Accenture, Dragos and the SANS Institute have set up a non-profit with roughly $10m in funding and services to give hundreds of small US utilities free operational technology security. The model is aimed squarely at America for now, but it raises an awkward question for the UK: who pays to protect the smaller operators that keep water and power flowing?
What happened
On 20 October 2026, at a utility security roundtable in Columbus, Ohio, hosted with American Electric Power subsidiary Ohio Power Company, Accenture, Dragos and the SANS Institute announced the Community Cyber Resilience Foundation. Between them the three are pledging around $10m in cash and in-kind services to start, while Elastic is backing the effort with the log storage and search engine that underpins the Dragos Platform.
Phase one aims to onboard up to 500 utilities. Eligibility is limited to US water, wastewater, electric and natural gas providers with annual revenue under $100m. According to the partners, more than 97% of US utilities fall below that line, which they put at over 50,000 organisations. These come on top of the 100-plus utilities already in the Dragos Community Defense Program, its free software scheme launched in December 2023.
The Record reports that no federal or state government is involved, and that participants face no time limit on access. Dragos chief executive Robert M. Lee wrote that several more companies intend to contribute “millions in resources” in the coming months, and that the company is looking at taking the model to other countries once phase one proves itself.
How it works
The interesting part is not the software giveaway but the admission of why it fell short. Lee is candid that many utilities signed up for free tooling and then stalled: there was nobody to install it, no server to run it on, no baseline assessment to start from and no spare hours to keep using it. His conclusion is that access was never the bottleneck. Adoption was.
The foundation therefore bundles four things that small operators usually cannot buy separately:
- Technology: the Dragos Platform for OT asset visibility, vulnerability management and threat detection, with Elastic supplying the data layer.
- Hardware: donated funds pay for the appliances and infrastructure needed to run the platform on site.
- People: Accenture provides in-kind assessments, deployment, configuration, integration and ongoing support.
- Skills: SANS ICS/OT courses and GIAC certifications for utility staff, plus a peer community where operators can compare notes.
Lee also explains the commercial context. When Accenture took its majority investment in Dragos, he says, one of his first conversations with Accenture chair and chief executive Julie Sweet was about serving utilities that cannot afford to be customers.
The backdrop is a sharp rise in attacks on small operators. The partners cite a campaign that hit more than 100 US water systems across over a dozen states, and Lee’s post also points to more than 700 supermarkets disrupted through internet-connected control systems, alongside long-running state intrusions into electricity and gas networks.
Why it matters for UK organisations
Nothing in the foundation applies to British operators today: phase one is US-only, and the partners have given no timetable for expansion. But the problem it targets is not uniquely American, and Lee himself says the same pattern exists in many countries.
The UK’s large water and energy companies are regulated operators with security teams, regulator scrutiny under the NIS regime and, for the most part, budgets to match. The harder cases are further down the chain: smaller generators, community energy schemes, heat networks, private water supplies, local authority sites and the managed service providers and integrators that look after their control systems. Many of these organisations resemble the US utilities Dragos describes, with no dedicated security staff and spending decisions that pass through boards, councils or regulators who are not OT specialists.
The Cyber Security and Resilience Bill is set to widen the range of organisations, including suppliers, that fall under NIS-style duties. Extending obligations is one thing; funding the monitoring kit, assessments and skills needed to meet them is another. The US approach, in which a services giant and the OT firm it holds a majority stake in absorb the early costs while building goodwill and a pipeline, is one possible answer. It is also, inevitably, a route to platform lock-in for whichever vendor pays first, and UK policymakers and operators should weigh that before welcoming a copy.
Accenture’s stake in Dragos also puts a global consultancy directly into OT security delivery; UK providers chasing water and energy work should expect bundled tooling, deployment and training offers to become the norm.
Expert view
In my experience testing industrial environments, Lee’s diagnosis is right. Smaller sites rarely fail because nobody has heard of network monitoring. They fail because the one engineer who understands the PLCs is also on call for the pumps, nobody has a current asset list, and the remote access path set up by an integrator years ago was never reviewed. Giving that site a licence key changes very little. Giving it someone to deploy the sensor, a baseline assessment and training for the operator changes a great deal.
I would add two cautions. First, visibility is only useful if somebody acts on the alerts; a dashboard no one watches is expensive decoration. The peer community and ongoing Accenture support will matter more than the headline sum. Second, philanthropic schemes depend on the commercial appetite of their backers. Utilities that join should treat the platform as a capability to own and understand, not a service that will always be there.
For UK operators, the basics that most reduce OT risk are cheap compared with an incident, and most can be started with existing staff.
What to do now
- Build an asset inventory: list every controller, HMI, historian and remote access route, including those managed by integrators. You cannot defend what you have not catalogued.
- Close internet exposure: check that no control system interfaces are reachable directly from the internet. This maps to the Cyber Essentials firewall and secure configuration controls.
- Lock down remote access: require multi-factor authentication, named accounts and time-limited sessions for vendors and staff, in line with Cyber Essentials user access control.
- Segment IT from OT: make sure a compromised office laptop cannot reach plant networks, and test that the separation actually holds.
- Use the free resources available: NCSC guidance and the Cyber Assessment Framework give smaller operators a structured starting point without a large budget.
- Invest in people: fund OT security training for the engineers who run your sites, and agree in advance who responds when monitoring raises an alarm.
- Press suppliers: ask integrators and MSPs how they secure their access to your systems, and write the answers into contracts.
Bottom line
The Community Cyber Resilience Foundation is a candid recognition that free security software does not protect small utilities on its own; people, hardware and training do. It is US-only for now and carries obvious commercial benefits for its backers. For the UK, the more pressing point is that as regulation reaches smaller operators, somebody will have to pay for them to comply, and that debate has barely started.
Sources
- Accenture: Accenture, Dragos and SANS Institute Launch Foundation to Strengthen Cyber Defenses for Under-Resourced U.S. Utilities
- Dragos: Supporting Our Underserved Utilities: Launching the Community Cyber Resilience Foundation
- The Record: Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
- Pulse 2.0: Accenture, Dragos And SANS Commit $10 Million To Utility Cybersecurity Foundation
