Nearly 20% of data center control systems one hop from internet

Data center operators have long focused security efforts on servers and network appliances, but a new study highlights risks in equipment traditionally managed as facilities infrastructure. Research by cybersecurity firm Claroty found that nearly 20% of physical control assets in major data centers sit just one network step from systems that make outbound internet connections. These exposed assets include power distribution units, cooling controls, building management platforms, generators, and environmental sensors—systems whose disruption could take computing capacity offline even if servers remain uncompromised.

What the research uncovered

Claroty’s findings stem from an analysis of network topologies in large-scale data centers. The study identified that 18% of control assets responsible for critical physical infrastructure are adjacent to systems with direct internet access. This proximity creates potential attack paths where adversaries could move laterally from compromised external-facing systems to equipment that regulates power, temperature, and environmental conditions. While the research did not confirm active exploitation, the exposure raises concerns about the security posture of operational technology (OT) in data center environments.

The report notes that many data center operators still treat power and cooling systems as separate from IT security programs. These systems often fall under facilities management rather than cybersecurity teams, leading to inconsistent patching, monitoring, and access controls. The lack of integration between IT and OT security frameworks leaves gaps that attackers could exploit to cause physical disruptions without directly targeting servers or storage arrays.

Why this matters for data center operators

The potential impact of compromised power or cooling systems extends beyond immediate downtime. Regulatory frameworks in many jurisdictions now classify data center outages as reportable incidents, particularly when they affect critical infrastructure or customer data. A successful attack on physical control systems could trigger compliance violations, contractual penalties, and reputational damage—even if the primary IT infrastructure remains intact.

The study also arrives amid growing scrutiny of data center resilience. Hyperscale providers and colocation operators have expanded rapidly to meet demand for AI workloads, often deploying new capacity faster than security controls can adapt. Claroty’s findings suggest that as data centers scale, the attack surface for physical infrastructure grows in parallel with digital assets.

What to watch

Claroty has not released specific details about the data centers analyzed or the geographic distribution of the findings. The company plans to present additional technical data at an upcoming industry conference, which may provide further insight into common misconfigurations or vulnerable equipment models. In the meantime, operators are likely to face increased pressure from customers and insurers to demonstrate robust segmentation between IT and OT networks.

The research also coincides with broader industry discussions about the convergence of IT and OT security. Standards bodies and industry groups have begun developing guidelines for securing physical infrastructure in data centers, but adoption remains uneven. Operators that proactively address these risks may gain a competitive advantage as customers prioritize resilience in their infrastructure decisions.