The rapid expansion of AI infrastructure is driving investment in data centres to record levels. At the same time, power density, technical complexity and reliance on energy, cooling and communications systems are all increasing. This is also fundamentally altering the risk profile of these facilities. An analysis by Allianz Commercial highlights where the greatest risks lie – and why security and resilience must be built in right from the planning and construction stages.

Data centres are becoming one of the key infrastructures of the digital economy. Driven by the rising demand for computing power for artificial intelligence, Allianz Commercial estimates that global annual investment could grow from around 500 billion US dollars in 2024 to more than one trillion US dollars as early as 2027.

This expansion extends far beyond server capacity. Power generation and grid connection, cooling systems, fibre-optic infrastructure, semiconductors and high-performance backup systems are becoming part of an increasingly complex overall architecture. At the same time, large-scale hyperscale and colocation campuses are emerging, with a high concentration of technical and economic value.
This is also changing the requirements for security. Data centres are no longer merely relatively standardised technology properties. They are becoming highly densified infrastructure systems whose availability depends on a multitude of internal and external factors.

Complexity increases the potential for damage

Significant risks arise even during the planning and construction phases. Multi-storey buildings, high structural loads, compressed construction schedules, last-minute planning changes and complex interfaces between trades increase the demands on quality assurance and project management
The use of prototype, modified or temporary technical systems can also increase the potential for damage. The testing and commissioning phase is particularly critical. At this stage, central systems are operated for the first time under realistic load conditions and, in some cases, pushed to their intended performance limits.

Hidden defects, faults at interfaces or inadequately tested backup systems can reinforce one another in the process. What begin as limited technical problems can thus result in extensive property damage and business interruption losses.
Real-world cases illustrate the scale of the issue: damage to external cooling systems, fires resulting from hot work, or delays in commissioning due to power supply disruptions have led to losses of between 50 and 100 million euros at hyperscale facilities.

Fire incidents with particularly high financial impact

Allianz Commercial’s loss analysis reveals a striking correlation between frequency and the level of loss. Whilst fires occur relatively rarely, they cause particularly high losses. More than half of the total loss volume examined – around 700 million euros – is attributable to fire incidents.
In terms of the number of claims, however, water damage ranks first. This is followed by wilful damage, fire and machinery damage. The figures illustrate that data centres’ security strategies cannot focus on individual types of risk.
At the same time, the fire risk changes as power density increases. Lithium-ion-based battery storage systems are playing an increasingly important role. In the event of so-called thermal runaway, a fire within a single battery cell can intensify and spread to other cells. The resulting temperatures and fire behaviour place high demands on detection, structural separation and fire-extinguishing technology.
However, fire suppression systems themselves must also be included in the risk analysis. False or unintentional activations can damage sensitive IT components through moisture, contamination, pressure changes or vibrations. Consequently, coordinated approaches combining very early fire detection, fire compartmentation and appropriate fire suppression technology are required.

Power supply becomes a critical safety factor

Hardly any other dependency is as fundamental to the operation of a data centre as the power supply. High connected loads, stable electricity grids, redundant supply paths and high-performance backup systems are prerequisites for high availability.
However, as facilities grow, so too does the complexity of this energy architecture. On-site power generation, battery storage, temporary supply systems and additional backup solutions can enhance resilience, but they also create new technical dependencies and additional fire and failure risks.
Cooling and water supply are also becoming increasingly important. Higher computing power generates greater heat loads, whilst water availability and environmental regulations are increasingly becoming limiting factors at numerous sites.
Added to this is the external communications infrastructure. Data centres rely on fibre-optic connections and network nodes located outside their own premises. A site may therefore be fully functional from a technical perspective yet still be significantly impaired by a disruption to upstream infrastructure.

Climate risks are becoming a site selection issue

An additional challenge arises from the geographical distribution of the facilities. According to the Allianz analysis, around 79 per cent of global data centre capacity is already located in areas with an elevated risk of natural disasters. 54 per cent are exposed to chronic heat or drought stress.
The risk profiles vary significantly. In the Americas, flooding, wildfires and storms play a particularly significant role. In the Asia-Pacific region, by contrast, heat and water scarcity are more prominent concerns.
The potential economic consequences are substantial. Allianz Commercial estimates the climate-related loss in value of the global data centre infrastructure, prior to any adaptation measures, at around 388 billion US dollars.
However, the risk of direct damage to buildings is not the only decisive factor. A significant proportion of potential business interruptions arises outside the actual site itself. According to the analysis, more than 90 per cent of the modelled business interruption losses due to climate risks are attributable to disruptions in upstream supply chains and infrastructure.

High concentration of value creates accumulation risks

Hyperscale and colocation facilities concentrate enormous technical and economic value within a confined space. Operators, various customers, construction companies, server technology, utility systems and other infrastructure may be located on the same campus or share common systems.
This gives rise to significant accumulation risks. The failure of a central power supply, cooling system, building management system or data connection can affect numerous users simultaneously and trigger claims across different areas of insurance cover.
In addition to property damage, there is a risk of business interruption, liability issues and contractual consequences. If guaranteed availability, capacity or service levels are not met, this can result in contractual penalties, claims for damages and the loss of customers.
Added to this is the difficulty in sourcing spare parts. Allianz Commercial quotes delivery times of up to 80 weeks for switchgear and up to 50 weeks for transformers. Technical failures can therefore have an impact on operations over long periods.

Security begins right from the design stage

Against this backdrop, it is clear that data centre security cannot be added as an afterthought. Risk management must be part of the facility concept right from the planning phase.
Key factors include a building structure designed for its intended purpose, sufficient spatial separation of critical systems, robust structural integrity, clearly defined fire compartments, and controlled vertical cable and supply routes. These are complemented by suitable systems for the early detection of fire, overheating and battery problems. During the construction phase, the focus is on rigorous quality assurance, realistic timetables and the safe handling of temporary systems. Critical technical components must also be protected from damage during transport and storage.
Commissioning requires particular attention. Sufficient testing time, clearly defined responsibilities and a structured troubleshooting process are crucial before facilities transition fully to normal operation.
During ongoing operations, preventive maintenance, condition monitoring, leak detection, redundant cooling, well-maintained fire protection systems and robust emergency and business continuity plans become increasingly important.

Resilience becomes part of the security architecture

The AI-driven expansion of data centre infrastructure is thus also raising the bar for security. Individual protection systems are not sufficient when power supply, building services, cooling, communications and supply chains are closely interlinked.
For operators, this means increasingly viewing physical security as an integral part of an overarching resilience strategy. Fire protection, access control, technical surveillance, power supply and business continuity must be planned and operated as an integrated whole.

As the economic significance of data and computing power increases, so too does the importance of each individual site for businesses and society. Data centres are thus definitively becoming critical hubs of the digital infrastructure. Their security depends not only on how effectively individual threats are mitigated, but also on how resilient the overall system is against technical faults, natural hazards and complex chains of failure. [ML]