Bottom line: The operational technology of AI data centers – cooling, power, climate control – is excluded from many security concepts, even though it underpins the physical operation of critical infrastructure.
While AI data centers protect their servers with firewalls and zero-trust architectures, the physical building infrastructure for cooling, power supply and climate control often remains unsecured. This creates an attack surface that classic IT security concepts do not cover.
AI data centers invest considerable resources in securing their server and network infrastructure: powerful firewalls, segmentation and zero-trust architectures have now become standard. Less attention is paid to operational technology (OT) – that is, the building management systems that control cooling systems, uninterruptible power supplies and air conditioning. These systems are often connected via their own networks or control protocols that are not subject to the same security requirements as the IT environment.
This creates a relevant risk for CISOs: an attack on the building infrastructure can impair the physical operation of a data center without the actual IT infrastructure needing to be compromised. In highly dense AI clusters, failures in cooling or power supply lead to critical operational disruptions faster than in classic data centers, since heat generation from GPU-intensive workloads is significantly higher. Anyone who does not integrate OT systems into their security concept leaves open an attack vector that bypasses classic network security.
In practice, this means that security officers should dissolve the separation between IT and OT security. This includes taking stock of all physical control systems, examining their network connectivity, and determining whether these systems can be remotely maintained and through which access points they can be reached. Responsibilities should also be clarified: responsibility for building infrastructure often lies with facility management teams that are not integrated into IT security processes. A consolidated risk assessment covering both IT and OT systems is thus becoming a necessary component of securing AI data centers.
Source: itwelt.at · Published August 20, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.