If you are a CISO or COO at a data center operator, you have almost certainly invested more in cybersecurity over the last several years than in anything else that carries the word security. That is reasonable. The threats are real, the customers ask about them constantly, and the tooling is mature. But I want to make a plain argument that cybersecurity cannot protect a data center by itself, and that the facilities most confident in their network defenses are often the ones with the softest floor.
I have spent my career on the physical side of this work, and the pattern I see in data centers is a mature cyber program sitting on top of a physical program that nobody has tested since the building was commissioned. The firewall rules are reviewed quarterly. The badge list has never been reviewed at all. The security operations center watches network traffic around the clock. The cameras record around the clock and nobody watches them. This article is about why that imbalance exists and what it takes to correct it.
Why Cybersecurity Cannot Protect a Data Center on Its Own
Every control in a cybersecurity program assumes the attacker is on the wrong side of a physical boundary. Encryption at rest matters when someone steals a drive, but it does nothing to stop someone from pulling the drive. Network segmentation matters when an attacker is remote, but a person standing at the rack with a console cable is not remote. Your customers understand this, which is why their audit questionnaires spend as much time on mantraps, escorts, and visitor logs as on patching. They are asking whether you can keep a human away from their hardware, and no amount of endpoint detection answers that question.
The uncomfortable part is that physical access is usually easier to obtain than network access. Getting through a hardened perimeter over the wire takes skill and time. Getting into a cage often takes a contractor badge that was never deactivated, a friendly guard who recognizes a face, and an escort policy that gets waived during a busy install window. I have watched all three happen, in facilities that had passed every audit put in front of them.
How the Imbalance Happens
The imbalance is structural rather than negligent. Physical security in most data centers reports either to facilities, where it is treated as a building system, or to the CISO, where it is treated as a compliance line item. Neither home gives it an executive who spends real time on it. The CISO is measured on network outcomes and hired for network expertise, so that is where the attention goes. Facilities is measured on uptime and cost. Nobody is measured on whether the mantrap actually stops tailgating, so nobody checks.
Budget follows the same path. Cyber tools come with dashboards, vendor briefings, and clear metrics, and they are easy to explain to a board. Physical security improvements are mostly labor, discipline, and review, which produce no dashboard and look like overhead. So the cyber program gets a new platform every year and the physical program gets the same guard contract renewed with the same post orders nobody has read since they were written.
Where the Two Programs Have to Meet
There are places where physical and cyber security are the same problem and have to be owned together. Access control systems run on the network and can be attacked from it. Badge data, biometric templates, and camera feeds are sensitive data that need the same protection as customer records. A terminated employee needs their network credentials and their physical credentials revoked in the same hour, by a process that does not depend on two departments remembering to talk to each other. Insider threat lives in both worlds at once, because the person with legitimate cage access and legitimate system access is the hardest case either program will face.
What this requires is a physical security leader with enough standing to sit across the table from the CISO as a peer. That leader owns the fence to the rack, tests it, and brings evidence. The CISO owns the network and does the same. Together they can answer a customer auditor directly instead of passing the question back and forth. In a mid-sized operator that physical leader does not have to be a full-time executive, but they do have to be an executive, with authority over the guard force, access control, and the vendors who touch either one.
What to Check This Month
Begin with the badge list. Export every active credential from your access control system and have someone who knows the business go through it name by name. Flag every contractor, vendor, and customer employee, and confirm each one still has a current reason to be there. In my experience this exercise finds more real exposure than a penetration test, and it costs nothing but an afternoon.
Then test the layers the way an outsider would. Send someone the guards do not know through the lobby with a plausible story and see how far they get. Watch the mantrap during a shift change and count how many people go through on one credential. Ask for last week’s visitor log and check whether the escorts listed were actually on shift. Pull an hour of camera footage from the cage floor and see whether anyone can tell you who the people in it are. Write down what you find. The point of this doctrine, which I lay out in Until Tested: Security Is Only Assumed, is that a control you have not tested is a control you are assuming, and assumptions do not survive contact with a determined person at the door.
Finally, put the results in front of the CISO and the COO together, in one meeting. If the physical findings are worse than the cyber findings, and they usually are, that is the case for giving physical security its own executive owner. Do not let it become another item on the CISO’s list. It will sink to the bottom again, because the network will always be louder.
Go Deeper
For a full explanation of how a part-time executive security director works alongside a CISO, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have a security leadership gap and shows how a fractional executive closes it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply