Free OT Security for 500 Small Utilities: What the Accenture-Dragos-SANS Foundation Offers as Federal Cyber Grants Run Out

On October 20, 2026, Accenture, Dragos and the SANS Institute launched the Community Cyber Resilience Foundation, a nonprofit that gives small U.S. utilities operational technology (OT) security at no cost. The first phase comes with about $10 million in combined funding and in-kind services and aims to sign up up to 500 utilities.

Eligibility is broad. Any U.S. water, wastewater, electric or natural gas utility with under $100 million in annual revenue qualifies. The partners estimate that covers more than 97 percent of U.S. utilities, or over 50,000 organizations.

It isn't a grant in the usual sense: no check arrives. But for a rural water district or municipal electric system that has spent the past year watching federal cybersecurity money dry up, it may be the most valuable cyber resource on offer this year. It is worth understanding exactly what it provides and what it doesn't.

What a utility actually gets

The foundation bundles four things that small utilities have rarely been able to get together:

• Monitoring software. The Dragos Platform provides asset inventory, network visibility, threat detection and vulnerability management for industrial control systems. It also includes Neighborhood Keeper, Dragos's shared threat-intelligence network, and OT-CERT membership, which gives access to a peer community, templates and security guides.
• Hardware. The foundation pays, from cash contributions, for the equipment needed to run the platform. This is the piece earlier free-software offers lacked.
• Deployment and support. Accenture provides, in kind, the initial assessments, deployment, configuration and ongoing operational support. Elastic is contributing technical support.
• Workforce training. SANS provides courses ranging from cybersecurity basics through ICS/OT specialization, plus GIAC certification paths for utility staff.

Dragos CEO Robert M. Lee wrote that all of this comes "at absolutely no cost to the utilities, ever." The program has no time limit, and members stay as long as they remain eligible.

The foundation's website says enrollment is "opening soon." For now, utilities can join an interest list. The process runs through a single entry point: a short eligibility check covering what you operate and your annual revenue, followed by a match to the program.

Why free software was not enough

The foundation grew out of the Dragos Community Defense Program, launched as a pilot in 2022 and expanded in December 2023. That program already gave the Dragos Platform free of charge to small U.S. utilities under the same $100 million revenue ceiling. More than 100 utilities joined it.

Lee's launch post contains the most important sentence for anyone running grants or budgets at a small utility: "Access was never the problem. Knowing help was available and adoption was." Free software sat unused because small utilities lacked someone to install it, servers to run it, an initial assessment to show where to look, and staff time to watch it. Many have no dedicated IT or OT security staff. Spending often needs a board vote or approval from a public utility commission.

The new foundation is built around that lesson. Its program pays for the parts federal grants have historically paid for, which are hardware, integration labor and training, and that free software never covered.

The results are concrete. A three-person team at the City and Borough of Juneau, Alaska, reported uptime on critical systems rising from roughly 85 percent to 99.99 percent after deploying the platform. In Littleton, Massachusetts, a small public utility used the program to find and remove an intruder in its OT network that was reportedly linked to the Chinese government.

The threat backdrop: July's water campaign

The launch follows the worst publicly reported stretch of attacks on U.S. water systems. In August, CISA said it had seen activity in July 2026 against more than 100 internet-exposed water and wastewater systems. Most of the targets were programmable logic controllers connected straight to cellular modems. Reporting puts the affected systems in at least 12 states. CISA did not name the actor. Press reports pointed to an Iranian state-sponsored group, but federal agencies have not confirmed that. Actual service disruption was limited, though the investigations themselves caused some outages.

That attack pattern is the kind of exposure passive OT monitoring is built to catch: a PLC answering on a public cellular IP address, or an unexpected programming session from outside the plant. It is also the kind of problem a two-person water district never finds without an asset inventory.

The foundation is not the only response. After the July attacks, the National Rural Water Association set up its own arrangement with five managed detection and response providers (Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies), which agreed to share threat information and patch data with member systems. Small utilities now have two private, sector-specific options that did not exist a year ago.

Why it matters now: the federal pipe is closing

The State and Local Cybersecurity Grant Program, the main federal channel for local cyber spending, was written into the 2021 infrastructure law as a four-year, roughly $1 billion commitment. Its final tranche was $91.7 million for FY2025, down 67 percent from the year before, with a 40 percent non-federal match. Authorization ran through September 30, 2026 with no new appropriation. The PILLAR Act, which would reauthorize the program through 2033, passed the House and has stalled in the Senate. The Record summarized the situation simply: federal efforts on utility cybersecurity have stalled, and states are building their own frameworks.

For small utilities, that leaves three realities:

1. Many never received SLCGP money at all. Funds went to state administrative agencies, which passed them through to local governments. A special-purpose water district or electric cooperative was often at the back of that line, if it was in line at all.
2. Those that did receive it often bought licenses that now renew at full price with no federal share.
3. A 40 percent match on a cyber project is a hard sell to a utility board that has deferred maintenance on pipes.

A program that supplies the platform, hardware, deployment and training at no cost, with no match and no expiration, fills a gap the federal program was never well suited to fill.

The trade-offs to weigh before enrolling

Free from a vendor is still not the same as free from a public agency, and boards should go in with clear eyes.

Vendor concentration. Accenture agreed in June 2026 to buy a majority stake in Dragos, part of an OT security push reported at about $4.1 billion. The foundation's deployment partner and its software provider are now effectively the same corporate family. Utilities should expect a capable, integrated stack, and they should also expect that a future procurement for managed services, incident response or a network redesign will start from a Dragos-and-Accenture baseline. That is not disqualifying, but write it into your board memo honestly.

Data and visibility. Neighborhood Keeper shares anonymized threat data across participants. Most utilities will see that as a benefit. Some boards, municipal attorneys or state regulators will want to read the terms first, particularly public utilities subject to public-records laws.

Capacity still matters. The foundation trains staff, but it cannot hire them for you. A platform that raises alerts nobody reads produces a false sense of security. Before enrolling, decide who will own the alerts, and whether a state rural water association, a county IT department or a managed provider will back them up.

Phase one is capped. Five hundred slots against 50,000 eligible utilities means early enrollment matters. Lee wrote that several other companies plan to contribute millions more, with announcements expected in the coming months. The foundation has not published how it will prioritize if demand exceeds capacity.

How to stack it with remaining public money

The smartest move for most eligible utilities is to treat the foundation as the core of their monitoring stack and point what public money remains at everything the foundation does not cover:

• Network segmentation and remote-access hardening. Removing PLCs from public cellular addresses, adding secure remote access gateways and putting multifactor authentication in front of SCADA logins are capital projects. They suit any remaining SLCGP pass-through, state water cyber programs (New York has run dedicated rounds) and, in many states, drinking water and clean water state revolving funds, which can treat cybersecurity as an eligible infrastructure cost. Check your state's intended use plan.
• Assessments as match. If your state still has SLCGP pass-through dollars, an Accenture-led initial assessment and SANS training received through the foundation may help document needs and capacity. Ask your state administrative agency before assuming in-kind vendor services can count toward match; they usually cannot unless the agency approves.
• Electric and gas cooperatives should coordinate with their generation-and-transmission cooperative or state association, which may already run shared security operations that the Dragos deployment can feed.

The foundation turns the least fundable part of utility cybersecurity, ongoing monitoring and training, into a free service. That frees scarce grant dollars and board-approved capital for the physical and architectural fixes no one is giving away.

Related reading

For the end of the federal program, see our analyses of the final SLCGP tranche and its 40 percent match and the exhausted IIJA pool and stalled PILLAR Act.

If your utility is building a cybersecurity capital request for a revolving fund, a state program or a board vote, Granted can help you turn an assessment into a fundable project narrative and budget.