The UK is in the middle of a data centre building boom. Government forecasts put AI capable capacity needs at 6GW by 2030, three times what exists today, while electricity demand from the sector is also expected to rise significantly, writes Katie Barnett, Director of Cyber Security at Toro Solutions and Gavin Wilson, Director of Physical Security and Risk at the consultancy Toro Solutions.
Our dependence on that infrastructure is growing too. Healthcare, financial services, government and many of the services we use every day depend on the data and systems these facilities support. Disruption to a major data centre can have consequences far beyond the operator itself, affecting essential services, businesses and potentially the wider economy. That level of national dependence was recognised in September 2024 when UK data infrastructure was formally designated Critical National Infrastructure [CNI].
As data centres become more important, they also become more attractive to a wider range of actors. At the same time, their dependence on power, water and telecommunications is growing and the systems keeping sites operational are increasingly connected. For somebody looking to cause disruption, that creates more than one potential route to the same outcome. The 2025 intrusion at RAF Brize Norton is a useful example. Relatively straightforward methods were used to reach strategically important assets. For data centre operators, it raises a broader question: where might the importance of an asset be out of proportion to how difficult it is to reach?
The answer may not be inside the data centre at all.
Who is interested and why?
A hostile state may be interested in a data centre long before it has any intention of disrupting it. A facility supporting government, defence, financial services or strategically sensitive AI workloads could be worth monitoring, gathering intelligence on or gaining access to. That could mean espionage or sabotage, but it could also mean establishing access that can be used at a later point.
For criminal groups, financial gain is likely to be the main motivation. Ransomware remains an obvious threat, but criminals can also apply pressure through employees, suppliers and operational systems, particularly where disruption gives them additional leverage. An insider may already know how the facility works, where important systems sit and which processes are weaker in practice than they appear on paper. That combination of legitimate access and detailed knowledge can make insider activity particularly difficult to identify.
Data centres are attracting more public scrutiny too, particularly around water use, electricity consumption, land and the growing footprint of AI infrastructure. Most resulting activity will be lawful, but operators still need to consider the potential for trespass, disruption or interference with infrastructure.
A compromised contractor account, unexplained drone activity and reconnaissance around supporting infrastructure might initially be treated as three separate incidents. They could be unrelated, or they could represent different stages of the same activity. If cyber, physical security and facilities teams are looking at them separately, nobody may see the full picture.
Start with the threat, not the checklist
Security reviews often begin with the controls already in place: perimeter fencing, CCTV, access control and policies. Those controls matter, but the better starting point is who might realistically target the facility and what they would want to achieve.
A site supporting defence or government workloads will attract different interest from one running standard enterprise capacity. Its customers, ownership, location and surrounding infrastructure can all change the threat picture. An attacker can also learn a great deal about a site before going anywhere near it. Planning applications, job adverts, supplier relationships, employee profiles, satellite imagery and social media can collectively reveal technologies, contractors, working patterns and details of supporting infrastructure.
We’ve written before about โthe gap between security on paper and security in practiceโ. A site can perform well against a recognised framework and still look very different to somebody actively trying to find a route in.
Look beyond the perimeter
A facility can have excellent physical security and still depend on a substation, fibre route or other infrastructure several miles away that has nothing like the same level of protection.
Power, telecommunications, cooling, fuel and specialist engineering support all need to be understood, including whether supposedly resilient systems actually share a route, supplier or point of failure. Two independent services on a diagram may ultimately depend on the same physical infrastructure. Inside the facility, building management systems, environmental controls, power distribution, CCTV and access control are increasingly connected, while responsibility for them can be split across IT, facilities, engineering and security.
The supply chain extends that exposure further. Data centres rely on technology providers, equipment manufacturers, engineering firms, maintenance companies, security contractors and telecommunications providers. Some may have physical access to the site, remote connectivity, privileged accounts or detailed knowledge of how the facility operates. An internal system might be tightly controlled by the operator but still be remotely accessible by the company that maintains it. Supply chain risk is not limited to access. Hardware, software and specialist equipment can pass through several organisations before reaching the facility, while updates, maintenance and remote support create dependencies that continue throughout its operational life.
The route to disrupting a data centre may sit with a supplier, a connected operational system or a piece of infrastructure outside the perimeter.
Test how it works in practice
Reviews need to be backed up by realistic testing, particularly where controls depend on people, contractor processes and challenge culture. For data centres, that testing should cross into the digital environment rather than treating physical and cyber security as entirely separate exercises. Publicly available information, supplier relationships and staff details can form part of realistic reconnaissance. Testing can then establish whether gaining access to one part of the environment creates opportunities somewhere else.
Exercises should cross those boundaries too. Protest activity outside the site, drone sightings near supporting infrastructure and an operational system beginning to behave unexpectedly would force security, facilities and IT to work out whether those events are connected while the situation is still developing. How quickly do they make the connection? Who takes control? At what point does leadership become involved?
Get it right at the design stage
Decisions being made now about where to build, how to power a site, which suppliers to use and how the facility is laid out will shape its security for years. Poor design decisions are much easier to address before construction begins, whether that relates to standoff distances, exposed critical infrastructure, weak zoning or unnecessary shared dependencies.
Cyber, OT and physical security need to be considered together at this stage. Designing them separately makes it much easier for gaps in ownership, integration and responsibility to become embedded in the finished facility. During construction, more contractors have access to the site, equipment is moving in and out, temporary access arrangements are common and detailed information is being shared across a much larger group of organisations. Major upgrades to existing sites can create many of the same issues.
Somebody targeting a data centre will be looking for the route that gives them the outcome they want with the least difficulty.
For a well-protected data centre, that route may increasingly be somewhere else.
