Eligibility covers US-based water, wastewater, electric and natural gas utilities with less than $100 million in annual revenue, a group the companies say accounts for 97% of utilities. Participants will get Dragos tools that identify devices on their network and flag vulnerabilities, with Accenture handling deployment, configuration and ongoing support. SANS will train employees, and Elastic will provide technical support to help scale the programme.

The initiative follows breaches of more than 100 water utilities across the US, and government agencies continue to warn of Chinese and Russian cyberattacks targeting energy utilities and telecoms. Dragos CEO Robert Lee said cybercriminals and nation-states are "aggressively targeting utilities, attacking the operational environments that provide life-sustaining services to millions of Americans."

There is no government involvement in the programme, and it arrives as federal efforts to improve utility cybersecurity have stagnated, leaving states to build their own frameworks. It is not the only industry response: in July, after the water utility attacks, the National Rural Water Association launched its own scheme with five managed detection and response providers sharing threat information and patch data.

Members will also be able to share best practices with one another, and there is no time limit on access. Dragos said other companies are already expressing interest in joining, and the first phase of 500 utilities may expand depending on its success.