Walk any hyperscale campus and you will find the tightest security in the industry wrapped around the data hall: mantraps, biometrics, cages, cameras every few meters. Then walk two hundred meters to the chiller yard and count the controls. A fence, sometimes a camera, often a gate secured with a padlock from the facilities budget. The hall cannot run thirty minutes without that yard.
N+1 is an availability concept, not a security control. Both chillers share one fence.
The envelope is drawn around the wrong asset
Redundancy design assumes independent random failures: one pump dies, its twin carries the load. Adversaries do not fail randomly. A person who understands the one-line diagram attacks the common elements: the substation intake, the switchgear room, the cooling loop, the generator fuel supply, the water main. Every one of those is typically outside the biometric envelope and inside a contractor’s daily routine.
The regulated utilities learned this lesson the hard way, which is why grid operators assess exactly these scenarios under standards like NERC CIP-014. Private campuses hosting AI workloads now carry comparable concentration of consequence with none of the regulatory forcing. The threat crossed over before the discipline did.
OT is the quiet corridor
The building management system reaches everything: cooling setpoints, power monitoring, fire suppression, door controllers. Its cabinets sit in corridors, its network is often flat, and its vendor accounts outlive their projects. Physical access to an unlocked BMS panel is a cyber event with a screwdriver. In our assessments the fastest respectable path from parking lot to consequence is almost never through the lobby; it is through a mechanical room.
What to fix first
- Redraw the protection envelope around consequence: substation, switchgear, chiller yard, fuel, water, and BMS nodes inherit the hall’s security tier.
- Lock and alarm OT cabinets like network closets, and reconcile vendor access accounts quarterly.
- Put detection, not just resistance, on the support perimeter: the chiller fence should alert before it delays.
- Run one tabletop where the scenario never touches a server: lose the yard, price the afternoon. The budget conversation that follows is short.
We have walked many chiller yards. A quiet afternoon on yours would tell you exactly where you stand.