Navigating the Evolving Cyber Risk Landscape for Data Centers

As the digital landscape expands, data centers have transformed from simple colocation facilities into complex hyperscale operations. These facilities are now pivotal to the functioning of countless businesses, making them prime targets for cyber threats. In this rapidly changing environment, brokers must navigate a complex web of risks and insurance requirements to protect their clients effectively. With ransomware attacks becoming more frequent and costly—up 17% in the first half of 2025, according to Resilience—the stakes have never been higher. Understanding the nuances of cyber risk and insurance coverage is crucial for brokers working with data center clients.

This article delves into the critical questions surrounding cyber insurance for data centers, emphasizing the importance of documented security controls, the implications of state-sponsored attacks, and the evolving nature of underwriting criteria. As we explore these factors, we will outline key strategies that brokers can employ to enhance their clients' cyber risk management and insurance outcomes.

The Rising Cost of Cyberattacks

The financial toll of cyberattacks is escalating rapidly, particularly for data centers. The rise in ransomware attacks, which can cripple operations and lead to significant financial losses, underscores the urgency of effective cyber risk management. Data centers are uniquely vulnerable due to the volume of sensitive data they handle and their role as critical infrastructure. Karen Kutger, a wholesale production leader for management, professional, and cyber at Novatae Risk Group, highlights that the catastrophic risk associated with data centers is a significant concern. "There could be billions or trillions of data points at risk, not to mention the cascading business interruption issues," she notes.

As cyber threats evolve, brokers must be proactive in addressing these risks with their clients. This includes having thorough discussions about existing security controls and the potential for catastrophic events that could disrupt operations. Understanding the broader implications of a successful cyberattack is essential for brokers to frame the risk conversation effectively.

Security Controls: A Key Element in Underwriting

One of the most crucial factors that insurers consider when underwriting cyber risk for data centers is the presence and enforcement of security controls. The quality and documentation of these controls can significantly impact premium rates. According to Kutger, there can be up to a 35% variation in premiums between comparable facilities based on the robustness of their security measures. This highlights the need for brokers to ensure their clients have well-documented security protocols in place.

Common Gaps in Security Practices

Despite the growing awareness of cyber risks, many data centers still struggle with inconsistent enforcement of security protocols. For example, multi-factor authentication (MFA) is a critical security measure, yet some data centers fail to implement it uniformly across all access points, leaving vulnerabilities in their systems. Kutger points out that underwriters are increasingly focused on seeing MFA applied to all remote access, privileged accounts, and cloud applications.

• Multi-Factor Authentication (MFA): Essential for secure access but often inconsistently applied.
• Endpoint Detection and Response (EDR): Gaps in coverage can leave systems exposed to threats.
• Encrypted Backups: Necessary to safeguard data during an attack.

Brokers who identify and address these gaps before submission can better manage client expectations and negotiate more favorable insurance outcomes. Insurance carriers often conduct external scans, and any identified open remote access ports can complicate underwriting processes.

The Impact of State-Sponsored Attacks

The threat of state-sponsored cyberattacks is another critical factor in the cyber risk landscape for data centers. As Kutger notes, large data centers are almost certainly targets for these attacks, which can have devastating consequences. State-sponsored threats often involve sophisticated tactics and resources that can overwhelm typical security measures.

This reality necessitates that brokers discuss these risks with their clients explicitly. Understanding the likelihood of such attacks and their potential impact on business operations is essential for developing robust cyber insurance coverage. The conversation should not only focus on current threats but also on the evolving landscape of cyber risks, including geopolitical factors that may influence the frequency and intensity of attacks.

Adapting to the AI and Operational Technology Landscape

As technological advancements continue to reshape the data center environment, new risks are emerging, particularly concerning artificial intelligence (AI) and operational technology. AI systems can introduce unique vulnerabilities, and the insurance industry is still grappling with how to address these exposures adequately.

Seeking Comprehensive Coverage

Brokers must advocate for explicit language in policies that addresses AI-related risks rather than accepting policies that remain silent on the issue. This includes coverage for potential liabilities arising from AI output, such as accuracy and bias, as well as emerging threats like deepfakes and biometric claims. The insurance market has yet to establish a standard approach to these risks, placing the onus on brokers to push for comprehensive coverage that protects against these evolving threats.

It is crucial for brokers to ask not only what is covered in a policy but also what is omitted. As the cyber landscape evolves, the risks associated with AI and operational technology will continue to grow, making it essential for brokers to stay informed and proactive in their approach to risk management.

Key Takeaways

• **Security controls are critical:** The quality and documentation of security controls can significantly influence premium rates.
• **Understand state-sponsored threats:** Brokers must proactively discuss the risks associated with state-sponsored cyberattacks with clients.
• **Push for comprehensive AI coverage:** Advocate for explicit policy language addressing AI-related risks and emerging threats.
• **Identify gaps in security practices:** Brokers should work to uncover and address inconsistencies in security measures before submission.

Frequently Asked Questions

What types of security controls should data centers have in place?

Data centers should implement a range of security controls, including multi-factor authentication (MFA) for all remote access and privileged accounts, endpoint detection and response (EDR) systems, and regular security audits. Additionally, data centers should ensure that backups are encrypted and disconnected from the network to protect against ransomware attacks. A comprehensive approach to security will help reduce vulnerabilities and improve the overall risk profile when seeking insurance coverage.

How can brokers effectively communicate cyber risks to clients?

Brokers can effectively communicate cyber risks to clients by framing the conversation around the potential financial and operational impacts of cyberattacks. This includes discussing the costs associated with ransomware attacks, the implications of state-sponsored threats, and the importance of robust security controls. Utilizing real-world examples and data can help clients understand the severity of the risks and the necessity of comprehensive insurance coverage.

What is the role of underwriters in assessing cyber risk for data centers?

Underwriters play a critical role in assessing cyber risk for data centers by evaluating the security controls in place, analyzing historical claims data, and considering external factors such as the prevalence of state-sponsored attacks. They use this information to determine the insurability of a data center and to set appropriate premium rates. A thorough understanding of a data center's risk profile is essential for underwriters to make informed decisions.

Why is it important to address AI-related risks in cyber insurance policies?

Addressing AI-related risks in cyber insurance policies is essential as AI technologies become increasingly integrated into data center operations. These risks can include potential liabilities arising from AI outputs, threats associated with deepfakes, and the security of biometric data. As the landscape of cyber threats evolves, having explicit coverage for these risks ensures that data centers are protected against emerging challenges, allowing them to operate with confidence in a digital world.