State of CPS Security: Data Center Exposures

Team82 analyzed 750,000+ data center CPS assets and core infrastructure and found a significant gap between perceived isolation and actual exposure.

A few findings that stood out:

• 18% (32,000+) of 174,000+ data center infrastructure assets are just one hop away from a system making risky outbound connections to the public internet.

• Power distribution and HVAC/cooling are particularly exposed, with 41% and 32% of assets, respectively, one hop from risky internet connections.

• 88% of BMS platforms communicate over insecure protocols, while 40% run outdated firmware.

• More than 80% of OT control systems, power monitoring, and IoT systems rely on legacy protocols such as BACnet and Modbus.

• 23% of IoT devices contain known exploited vulnerabilities (KEVs).

The interesting part isn't simply that these systems have vulnerabilities. It's the attack path.

An attacker doesn't necessarily need direct internet access to a PLC, UPS, BMS, or other CPS asset. A foothold in IT, a third-party remote access connection, remote management service, or trusted network relationship can provide the lateral path into operational infrastructure.

Read the report: https://claroty.com/resources/reports/state-of-cps-security-data-center-exposures

Impact

The exposure of critical CPS assets in data centers increases the risk of attackers gaining unauthorized access to operational infrastructure. Vulnerable power systems, HVAC, building management systems, and IoT devices could be compromised, potentially impacting uptime, reliability, and safety. The use of insecure protocols and outdated firmware further exacerbates these risks. The presence of known exploited vulnerabilities in a significant portion of IoT devices increases the likelihood of successful exploitation. The indirect attack paths via IT footholds and trusted network relationships mean that attackers can reach sensitive CPS assets without direct internet exposure.

Defensive guidance

The report does not specify direct remediation steps or patches. Organizations should review the full Claroty report for detailed guidance. Given the nature of exposures, mitigation likely involves segmenting CPS assets from risky internet-connected systems, updating firmware, replacing or securing legacy protocols, and monitoring third-party remote access and trusted network relationships.

Summary

Claroty Team82 conducted a large-scale analysis of data center CPS assets and core infrastructure, identifying a significant gap between perceived isolation and actual exposure. Key findings include that 18% of data center infrastructure assets are one hop from risky internet connections, with power distribution and HVAC systems particularly exposed. Building management systems often use insecure communication protocols and outdated firmware. Over 80% of OT control, power monitoring, and IoT systems rely on legacy protocols like BACnet and Modbus. Nearly a quarter of IoT devices contain known exploited vulnerabilities. The report emphasizes that attackers do not require direct internet access to CPS assets; lateral movement through IT systems, remote access, or trusted networks can provide attack paths into operational environments.

State of CPS Security: Data Center Exposures

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 7 Aug 2026, 21:26 UTC

Technical details

References

Community reviews