Data Center OT Security
Beyond the servers, the systems that actually run a data center are becoming a new attack surface. OT security is now a core condition for preventing outages and keeping services running. Security has never been a hotter topic. Since 2025, a string of major breaches has hit leading telecom and financial companies in Korea, and reported cyber incidents rose 19.5% year over year in the first half of 2026[10][11]. Overseas, data centers have even become targets of drone strikes, cementing their status as critical national infrastructure[12]. Yet most conversations about data center security stop at the front door and the firewall. Inside, a less visible risk is building up: the operational technology (OT) that controls chillers, CRAH units, UPS systems, switchgear and fire suppression. These systems are now connected to remote management tools and corporate networks, but most of them were never designed with today’s threats in mind.
When OT is attacked, not a single byte of data may leave the building. Instead, cooling falters and power drops. That is why an OT incident rarely looks like a hack. It looks like an outage[8]. And the more a data center supports AI training and critical services, the higher the cost of that outage.
IT vs. OT in the Data Center
Data center operators are used to thinking of their facility in two parts: the white space, where servers and network equipment live, and the gray space, home to power and cooling infrastructure. IT security protects the white space, while OT monitors and controls the equipment in the gray space. Cooling and HVAC, UPS and power distribution, the building management system (BMS) that ties them together, fire systems and access control all fall under OT[1][6].
The two worlds protect different things. IT security is built around keeping data confidential. OT security is built around keeping equipment running, which means uptime and safety come first. Facility equipment stays in service for decades, and continuous operation makes patching difficult. Facility protocols such as BACnet and Modbus are often unreadable to conventional IT security tools like IDS and EDR, so attacks can slip through unnoticed[7].
The bigger problem is that organizations have changed more slowly than the technology. Facilities teams talk in temperature and voltage. Security teams talk in packets and vulnerabilities. Neither has the tools or processes to translate the other’s risks. The result is territory that belongs to no one, and that gap is exactly where outages begin[8]. In some cases, equipment vendors or contractors connect systems through separate internet lines that the security team doesn’t even know exist[9].
What Happens When OT Is Attacked
A compromised OT system looks nothing like a typical IT incident. Change a cooling setpoint, and server room temperatures climb until servers throttle themselves and eventually shut down to stay safe. Tamper with sensor readings, and alarms sound late or not at all. Disrupt UPS control, and a power issue in a single rack can cascade into upstream systems[5][8].
This isn’t just theory. In 2023, a facility malfunction in Singapore pushed temperatures past safe limits and took down banking services used by millions of people[3]. Had it been a deliberate attack rather than a malfunction, the outcome would have been the same.
That changes the question OT security needs to answer. Stopping intrusions is not enough. The real question is whether you can keep operating safely even while an intrusion is underway[8]. That is what resilience means for a data center.
Why OT Risk Is Growing
AI demand is driving data center construction at an unprecedented pace, and governance is struggling to keep up with design, build and commissioning timelines. Some new equipment suppliers lack mature secure development practices, and tight schedules lead to repeated mistakes: misconfigured network segmentation (VLANs), open ports and default passwords left unchanged[8].
The numbers tell the same story. A study of the areas around roughly 1,000 U.S. data centers found about 6,300 facility control devices reachable directly from the internet. Notably, exposure rates were actually higher around newer facilities than older ones[9]. Installing the latest equipment doesn’t remove the risk if it isn’t connected and managed properly.
Vulnerabilities in the equipment itself are also growing. Publicly disclosed vulnerabilities from four major facility equipment vendors rose 13% in a single year, and average severity increased[2]. OT security firm Claroty found that 75% of organizations it analyzed were running BMS devices with known exploited vulnerabilities[6]. Speed has become a competitive edge, but speed without governance quickly turns into security debt.
The Threat Is Already Here
Recent research shows how directly these vulnerabilities can translate into outages. Researchers found near-maximum-severity flaws in the network devices used to manage UPS systems, allowing attackers to bypass authentication and execute commands. In the worst case, that could cut power to the very equipment the UPS is meant to protect. A widely deployed HVAC controller was also found to offer a path to root-level access without authentication[8]. As rack densities rise and thermal margins shrink, disrupting cooling can quickly become a service outage.
Real attacks are happening too. In June 2025, U.S. data center operator Digital Realty was reportedly targeted by a state-linked hacking group, with unpatched vulnerabilities and stolen credentials identified as likely entry points[6]. There have also been reports of attackers using stolen employee accounts to access facility management equipment[3].
The pattern is clear. The equipment IT security teams rarely look at turned out to be exactly the equipment that decides whether a data center stays online.
How to Secure Data Center OT
ReceThe risks above come down to four gaps: connections the security team doesn’t know about, configuration mistakes left behind by rushed builds, unmanaged remote access, and the ownership gap between facilities and security teams. OT security is about closing these gaps one by one, in line with international standards such as NIST SP 800-82 and IEC 62443[1][4].
1. Find the connections no one knows about. You can’t block a path you can’t see, such as an internet line a vendor installed on their own. Start by keeping a single inventory of every device across white space and gray space, along with where it sits and what it connects to[6][8].
2. Separate facility systems from the internet and business networks. As the 6,300 exposed devices show, the most common risk is a door that should never have been left open. Isolate facility control networks from business networks, and verify network settings and default passwords from the construction phase onward[8][9].
3. Verify every remote access session. As the stolen-account cases show, remote access is an attacker’s easiest way in. Grant vendors only the access they need, enforce strong authentication and keep a record of every session[3][6].
4. Watch security alerts and facility anomalies together. Because OT attacks show up as outages, security events alone can miss them. Analyzing temperature, power and other facility anomalies alongside security monitoring helps catch attacks before they turn into outages[8].
5. Protect what must never stop, first. You can’t replace every system at once. Identify the equipment whose failure would take down service within 30 minutes and protect it first, then compensate for legacy devices that can’t be patched with segmentation and continuous monitoring[5][6].
OT Security Is a Business Issue
OT security is no longer just a job for technical teams. Insurers are increasingly asking for evidence of OT controls such as asset visibility, network segmentation and remote access management[8]. That is why OT security needs to be treated as an enterprise risk, not a facilities checklist, with IT and OT teams sharing responsibility[5].
If you are choosing a data center, these questions are worth asking:
In a data center, uptime is the product. And if that’s true, the OT security that keeps it running is part of product quality.
Discover More.
Join us as we take you through every step of the development of our state-of-the-art hyperscale data center in this blog. We loves to talk about what we do. Feel free to chat with our sales experts about data center, managed colocation, and connectivity.
Content is protected by copyright law and is owned by Daou Technology Inc
It is prohibited to modify or commercially use this content without prior consent.
Featured images via gettyimages.
References
1. NIST, SP 800-82 Rev.3 Guide to Operational Technology (OT) Security (2023)
2. Uptime Institute, OT security: rising critical vulnerabilities, widespread risks (2025.09)
3. Conor McLaren (Dragos), The cybersecurity blind spot in data center building systems, DCD (2026.03)
4. ISA/IEC 62443 Series, Security for Industrial Automation and Control Systems
5. Prateek Singh (Eaton), The overlooked threat: Why OT cybersecurity is critical for data center uptime, LinkedIn (2026.05)
6. Claroty, Enhancing Data Center Protection with OT Cybersecurity (2025.10)
7. Sean Tufts (Claroty), The Data Center’s Hidden Attack Surface: Why OT Security Can’t Wait, Data Center Knowledge (2026.08)
8. Jennifer Tullman-Botzer (Cyolo), The Overlooked OT Security Risks Inside AI Data Centers (citing TrendAI research)
9. Ministry of Science and ICT & KISA, 2026 H1 Cyber Threat Trends (2026.07)
10. Newsis, coverage of telecom and card company breaches (2025.09)
11. Financial News, Data centers become wartime targets (2026.10)