The IT Nerd

Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act, which would give the EPA explicit authority to conduct cybersecurity assessments, require corrective actions and establish security standards for water systems alongside CISA and NIST.

The bill would also authorize $300 million annually for water infrastructure upgrades, require risk assessments for large systems and expand mandatory cyber incident reporting.

The legislation follows coordinated cyberattacks against dozens of community water systems across at least 12 states. Separately, DEF CON Franklin and the National Rural Water Association launched the Water Watch Center to provide cybersecurity services to utilities serving fewer than 10,000 people, a group representing 91% of the roughly 50,000 community water systems nationwide. Five cybersecurity firms will provide managed detection and response services, building on a two-year pilot involving nearly 450 volunteer cybersecurity experts across seven states.

Damon Small, Board of Directors, Xcape, Inc.:

   “The Water Cyber Shield Act attempts to address a major regulatory gap by granting the Environmental Protection Agency explicit authority to enforce baseline security standards and allocate $300 million annually for utility upgrades, but federal dollars alone cannot fix this sector’s systemic fragility. Spread across roughly 50,000 community water systems nationwide, that funding yields a negligible $6,000 per facility, an amount that barely covers an initial architecture audit, let alone operational technology overhauls.

   “The industry already possesses robust reference architectures and standards for protecting control systems, so the primary barrier is execution rather than a lack of guidance. Furthermore, claiming that capital injections will solve the threat ignores the reality that maintenance windows are rare in continuous operational technology environments. Rather than waiting on Congressional appropriations, security leaders and asset owners must immediately execute foundational controls: strictly isolate industrial control networks from corporate IT, eliminate publicly exposed management interfaces to the Internet, enforce multi-factor authentication, and replace default device credentials.

   “Critical Takeaways

• Funding dilution: Allocating $300 million across 50,000 utilities yields $6,000 per facility, failing to cover basic operational technology remediation.
• Operational reality: Standards already exist, but infrequent maintenance windows choke security execution far more than funding deficits.
• Immediate action: Operators must enforce network segmentation, eliminate Internet-facing control systems, and rotate default credentials immediately.

   “Operational security standards already exist; what utilities lack is not awareness, but the uptime flexibility to actually apply patches.”

Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:

   “While it’s always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it’s likely a far reach from what will actually happen. The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here https://www.epa.gov/cyberwater/cybersecurity-sanitary-surveys) 

   “I hate to say it, but historically speaking, this is likely to fail before making it to a vote, just like all other bills that have been attempted to improve water cybersecurity in the past.  If we look at just the 118th and 119th Congress, we have had 9 bills introduced, as far as I’m aware, that pushed language that would have focused on either providing monetary assistance for, directly enforcing industry standards, and/or regulation around cybersecurity for water systems and CI, each varying in degree of what they would have provided and who they would have protected (rural vs non), but of those 9, all from within the 118th congress died within committees and without comments or markup, meaning no one even bothered to fight for them to get a vote across. Technically, the 4 from this congress (119) are still “pending’ but considering no movement has occurred on them, they will likely reach the same fate. 

• https://www.congress.gov/bill/118th-congress/house-bill/3809 – H.R.3809 – Cybersecurity for Rural Water Systems Act of 2023 
• https://www.congress.gov/bill/118th-congress/house-bill/7922–  H.R.7922 – To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector. 
• https://www.congress.gov/bill/118th-congress/senate-bill/5335 – S.5335 – Rural Prosperity and Food Security Act of 2024 
• https://www.congress.gov/bill/118th-congress/house-bill/10389 H.R.10389 – Water Authority Cybersecurity Protection Act 
• https://www.congress.gov/bill/118th-congress/house-bill/10483 – H.R.10483 – Water Cybersecurity Enhancement Act 
• https://www.congress.gov/bill/119th-congress/house-bill/2109 – H.R.2109 – Cybersecurity for Rural Water Systems Act (attempt 2 of the Cybersecurity for Rural Water Systems Act)
• https://www.congress.gov/bill/119th-congress/house-bill/2344 –  H.R.2344 – Water ISAC Threat Protection Act 
• https://www.congress.gov/bill/119th-congress/house-bill/2594  – H.R.2594 – To establish a Water Risk and Resilience Organization to develop risk and resilience requirements for the water sector. 
• https://www.congress.gov/bill/119th-congress/senate-bill/1549 – S.1549 – Water Cybersecurity Enhancement Act of 2025

   “Ultimately, Congress has been unreliable in pushing forward regulation and standards towards CI for quite some time, and the mantle thankfully has been picked up by private organizations and security practitioners who wish to have a safer and more secure water source. Even though it shouldn’t be dependent on the goodwill of private citizens to protect public infrastructure. Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn’t the first time we have had this situation happen before.  So, my fingers are crossed, but I’m not holding my breath.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “I think this type of legislation is important, but it’s also long overdue. People have known about the security weaknesses in critical infrastructure, especially within municipalities, for well over a decade. Unfortunately, this is another example of a reactive approach to cybersecurity. Too often, meaningful action doesn’t happen until the damage has already been done.

   “My concern is that by the time these programs are fully implemented and organizations begin benefiting from them, many of the municipalities with the same vulnerabilities that enabled recent attacks will have already been compromised. It’s a positive step, but it’s arriving years after the underlying risks were widely understood. This is the kind of investment that should have been made more than a decade ago, not after the attacks have already demonstrated the consequences of inaction.”

While addressing critical infrastructure is long overdue, the time to act is now as the threat is real and present. Will lawmakers act on that threat is the real question.

U.S. cybersecurity officials are considering significantly shortening deadlines for fixing critical vulnerabilities in federal systems, reducing the standard remediation window from two to three weeks down to as little as three days, according to Reuters. 

The move follows concerns that advanced AI models, including Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber, can rapidly identify and exploit vulnerabilities, compressing the time between disclosure and active exploitation from weeks or days to potentially hours.

The proposal is being discussed by leaders at CISA and the Office of the National Cyber Director.

Doc McConnell, Head of Policy and Compliance, Finite State:

   “It makes sense that CISA wants to promote a greater sense of urgency in the patching process. Organizations with open vulnerabilities that have been exploited in the wild are carrying real risk, and they should patch with urgency. But it takes more than shorter deadlines to improve security, especially for OT and IoT devices.

   “Companies need real-time visibility into whether vulnerabilities are present in their products through continuous monitoring and detailed, verified software bills of materials. They also need tested, trustworthy, automated processes for applying security updates as soon as they’re available and keeping their customers up-to-date.

   “A three-day deadline is going to be too fast for many organizations that are still relying on manual, ad hoc processes, and it’s going to be plenty of time for attackers that are relying on modern, automated tooling to scale their attacks.”

Noelle Murata, Chief Operating Officer at Xcape, Inc.

   “The proposal to slash federal patch deadlines from weeks to just 72 hours represents a pivot to “Hyper-Accelerated Defense.” This policy shift, being weighed by CISA and the Office of the National Cyber Director, is a direct admission that the traditional 14-day remediation window has been rendered obsolete by the arrival of “Cyber-Permissive” AI models like OpenAI’s GPT-5.4-Cyber and Anthropic’s Mythos.

   “These advanced models have fundamentally compressed the “N-day” window – the gap between a patch release and its mass exploitation. Where human researchers once took days to reverse-engineer a patch and develop an exploit, these AI systems can now identify exploit primitives and generate proof-of-concept code in a matter of hours. For federal agencies and critical infrastructure, this means “Cyber Hygiene” is no longer a periodic administrative task; it is now a real-time race against automated adversaries.

   “The implications for leadership are clear: hitting a 3-day target is humanly impossible without Autonomic Security. Organizations must transition away from manual patch cycles and toward automated, AI-driven CI/CD pipelines that can test and deploy updates at machine speed. While the 72-hour mandate may currently focus on federal systems, it will rapidly become the de facto benchmark for any entity managing critical data. In the 2026 threat landscape, defense is no longer measured in weeks of policy, but in hours of automation.

   “Key Takeaways for the 72-Hour Window

• AI-Driven Exploitation: Models like Mythos can autonomously perform binary analysis, shortening the time-to-exploit from days to hours.
• Infrastructure Stress Test: Agencies must move from “manual review” to “automated testing” to meet a 3-day deadline without breaking legacy environments.
• New Compliance Baseline: Expect the CISA Known Exploited Vulnerabilities (KEV) catalog to be the primary driver for these high-speed mandates.

   “Patching in three days sounds impossible until you realize that GPT-5.4 doesn’t take weekends, doesn’t need coffee, and already has a working exploit for the bug you just heard about ten minutes ago.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Cutting the default KEV remediation window from two weeks to three days is the right move and not a second too late. The two-week window was built for a threat landscape where exploitation required time and large amounts of resources. That landscape no longer exists.

   “LiteLLM’s CVE-2026-42208 was exploited within 36 hours of advisory publication earlier this year. When the advisory itself becomes the exploit development kit and AI models can parse vulnerable code paths and generate working exploitation faster than most organizations can schedule a change window, three days is generous. Attackers are routinely inside systems before patches exist.

   “Three days is ambitious, but defenders are not operating with the same constraints they had even 12 months ago. The same AI capabilities compressing the offensive timeline are available to the defensive side. Documentation review, compatibility testing, compliance validation, and change management workflows that used to justify longer remediation windows can all be accelerated by the same technology driving the threat. Organizations that invest in AI assisted patching and deployment pipelines will find three days achievable. The remediation toolbox is expanding at the same rate as the threat.”

Sunil Gottumukkala, CEO, Averlon:

   “The intent is absolutely right. AI is compressing the time between vulnerability disclosure and exploitation, and defenders cannot operate on old remediation timelines forever. But moving from weeks to three days is aspirational unless agencies also get the operational maturity, automation, asset visibility, and change-management capacity needed to execute that quickly. Many agencies already struggle to meet today’s deadlines, so simply shortening the clock does not automatically reduce risk.

   “The more practical path is to combine urgency with exploitability-based prioritization. CISA should push agencies to determine whether a KEV vulnerability is actually reachable and credibly exploitable in their specific environment, and then require the fastest action on those systems. FedRAMP’s recent vulnerability management direction is a good model: it explicitly considers reachability, exploitability, criticality, potential impact, and mitigation when determining urgency. That is the kind of context defenders need.

   “The threat is real, and AI will make exploitation faster. But guidance has to be achievable. Otherwise, agencies will end up chasing deadlines on paper while the most exploitable paths in their environments remain exposed.”

Honestly, I do not think there is really a choice here. Things are moving so fast that unless you remediate vulnerabilities quickly, you simply expose yourself to getting pwned by any threat actor out there. And that is not a good place to be.

U.S. lawmakers and industry leaders are evaluating whether data centers should be designated as a standalone critical infrastructure sector, following a House Homeland Security cyber subcommittee hearing on April 29, 2026. The discussion reflects concerns that current federal frameworks do not clearly assign responsibility for securing data centers or coordinating responses to incidents.

Officials and experts noted that data centers are increasingly targeted by adversaries and are central to cloud services, financial systems, healthcare data, and communications infrastructure, with three providers—Amazon Web Services, Microsoft Azure, and Google Cloud—accounting for 63% of the market.

The hearing also highlighted recent incidents involving physical attacks on data centers, alongside ongoing cyber risks, prompting proposals to create a dedicated coordinating body or sector designation to improve collaboration between government and industry. No formal decision has been made, and discussions are ongoing regarding how federal agencies should structure oversight and protection efforts.

Doc McConnell, Head of Policy and Compliance, Finite State:

   “There is no denying that data centers are becoming more critical to the functioning of our existing critical infrastructure, including healthcare, communications, energy, and financial services. And there is likely value in closer coordination among data center owners to collectively share risks and respond to incidents.

   “But the designation of data centers as critical infrastructure does not, in and of itself, solve this problem. The 2024 National Security Memorandum on critical infrastructure established a shared responsibility model between the public sector and private owners and operators. Building that collaboration, collectively identifying risks, pooling resources to address them systematically — that’s where the real value comes from.

   “If the federal government moves to make this designation, they must follow up by leading a national effort with clear outcomes, action plans, and resource commitments from both the public and private sectors. Otherwise, this won’t lead to the strengthened security and resilience that we need.”

Matt Wyckhouse. Founder & CEO,Finite State:

   “Data centers are no longer just IT facilities — they are strategic infrastructure underpinning AI, cloud services, financial systems, healthcare, communications, and national security. Treating them as critical infrastructure makes sense, but the designation itself is only the starting point.

   “Recent conflict-linked attacks on data center infrastructure in the Middle East, including reported Iranian drone strikes on cloud facilities in the UAE and Bahrain, show that this is no longer a theoretical risk. Data centers are becoming part of the modern battlespace, where cyber operations, physical attacks, supply-chain compromise, and geopolitical coercion can converge.

   “The bigger issue is that data center risk is not limited to physical security or perimeter cyber defenses. These environments depend on an enormous technology supply chain: servers, networking equipment, firmware, cooling systems, access-control systems, operational technology, cloud software, and the vendors who build and maintain all of it. A serious compromise may not begin with a front-door attack on a hyperscaler; it may begin much earlier in the lifecycle, through a vulnerable component, manipulated firmware, insecure update mechanism, or opaque supplier relationship.

   “If policymakers move toward a standalone data center critical infrastructure sector, the focus should be on measurable assurance: knowing what technology is inside these environments, where it came from, how it was developed, whether it contains known vulnerabilities or exploitable weaknesses, and whether operators can produce defensible evidence of security and resilience. We need to move beyond voluntary checklists and toward continuous, evidence-based assurance across the full supply chain.

   “Data centers are becoming the factories of the AI economy. If we are going to depend on them for national-scale compute, we should secure them with the same seriousness we apply to energy, telecommunications, defense, and financial infrastructure.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Data centers are already critical infrastructure in practice. The policy debate is just catching up to operational reality. These facilities are no longer passive real estate where servers happen to sit. They have become part of the operating layer of the modern economy.

   “When a major facility or shared dependency fails, the impact does not stay neatly inside one company’s environment. It can become a broader continuity problem very quickly. A standalone designation can help, but only if it turns vague concern into clear ownership and a response model that works when the incident has outgrown a customer support ticket.

   “The AI buildout makes this harder to ignore. Training and inference depend on concentrated infrastructure that has to keep working under pressure. That concentration creates efficiency, but it also places more national capacity inside a smaller number of highly important facilities. The threat model is no longer just cyber either. Physical disruption, geopolitical pressure, operational technology compromise, and cloud outages increasingly converge at the same layer.

   “The recurring theme in Washington is naming something critical without building the machinery needed to protect it. A sector label only matters if it comes with practical coordination and federal partners that operators trust during a crisis. If agencies like CISA lose capacity while data centers become more strategically important, policymakers trade substance for ceremony.”

John Carberry, Solution Sleuth, Xcape, Inc.:

   “The move by Congress to designate data centers as a standalone critical infrastructure sector marks a long-overdue transition in federal risk management. Internet-based services have evolved from business conveniences into safety-critical utilities; however, the current regulatory framework remains bifurcated between the IT and Communications sectors. This oversight gap is increasingly untenable given that three hyperscalers – AWS, Azure, and Google Cloud – now control 63% of the market. This concentration creates a systemic single point of failure where a coordinated cyber campaign or physical sabotage could trigger cascading collapses across healthcare, finance, and government operations.

   “Formalizing this 17th sector would mandate stricter incident reporting and create a dedicated Sector Coordinating Council (SCC) to align federal response with the “foundational layer” of the modern economy.

   “For leadership, this shift signifies that cloud resilience will soon face the same federal scrutiny as the bulk power system or water utilities. It is a necessary acknowledgment that in 2026, data center availability is no longer a localized operational concern, but a prerequisite for national security and public safety.

   “In 2026, treating data centers as “non-critical” is like calling the power grid an optional hobby for people who enjoy light bulbs.”

I am not sure why this is a conversation because in my mind we’re way past the point where datacenters should be considered critical. Or put another way, this conversation should have happened years ago. Clearly congress is late to the party here.