Data centres have quietly become one of the most attractive targets in the cybersecurity landscape. As AI workloads multiply and infrastructure investment surges, the facilities powering the modern internet are drawing a more sophisticated class of threat actor than ever before.
According to a Morgan Stanley estimate, roughly £2.2 trillion will be spent on AI-supporting data centres between 2026 and 2029 since scale of investment creates scale of risk. The bigger these facilities grow and the more critical services depend on them, the more disruptive a successful attack becomes.
A Threat Landscape Transformed by AI
The nature of attacks has shifted. Around 66% of IT decision-makers now identify AI-generated attacks as the single biggest threat to their data, with ransomware following closely behind as a top concern heading into 2026. These are not conventional intrusion attempts. AI-assisted attacks can probe defences at machine speed, adapt in real time, and evade signature-based detection tools built for a different era.
A separate and growing concern is silent data exfiltration. The “harvest now, decrypt later” threat has moved from theoretical to urgent, with attackers collecting encrypted data today to decrypt it once quantum computing matures. For data centres storing sensitive enterprise and government workloads, this creates a risk window measured not in hours but in years.
Physical Infrastructure Is Now Part of the Attack Surface
The threat is not limited to software and networks. AI is pushing data centres into a new operating regime with denser compute, higher power draw, and tighter integration between IT systems and physical infrastructure controls such as building management, power monitoring, and cooling. Many incidents once classified as IT problems now have a credible path to becoming physical events: power outages, thermal failures, forced shutdowns, and service disruptions.
This convergence of digital and physical systems gives attackers more entry points and more ways to cause real-world damage. A compromised building management system, for instance, can take down compute capacity just as effectively as a network intrusion.
How the Industry Is Responding
Security teams are fighting back with the same tool set attackers are exploiting. NTT DATA recently launched a network of AI-powered Cyber Defense Centres across India, the UK, and the US. These facilities use AI agents to autonomously triage, analyse, and hunt for threats, cutting investigation time by up to 60% and reducing alert volumes by up to 90%.
The broader industry consensus is moving away from reactive defence toward integrated, adaptive systems built to anticipate threats before they escalate, combining automated detection with stronger situational awareness across the full infrastructure stack.
For security operations centres, AI agents now handle alert triage and autonomous threat blocking in seconds, freeing human analysts to focus on forensics, containment, and recovery rather than manual monitoring.
The Regulatory Gap
Investment in defence is outpacing regulation. National frameworks requiring strong security standards for AI data centres remain largely absent. Incentives such as tax breaks or land access tied to security compliance have been proposed but not consistently implemented. Without binding requirements, security investment remains voluntary and uneven across operators.
Cybersecurity ranked as the top disruptor in IT planning surveys for 2026, with nearly half of senior leaders citing security incidents as their primary concern. More than half expect moderate to significant budget increases for data protection in the coming year.
The infrastructure underpinning the AI economy is under sustained attack. Investment alone will not close the gap. What the industry needs now is a coordinated approach that treats physical infrastructure, software systems, and regulatory frameworks as a single security problem, not three separate ones.