LAS VEGAS — A water industry trade group and a collective of volunteer cybersecurity experts are bringing free security services to small water utilities that desperately need help protecting their systems from hackers. The DEF CON Franklin project on Friday announced that it will pay cybersecurity firms to provide their monitoring and protection products for free to water utilities serving fewer than 10,000 people. Those utilities, which account for more than 90% of the 50,000 community water systems in the U.S., are among the most digitally vulnerable, a danger highlighted by recent Iran-linked attacks on water systems across the country. Five managed detection and response (MDR) providers — Defendify, Legato Security, L1 Secure, Rapid7 and Sentinel Technologies — will initially participate in the program, and they will share the threat intelligence they collect from utilities’ networks through a new Water Watch Center run by the National Rural Water Association (NRWA). When MDR software installed on a utility’s network detects a potential cyberattack or vulnerability, the vendor will alert the utility and provide a report on the problem. The utility can then either fix the problem itself or request help from a volunteer expert on Franklin’s roster. “This is all about scale,” DEF CON Franklin organizer Jake Braun said in a Friday interview here on the sidelines of the DEF CON cybersecurity conference, the birthplace of the volunteer group. “Scaling delivery of cyber is where all the challenges fall.” The MDR offering and watch center represent a significant expansion of Franklin’s work supporting the water sector. In late 2024, the group started dispatching volunteers to help participating water utilities implement basic cybersecurity measures, map their networks and write incident-response plans. But Friday’s announcement marks the beginning of an ambitious new era for the group that will see it directly fund commercial