Claroty Team82 conducted a large-scale analysis of data center CPS assets and core infrastructure, identifying a significant gap between perceived isolation and actual exposure. Key findings include that 18% of data center infrastructure assets are one hop from risky internet connections, with power distribution and HVAC systems particularly exposed. Building management systems often use insecure communication protocols and outdated firmware. Over 80% of OT control, power monitoring, and IoT systems rely on legacy protocols like BACnet and Modbus. Nearly a quarter of IoT devices contain known exploited vulnerabilities. The report emphasizes that attackers do not require direct internet access to CPS assets; lateral movement through IT systems, remote access, or trusted networks can provide attack paths into operational environments.

The exposure of critical CPS assets in data centers increases the risk of attackers gaining unauthorized access to operational infrastructure. Vulnerable power systems, HVAC, building management systems, and IoT devices could be compromised, potentially impacting uptime, reliability, and safety. The use of insecure protocols and outdated firmware further exacerbates these risks. The presence of known exploited vulnerabilities in a significant portion of IoT devices increases the likelihood of successful exploitation. The indirect attack paths via IT footholds and trusted network relationships mean that attackers can reach sensitive CPS assets without direct internet exposure.

The report does not specify direct remediation steps or patches. Organizations should review the full Claroty report for detailed guidance. Given the nature of exposures, mitigation likely involves segmenting CPS assets from risky internet-connected systems, updating firmware, replacing or securing legacy protocols, and monitoring third-party remote access and trusted network relationships. Patch status is not confirmed; check the vendor advisory for current remediation guidance.