Why physical security, infrastructure resilience, and the changing threat environment demand a different approach to data center protection.
When we talk about Data Center Security, the conversation often moves directly toward cybersecurity, ransomware, network vulnerabilities, and the protection of information. These are legitimate concerns and certainly deserve the attention they receive. However, some of the latest developments involving data centers around the world should remind us that protecting the information inside a facility is only part of the equation. The buildings, power infrastructure, cooling systems, equipment supply chains, and people supporting these operations are just as important to keeping a data center operational. As these facilities become larger, more complex, and increasingly critical to our economy, we need to broaden the conversation about what we are protecting and how we approach the design of security.
Over the past several months, we have seen developments that should cause owners, operators, security professionals, architects, and engineers to reconsider how they approach data center protection. Drone attacks have damaged data center infrastructure, organized criminal groups have targeted shipments of valuable computing equipment, and government agencies have continued to warn about cyberattacks targeting industrial control systems. At the same time, the rapid expansion of artificial intelligence is driving the construction of larger facilities with enormous electrical and cooling requirements. All of this is creating a security environment that extends well beyond the traditional data hall.
I have spent a significant part of my career working with data centers and other mission-critical facilities, and one of the recurring challenges I have seen is the tendency to separate physical security, cybersecurity, and facility operations into different areas of responsibility. We spend considerable time protecting network infrastructure and controlling access to servers, but sometimes overlook the fact that a relatively simple physical event involving electrical distribution, cooling equipment, or communications infrastructure can accomplish what a sophisticated cyberattack might otherwise be attempting to achieve. The industry has made tremendous progress in physical security, incorporating multiple layers of access control, perimeter protection, surveillance, intrusion detection, and security personnel. The question we should be asking is whether those systems are designed around the threats we face today or around assumptions established years ago.
One of the more significant developments during 2026 has been the reported targeting of commercial data center infrastructure during military conflicts. Earlier this year, Amazon Web Services facilities in the Middle East sustained damage from attacks associated with regional hostilities. Subsequent reporting indicated that the damage affected infrastructure supporting multiple availability zones and created restoration challenges that could not simply be resolved through traditional redundancy. In October, additional reports described drone attacks against Yandex data center facilities in Russia, including locations supporting cloud services and artificial intelligence operations. These incidents illustrate something the industry needs to recognize. Data centers are no longer viewed exclusively as commercial real estate containing computing equipment. In certain circumstances, they have become strategic infrastructure supporting economic activity, communications, research, and national interests.
We should not assume that every data center in North America faces the same threat environment as facilities located near an active conflict. However, these incidents demonstrate that physical destruction or disruption of computing infrastructure is a credible threat under certain conditions and belongs in a comprehensive risk assessment. From a physical security perspective, this introduces considerations extending beyond fencing, cameras, and card readers. The location of electrical substations, generator yards, fuel storage, cooling equipment, and other critical infrastructure can dramatically influence the consequences of an attack. A facility may have excellent perimeter protection and still leave essential equipment exposed to threats originating outside the protected property. Security professionals should be considering how critical infrastructure is positioned, whether adequate standoff distances exist, what equipment can be observed or approached from public areas, and how quickly a facility can identify and respond to an abnormal event. The larger issue is that security cannot be designed exclusively around someone attempting to enter a building. There are ways to disrupt a data center without ever crossing its perimeter.
Another issue receiving attention involves the organized theft of equipment destined for data centers. Recent reports have described sophisticated criminal operations targeting shipments of servers and other high-value technology equipment. These are not simply cases of someone breaking into a parked trailer. Investigators have described operations involving compromised logistics accounts, fraudulent transportation identities, manipulated tracking information, and coordinated efforts to divert shipments. Think about what this means for a large data center project. We may spend months designing the physical security of a facility, carefully controlling the delivery entrance, establishing contractor access procedures, and specifying surveillance coverage for loading docks. Yet millions of dollars in equipment may have traveled across the country with far less oversight than it will receive once installed.
The consequences of equipment theft are not limited to the immediate financial loss. A missing shipment of specialized electrical equipment, networking hardware, or computing components can disrupt construction schedules, delay commissioning, and create contractual problems for operators waiting to bring capacity online. Some equipment has significant replacement lead times, particularly when projects require specialized configurations. This is where security planning should begin much earlier in the project lifecycle. Contractors, equipment suppliers, transportation providers, integrators, and owners should understand who is responsible for maintaining custody of critical equipment from shipment through final installation. Physical security also has a role in protecting equipment integrity. A shipment that has been diverted, tampered with, or substituted creates concerns extending into cybersecurity and operational reliability. The security perimeter, in this case, begins long before the equipment reaches the property.
The construction phase deserves particular attention because it introduces an environment very different from the one envisioned in the final security design. A completed data center may have sophisticated access control, monitored intrusion detection, established security procedures, and clearly defined authorization requirements. During construction, that same property may have temporary fencing, changing entrances, incomplete surveillance coverage, and hundreds of contractors moving between buildings and work areas. As equipment arrives, the value of materials stored on site can increase dramatically. Electrical switchgear, copper, network components, cooling systems, generators, and other specialized equipment can become attractive targets for theft, vandalism, and potentially deliberate interference.
I believe construction security should be considered an early phase of the permanent security program rather than an unrelated temporary service. Temporary cameras, mobile credentials, contractor identification, controlled delivery areas, and equipment tracking should be designed with the eventual operational environment in mind. During installation and commissioning, contractors and service personnel may receive permissions that would never be appropriate during normal operations. Engineers need access to mechanical and electrical spaces. Integrators need access to controllers, network equipment, and security management platforms. Commissioning personnel may require access across multiple operational areas. Once the facility transitions into operation, those credentials and permissions need to be reviewed, modified, or removed. The same applies to network accounts, service credentials, temporary configurations, and emergency overrides established during construction. The transition from construction to operation is a security event in its own right, and it should be managed accordingly.
One of the developments I find particularly concerning is the continued targeting of operational technology. Government agencies, including CISA and the FBI, have issued warnings concerning malicious activity directed at industrial control systems and internet-connected operational equipment. These advisories describe attacks that can manipulate equipment configurations, interfere with operations, and potentially create physical consequences through digital access. For data centers, this is significant because the infrastructure supporting a modern facility is increasingly dependent on interconnected control systems. Building management systems, electrical power monitoring, cooling equipment, generators, environmental monitoring, and other operational technologies may all rely on network connectivity and remote management.
Consider a facility with substantial redundancy in its computing environment. Servers may be distributed across multiple rooms, electrical systems may have backup generation, and networking infrastructure may support multiple paths. Yet if an attacker can interfere with cooling operations or disrupt the controls associated with electrical distribution, those redundancies may not prevent an outage. This is an area where physical security and cybersecurity need to be designed and operated together. A technician accessing a mechanical room may be using a perfectly valid credential. At the same time, that technician, or someone using the technician’s compromised account, may be making unexpected changes to equipment controls. A properly designed security environment should provide the ability to investigate both sides of that activity. Who entered the room? When did they arrive? Was their access authorized for that particular maintenance window? What happened on the control network during the same period? Did equipment configurations change, and were those changes associated with an approved work order? Not every organization will have the technology or operational maturity to correlate all this information automatically, but it is a direction that deserves serious consideration.
Security professionals spend considerable time discussing unauthorized entry, and for good reason. However, one of the more challenging threats in a modern data center involves individuals who are already authorized to be there. Contractors, remote-hands technicians, equipment manufacturers, maintenance personnel, and customer representatives may all require access to restricted areas. Depending on the facility, that access can involve everything from a common mechanical space to an individual cabinet containing sensitive equipment. The challenge is determining how much access is necessary and how long it should remain active. A contractor who requires access to a specific room for a two-day project should not retain those permissions indefinitely. A technician assigned to one customer cage should not automatically receive authorization to adjacent cages. Likewise, a maintenance vendor who needs access to an electrical room should not be granted broad access throughout the facility simply because it is easier to administer.
This is where the design of an access control system becomes particularly important. We have the technology to establish increasingly granular access permissions, define schedules, integrate identity management, and maintain detailed records of credential activity. However, the effectiveness of those capabilities depends on the operational procedures established by the owner. There is also a balance to consider. Security systems can become so complicated that administrators struggle to maintain accurate permissions, resulting in excessive exceptions, shared credentials, or unnecessary privileges. More access control points do not automatically translate into better security. The objective should be to provide the appropriate level of access to the appropriate individual, for the appropriate reason, and only for the time required. Video surveillance can provide important supporting information, especially around high-value equipment, loading docks, controlled corridors, and critical infrastructure rooms. However, surveillance should complement rather than replace effective access control procedures. A recording of an unauthorized action may be valuable during an investigation, but preventing or identifying inappropriate access before damage occurs is a far better outcome. The risk is not always that someone will defeat the security system. Sometimes the system grants exactly the access that creates the opportunity.
In my book, Data Center Security: The Blueprint for Resilient Infrastructure, I discuss the importance of looking at data center security from the supporting infrastructure all the way to the rack. That approach becomes even more relevant as we consider the threats emerging today. A data center is dependent on far more than its computing equipment. Electrical power must reach the facility, cooling must remove tremendous amounts of heat, telecommunications infrastructure must remain available, and personnel must be able to operate and maintain the supporting systems. We have become very good at designing redundancy within the facility, but redundancy does not automatically eliminate vulnerabilities outside the building.
An electrical substation may be located beyond the secure perimeter. Telecommunications pathways may share common routes. Fuel supplies may depend on outside transportation networks. Cooling infrastructure may contain exposed equipment that is far easier to approach than the data hall itself. Uptime Institute’s 2026 Annual Outage Analysis reinforces the importance of these dependencies, identifying power as a leading cause of significant outages and highlighting the considerable financial consequences of operational disruptions. Although many outages result from equipment failures or human error rather than deliberate attacks, the same vulnerabilities can be exploited intentionally.
From a design perspective, this is where physical security must move beyond a checklist of cameras, card readers, and fencing. The security assessment should examine the entire property and the infrastructure supporting it. Can an unauthorized vehicle approach a critical transformer? Are generator and fuel systems adequately protected? Can individuals reach exposed cooling equipment without encountering an effective security barrier? Are critical communications pathways identified, and are alternative routes available if one is damaged? Some of these concerns can be addressed through physical barriers, vehicle mitigation measures, surveillance, lighting, and intrusion detection. Others require coordination with electrical engineers, mechanical engineers, utility providers, network architects, and facility operators. There is no single security product that solves these problems. The solution is a coordinated design that recognizes how each part of the facility supports the others.
The rapid development of artificial intelligence is adding another level of complexity. AI-focused data centers are being constructed with substantial computing capacity, specialized processors, high-density electrical systems, and advanced liquid-cooling infrastructure. These facilities represent enormous investments, and the concentration of high-value equipment makes them attractive targets for theft, sabotage, and other forms of disruption. At the same time, increased electrical demand and greater dependence on specialized cooling create operational requirements that need to be understood during security planning. Equipment density, thermal loads, cooling distribution, and electrical infrastructure may place important systems in locations that require new approaches to surveillance, access control, and protective barriers.
Liquid-cooling infrastructure, for example, introduces mechanical distribution equipment whose failure can affect large concentrations of computing assets. From a security standpoint, the concern is not simply whether someone can enter the server room, but whether unauthorized individuals can access valves, pumps, distribution units, control panels, or other components capable of affecting operations. The industry is also exploring artificial intelligence for security applications, including video analytics, anomaly detection, automated investigations, and the correlation of events across multiple systems. These technologies may improve situational awareness, particularly across very large campuses. However, we should be careful not to assume that adding AI to a security system automatically makes a facility more secure. Analytics cannot correct poor camera placement, an improperly designed perimeter, excessive credential permissions, or the absence of a meaningful response procedure. Technology should support the security design, not become a substitute for it.
One of the most persistent challenges I have encountered throughout my career is the separation between the people who design a facility and the people who eventually operate it. Architects, engineers, security consultants, integrators, contractors, and facility operators often participate at different stages of a project. Each group brings important expertise, but unless there is meaningful coordination, decisions made in one area can create vulnerabilities in another. A security consultant may specify excellent surveillance coverage without knowing that a future mechanical installation will obstruct critical camera views. An electrical engineer may design equipment placement around operational requirements without considering vehicle access or intentional physical damage. An access control system may be designed to protect a restricted room without adequately addressing what happens when communications are lost during an emergency. These issues are much easier to resolve during design than after construction.
The same principle applies to Crime Prevention Through Environmental Design, or CPTED. Although CPTED is often associated with public spaces, commercial properties, and community environments, its principles have practical applications in mission-critical infrastructure. Natural surveillance, controlled approaches, territorial reinforcement, appropriate lighting, environmental maintenance, and the thoughtful arrangement of buildings and equipment can all contribute to a more secure data center campus. Those measures should work alongside electronic security systems rather than being considered separately. Landscaping, property grading, fencing, vehicle barriers, and building placement can influence whether an unauthorized individual has an opportunity to approach critical infrastructure without being observed. Similarly, the location of loading docks, contractor entrances, and maintenance corridors can either support or complicate security operations. The goal should be to design an environment where physical security is supported by the architecture, not simply attached to it after the buildings are finished.
I would also encourage owners and security consultants to spend more time discussing abnormal operating conditions during design reviews. We routinely evaluate how systems function under normal circumstances, but some of the most important security decisions involve what happens when something goes wrong. How does the access control system operate when network communications fail? How are emergency permissions granted and documented? Can video surveillance remain operational during a partial power failure? How do security personnel verify someone requesting access during an outage? What happens if a critical equipment room becomes inaccessible during an emergency? These are operational questions, but the answers often depend on decisions made long before the first piece of equipment is installed.
The threats we are seeing in 2026 should encourage the data center industry to broaden its understanding of security. The challenge is no longer limited to keeping unauthorized people out of buildings or protecting data from cyber intrusion. It involves protecting an interconnected environment where people, equipment, infrastructure, networks, and operational processes all contribute to availability. A criminal organization may never enter a data center but can disrupt a project by stealing critical equipment before delivery. A cyber threat actor may never gain access to a customer server but could interfere with infrastructure supporting cooling or electrical distribution. An authorized contractor may be able to reach equipment they no longer have a legitimate reason to access. A deliberate physical attack may be directed at infrastructure located outside the building rather than the computing systems inside. Each scenario demonstrates the limitations of thinking about security as a collection of independent technologies.
Physical security remains one of the most important components of data center protection, but it has to be applied with a clear understanding of the facility’s operational dependencies. Perimeter intrusion detection, access control, video surveillance, vehicle barriers, security personnel, and response procedures are all valuable, provided they are positioned and managed to address credible threats. Just as importantly, security leaders need to understand how those measures interact with cybersecurity, engineering, and operational continuity. I have often argued that security should be established as a design requirement rather than an operational feature added toward the end of a project. That position has only become stronger as data centers have grown larger, more interconnected, and increasingly important to the global economy.
The events of this year reinforce that view. The security industry needs to look beyond individual systems and consider the entire environment supporting the data center, from the utility infrastructure feeding the property to the equipment located within the rack. We should also recognize that no amount of technology will eliminate every threat. There will always be equipment failures, unexpected events, human mistakes, and circumstances that exceed the assumptions established during design. The real measure of a security program is not whether it can prevent every possible incident, but whether it can reduce exposure, identify developing problems, support an effective response, and help the facility recover when something goes wrong.
Data centers have become essential infrastructure supporting nearly every aspect of modern life. As their importance continues to grow, so does the responsibility to protect them with security strategies that reflect the environment in which they actually operate. The next attack on a data center may never touch a server. It may occur at the loading dock, along a utility corridor, inside a cooling plant, through a compromised contractor account, or miles away from the facility itself. And if we are not considering those possibilities when we design and operate these facilities, we may be protecting the servers while overlooking the infrastructure that keeps them running.
