Growing demand for computing power is putting more pressure on water utilities to secure the systems that support data center cooling, even as small providers struggle with limited staff and funding, experts said Oct. 27 at ISC2 Security Congress 2026 in Denver.
The conference highlighted a mismatch between the consequences of water-system disruption and the resources available to prevent it. Small utilities, for example, may have only a handful of technical employees covering multiple responsibilities, leaving little capacity for dedicated cybersecurity and operational security work.
Philip Stupak, senior director of advocacy at ISC2, a nonprofit association for cybersecurity professionals, and a former assistant national cyber director, said that the water sector’s importance extends beyond drinking water to public health broadly, as well as national security and geopolitical power.
Today, he noted, “national security is tied directly into AI production. … That’s what we’re competing on: Global compute power. And to do that, we need two things: power and water.”
And, because power and water plants are online, they can be sabotaged by adversaries from anywhere in the world, Stupak observed. Approximately 100,000 water districts operate across the United States, he said.
“Water is what kept me up at night,” Stupak said of his time at the White House. “This was the one critical infrastructure sector that we were not adequately prepared for.”
Small, rural water districts are a particularly vulnerable target because they may supply data centers but lack the staff to defend against cyberattacks, Stupak said.
Small utilities typically have one to three technical employees who cover multiple roles and rely heavily on contractors, he noted, while medium utilities have distinct IT and operational technology groups that share cybersecurity responsibilities. Large utilities typically operate multiple plants and stations, with distributed supervisory control and data acquisition systems and a mature cybersecurity organization.
In small districts, Stupak said, improving security may mean assigning cybersecurity duties to an existing employee, drawing on county personnel, or contracting for managed security services. Those limited resources become a national security concern when adversaries can target a small water provider to disrupt the computing infrastructure that depends on it, he warned.
Training and cooperative arrangements can boost system resilience
Stupak pointed to resources from the American Water Works Association that can help water districts improve security, including cybersecurity risk management guidance and an assessment tool that generates a customized, prioritized list of controls.
Workforce development is critical, conference participants said: Water-system personnel need cybersecurity fundamentals, while cybersecurity professionals need to understand operational technology (OT).
Participants called for funding that supports ongoing training, regular exercises, and security improvements. They suggested pooling resources through shared services and creating incentives for private-sector partners, including data center companies that depend on local water supplies, to help cover those costs.
Stupak also endorsed cooperative arrangements and managed security services, and he described Texas Cyber Command’s university-based regional security operations model as a way to combine practical student experience with support for entities lacking cybersecurity expertise.
Texas is testing a public-private approach to water system security with Project Watershed 250, which Gov. Greg Abbott and National Cyber Director Sean Cairncross launched Aug. 31. The initiative involves the White House Office of the National Cyber Director, Texas Cyber Command, the governor’s office, and private-sector partners. Participating water and wastewater utilities can receive assessments, remediation assistance, and defensive tools at no cost, according to Texas Cyber Command.
The Cybersecurity and Infrastructure Security Agency’s new strategy, released Oct. 26, commits the agency to working with infrastructure owners and operators to modernize OT environments, improve asset visibility and anomaly detection, and strengthen OT supply chain integrity. It also calls for prioritizing infrastructure whose disruption would most affect public health and safety, economic continuity, and national security.