Securing the Unseen Engines: OT Cybersecurity for the AI Data Center Era
Redundant but Not Resilient
Israel's data center expansion has stopped being only a real estate story. In 2026, the Knesset advanced a proposal to treat qualifying AI server farms as national infrastructure - a signal that domestic compute capacity is now part of the country's strategic base. Driven by AI and high-performance computing, they have become prime economic and strategic assets.
That shift changes the security question. Protecting customer data and cloud workloads remains essential, but it is only half the problem. A data center can have world-class logical security and still lose availability because the physical systems beneath the compute layer cannot deliver stable power, cooling, and environmental control.
The facility is part of the compute stack
Strip away the racks and a modern data center looks like a tightly coupled industrial plant. UPS systems, generators, switchgear, automatic transfer switches, chillers, pumps, coolant distribution units, building management systems (BMS), electrical power monitoring systems (EPMS), and safety systems coordinate continuously to keep equipment inside its operating limits.
AI and high-performance computing make that coordination far more demanding, concentrating electrical and thermal load into dense racks. Where legacy IT offered a comfortable thermal buffer, GPU-dense clusters leave very little, so a cooling disruption escalates quickly. It does not have to destroy hardware to become a serious incident - workload throttling, protective shutdown, and a complex restart sequence are enough to interrupt customer services.
Redundancy is not cyber independence
Data center design has long been governed by an engineering gold standard: redundancy. Operators spend tens of millions on N+1 and 2N architectures, duplicate generators, UPS topologies, redundant chilled-water loops on a simple assumption: if a component fails, the backup takes over.
Cyber incidents break that assumption. They do not cause isolated mechanical wear; they target the control logic itself. When an attacker manipulates an industrial protocol such as Modbus or BACnet, or compromises a central BMS, they can affect several nominally redundant assets at once suppressing alarms, altering setpoints, and leaving operators unsure which telemetry to trust. Two power paths or two chillers may still depend on one management platform, one vendor gateway, one credential set, or one control network.
Access to a BMS does not automatically mean control of every breaker or chiller; local controllers, interlocks, and protective relays still matter. But shared engineering workstations, flat networks, reused credentials, and broad vendor access can quietly connect systems that were meant to fail independently.
Dimension | IT / Compute Layer | Facility OT Layer |
Priority | Confidentiality, integrity, and availability of data and digital services | Safe, stable physical processes; availability and process integrity dominate |
Assets | Workloads, storage, networks, identity and management systems | BMS, EPMS, PLCs, chillers, UPS, generators, transfer switches, sensors |
Communications | IP traffic - HTTPS, TLS, APIs, management | IP and serial - BACnet, Modbus, SNMP, proprietary |
Impact of attack | Data exposure, credential theft, service interruption | Loss of power, cooling, monitoring, or safety - with downstream service impact |
How the exposure reaches in
Few facility networks are truly air-gapped anymore. Remote support, cloud dashboards, energy optimization, DCIM integration, and vendor-managed maintenance create legitimate paths into once-isolated systems - and each connection can link assets the availability design assumes will fail on their own.
A firewall rule can confirm that two devices are allowed to talk without revealing whether the action inside the session is expected. An authenticated system can still issue a dangerous write, change a setpoint, or suppress telemetry. In facility OT, the meaning of a command can matter as much as the existence of the connection. The danger is rarely a single dramatic event; it is a chain - a compromised vendor account reaches a remote gateway, crosses into a shared network, issues an unauthorized command, degrades cooling or power redundancy, and forces the compute layer to throttle or shut down.
This is not hypothetical. In 2022, CISA and the U.S. Department of Energy warned that threat actors were reaching internet-connected UPS devices, often through unchanged default credentials, and CISA has since published advisories affecting data center and building management products. The lesson is not that one vendor or protocol is uniquely unsafe, but that facility management interfaces can be exposed, over-privileged, and operationally consequential.
Availability fails first
When cooling is interrupted, high-performance systems throttle or shut down. Protective shutdown lowers the odds of immediate hardware damage, but it does nothing to preserve availability recovery may still require stabilizing cooling, verifying controllers, and executing a carefully sequenced restart. In a colocation facility, one common-mode incident can affect multiple tenants; in an enterprise site, it can take down logically redundant applications that still depend on a single physical building. And if telemetry itself is compromised, operators may have to make shutdown and safety decisions with incomplete information.
Securing the unseen engines
Real resilience means moving beyond physical redundancy toward operational zero-trust. Facility managers rightly worry that security tooling will disrupt live equipment, void vendor warranties, or force downtime, so protection has to be inline and non-intrusive. That points to three practical measures: hardware-enforced micro-segmentation that draws strict perimeters around critical controllers without re-architecting the network; protocol-aware command filtering that inspects industrial traffic and blocks anomalous or unauthorized logic in real time, without adding latency; and zero-downtime deployment that wraps both legacy and modern controllers without site reboots. The aim is to make the meaning of every command visible, not just the connection.
Conclusion: N+1 is not a security strategy
Data centers are engineered to survive equipment failures. The hidden assumption is that redundant systems fail independently and cyber incidents are exactly what break that assumption, because two physical paths can still share one control plane. The compute layer can be secure and the facility physically redundant, and availability can still hinge on a single digital dependency. As Israel cements its role as a technology hub, resilience in the AI era demands a mindset shift: N+1 is no substitute for OT cyber defense. Securing these facilities means securing the unseen engines, the logic driving the chillers, power distribution, and backup generators that keep the digital economy running.
Sources
1. Knesset AI server farms proposed as national infrastructure (first reading); committee approval for final readings.
3. ASHRAE Data Centers and Telecommunication Facilities; AI Data Center Energy Performance Framework.
5. CISA / U.S. Department of Energy Mitigating Attacks Against Uninterruptible Power Supply Devices (2022).
6. CISA ICS advisories Schneider Electric Data Center Expert; Siemens Desigo CC / Cerberus DMS.
