s training pillar is aimed at exactly this gap. The sources we reviewed do not state how long the training runs, and we found no outcome data for the 2023 programme, so whether it closes the gap is untested.
Segmentation and remote access. A passive monitoring platform shows you an exposed PLC. It does not remove it from the internet. In our assessment the cheapest controls for this sector, such as taking controllers off public addresses, changing default credentials and putting remote access behind a VPN with MFA, cost little and sit outside the platform. They should be done first, funded or not.
Dependency on a vendor. The offer ties participants to one commercial platform. That is a reasonable trade for a utility with nothing today, but boards should ask what happens to the data, the hardware and the support arrangement if the programme ends or changes. Accenture’s release does not state how long support lasts. The Record alone reports no time limit, without attributing it, so treat that as unconfirmed. The Record also says the first phase may expand depending on its success.
Scale. Five hundred utilities is at most about 1% of the more than 50,000 eligible organisations the companies cite. The number matters because attackers choose targets by exposure, not by participation.
What this means for the sector
For operators, check eligibility and apply, but do the no-cost hygiene work in parallel. For larger utilities and suppliers, the peer network is a prompt: sharing detections and lessons with smaller neighbours reduces shared risk, and in our view many small systems depend on larger ones. For regulators and funders, the model shows private money filling a gap that public programmes have not closed. The Record reports no federal or state government involvement, and that the National Rural Water Association launched its own programme in July with five managed detection and response providers. That is useful, though private programmes should not stand in for baseline requirements.
Transport, healthcare and finance readers should note the pattern. Small operators in every critical sector face the same mix of thin staffing and exposed legacy systems, and we have not checked whether they have an equivalent offer.
Recommended actions
- If you run a small US utility, review the eligibility terms and register interest, keeping your own asset inventory current regardless.
- Audit for internet-reachable controllers, default credentials and remote access without MFA this month.
- Ask any vendor-funded programme what happens to your data and hardware if funding ends.
- If you are a larger operator, consider whether you can share threat information with smaller neighbours.
This piece is commentary and reflects our assessment. Programme details come from Accenture’s announcement, SecurityWeek, The Record and Dragos’s 2023 release.