Neoclouds
Neocloud Users
AI Data Centers
Enterprise Data Centers
Visibility & Posture
Verify Rented Capacity
Risk Prioritization & Hardening
Red Teaming & Pen Testing
Runtime Detection & Response
Compliance & Audit Readiness
The OWASP Top 10 Neocloud and AI Data Center Security Risks
Harden the metal beneath the model.
A targeted, actionable framework for neocloud providers, security architects, CISOs, and teams building, operating, securing, or procuring AI compute infrastructure across data centers.
Neoclouds and AI data centers are being built faster than they are being secured.
Demand for AI compute has driven a rapid expansion of neoclouds and AI data centers. Much of this infrastructure was built for a single trusted operator, yet it now runs high-value workloads for many unrelated customers on shared hardware. GPU scarcity increases the risk as companies focus on bringing GPUs online before security matures.
The OWASP Top 10 Neocloud and AI Data Center Security Risks, an OWASP incubator project, gives providers, operators, customers, and security teams a shared language to assess architectures and secure the infrastructure AI runs on.
The OWASP Top 10 Risks
A practical framework for identifying, prioritizing, and reducing the most critical security risks in this infrastructure, and for translating them into concrete security requirements.
- 01Firmware & Hardware Integrity CompromiseUnauthorized firmware or hardware changes can create persistent compromise below the operating system, surviving rebuilds, disk wipes, and tenant reassignment.Critical
- 02Network & Interconnect VulnerabilitiesWeak fabric isolation, management protection, and monitoring can expose InfiniBand, RoCE, and RDMA paths to discovery, abuse, or lateral movement.Critical
- 03Unsafe Multi-Tenant Isolation and Resource ReuseFailures in shared or reassigned infrastructure can let tenants cross boundaries, observe residual state, discover other workloads, or degrade neighboring jobs.Critical
- 04Insecure Out-of-Band Management PlaneWeaknesses in BMCs, management protocols, networks, and fleet tools can give attackers hardware-level control outside the host OS.Critical
- 05AI Infrastructure Supply Chain CompromiseUnverified hardware, firmware, images, drivers, packages, models, or infrastructure artifacts can introduce compromise through trusted supply paths.Critical
- 06Insecure Facility & Data Center Management SystemsWeaknesses in cooling, power, DCIM, access control, or facility networks can disrupt AI workloads, expose asset maps, or bypass server-side defenses.High
- 07Insecure Data and Artifact HandlingWeak controls over datasets, prompts, logs, embeddings, checkpoints, model weights, caches, backups, and deployment artifacts can enable exposure or tampering.High
- 08Certification Gaps & Provider Transparency FailuresCustomers may rely on certifications, attestations, or provider claims that do not clearly cover the infrastructure actually running their workloads.High
- 09Insecure Operational Infrastructure ServicesCompromise of schedulers, control planes, provisioning workflows, automation, or admin interfaces can give attackers broad control over AI workloads and nodes.High
- 10Vendor Embargo Gaps & Patch Velocity FailuresDelayed disclosure, slow patching, disruptive updates, and version drift can leave AI infrastructure exposed to known vulnerabilities.Medium
Reviewed by practitioners across the AI infrastructure stack
Tony Rea
Global AI Infrastructure Lead
Daniel Iziourov
Director of Platform Security
Assaf Namer
Head of AI Security
Roey Yaacovi
CTO, DSPM & AI Security
Selim Aissi
Former Vice President, Global Information Security, Visa & Intel
&
Vjaceslavs Klimovs
Senior Technical Director
James Berthoty
Founder & CEO
Bill Stout
Former Technical Director, AI Product Security, ServiceNow
Tyson Macaulay
Deputy Director
Golan Ben-Oni
CIO/CISO
Florina Ciorba
Associate Professor, Head of High Performance Computing group
Arthur Reed
Security Engineer
Erik Deumens
Director Research Computing
Saad Malik
CTO
Guy Bilitski
Leading AI Operations
Michael Bargury
CTO
Amir Jerbi
Former CTO, Aqua Security
Ziv Karliner
CEO
Dan Farmer
Security Researcher
Individual contributorsAssaf Morag
Security Researcher
Individual contributors