One Hop From Disaster - Claroty data center exposure- 320

August 2, 2026

The servers inside a data center get most of the security attention, but the systems keeping those servers alive — the cooling, the power, the fire suppression — often sit one careless network connection away from an attacker. New research from Claroty, which analyzed more than 750,000 data center assets worldwide, including roughly 191,000 operational-technology devices and 174,000 infrastructure systems, found that while direct internet exposure is genuinely rare, the layer just behind that first line of defense is considerably softer than the industry's public confidence about data center security would suggest.

The headline number is reassuring on its face and considerably less so once you follow it one step further. Fewer than 1,000 of the 174,000 infrastructure assets Claroty examined — under half a percent — are directly reachable from the internet, covering systems that manage HVAC, power monitoring and distribution, fire suppression, and uninterruptible power supplies. But roughly 32,000 of those assets, 18 percent of the total, sit just one network hop away from something that is internet-exposed, meaning a single additional connection or a single misconfigured gateway is often the only thing standing between an external attacker and equipment that keeps a data hall from overheating or losing power. The exposure is not evenly distributed either: 41 percent of power distribution units and 32 percent of HVAC systems fall into that one-hop category, concentrating the risk precisely in the systems whose failure has the most immediate physical consequences. Claroty's own framing of the danger is blunt — successful attacks against this layer can disrupt cooling operations, affect power distribution, compromise environmental controls, interfere with backup generation, and degrade a facility's overall operational resilience, all without ever touching a single server directly.

The building management systems that tie these functions together compound the problem rather than mitigating it. Claroty found that 88 percent of building management systems communicate using insecure protocols, and 40 percent run on outdated firmware — meaning the coordination layer meant to keep HVAC, power, and fire systems working in concert is, in the large majority of cases, built on communication standards with no meaningful protection against interception or manipulation. On the operational-technology side specifically, which includes SCADA and programmable logic controllers, researchers identified 11,000 devices running software with vulnerabilities already known to have been exploited in the wild — not theoretical weaknesses, but flaws with a documented history of active attacker use, sitting inside the control layer of some of the world's largest data centers. Claroty describes the realistic attack path as a chain rather than a single flaw: insecure communication protocols, known exploited vulnerabilities, unmanaged remote-access tools, flat network architectures that don't separate one system from another, weak authentication, and misconfigured device communications all combine to turn a single internet-facing foothold into a path toward the equipment that actually keeps the facility running.

None of this requires a dramatic breakthrough to fix, which is precisely Claroty's point in publishing the research. The firm's recommendations are the standard prescription for exactly this kind of layered exposure: continuous exposure management rather than periodic audits, zero-trust network segmentation so that a single compromised gateway can't reach everything one hop beyond it, deliberate hardening of building management systems specifically, and protocol-aware threat detection tuned to the specific communication standards these operational systems actually use rather than generic IT monitoring. The gap Claroty's numbers expose isn't a story about sophisticated attackers defeating cutting-edge defenses — it's a story about an industry whose public reputation for security rigor has outpaced the actual segmentation and patching discipline applied to the physical systems that reputation depends on.