Data Center Security Crisis: Why 1 in 5 Building Automation Assets Are Highly Vulnerable
Modern data centers are the beating heart of the global digital economy, supporting everything from critical cloud services to the massive AI boom. Yet, while their IT networks are heavily fortified, the physical infrastructure keeping these servers cool and powered remains alarmingly exposed.
A recent and sobering report from Claroty’s Team82 threat research team analyzed over 750,000 cyber-physical system (CPS) assets across major data centers. The findings reveal a glaring blind spot in industrial cybersecurity: nearly 1 in 5 operational assets are just “one hop” away from being accessible to an external attacker.
The “One Hop” Threat to Cyber-Physical Systems
In the realm of building automation, a “one hop” exposure means an attacker only needs to compromise a single externally facing system to pivot directly into critical operational technology (OT). Once inside, threat actors can manipulate environmental controls to devastating effect.
The Team82 research highlights that 41% of power distribution units (PDUs) and 32% of HVAC and cooling systems possess this direct or single-hop exposure to the public internet. In a data center environment, manipulating cooling infrastructure or uninterruptible power supplies (UPS) isn’t just a nuisance—it’s a catastrophic operational failure.
The Danger of Legacy Protocols in Smart Buildings
The root cause of these massive exposure vectors stems from an industry-wide reliance on outdated communications. A staggering 88% of Building Management Systems (BMS) are exposed via inherently insecure protocols, and 40% operate on outdated, unpatched firmware.
More concerning for ICS security professionals is that over 80% of OT control and power monitoring systems communicate over unencrypted legacy protocols like BACnet and Modbus. While BACnet is the foundational language of smart buildings, its traditional, unencrypted iterations lack the authentication necessary to withstand modern cyber threats.
Compounding this issue, the research found that 23% of connected IoT devices in data centers contain Known Exploited Vulnerabilities (KEVs). When left unsegmented, these compromised devices act as open doors to the wider automation network.
Modernizing BMS Resiliency and Zero-Trust
To defend against these evolving threats, operators must adopt a zero-trust approach to network segmentation, actively isolating unpatchable legacy systems and shrinking the potential blast radius. Continuous exposure management and protocol-aware threat detection are now baseline requirements.
However, retrofitting security into legacy infrastructure is complex. This is where modern cloud ecosystems like BAaaS.io provide a strategic advantage. By centralizing building management through an intelligent, secure-by-design platform, operators can eliminate the scattered attack surface of traditional deployments.
BAaaS.io ensures robust access control with built-in authentication and role-based permissions, addressing the exact vulnerabilities highlighted by Team82. By wrapping vulnerable protocols in a secure, unified network, facility managers can achieve the uptime and operational resilience modern data centers demand.
Conclusion
Data centers have evolved into tier-one critical infrastructure, making them high-value targets for nation-states and ransomware syndicates alike. Protecting these massive cyber-physical ecosystems requires treating a facility’s cooling and power systems with the same security rigor as its data servers.
The era of relying on “security by obscurity” in building automation is officially over. By recognizing these structural exposures and adopting robust, service-oriented platforms, operators can safeguard the infrastructure that powers modern life against an increasingly hostile digital landscape.
