Data centers are one of the fastest growing vertical markets for the security industry, with distinctive security needs and priorities during three different phases: pre-construction, construction and operation.  As hyperscale and “mega” data centers become increasingly critical to global commerce, communications, and national resilience, they are also emerging as higher-value and more visible physical security targets—often well before they become operational. 

A panel of experts looked at the priorities for each phase during GSX 2026, Sept. 15 in Atlanta. Panel speakers included:

• Shezad A. Moten, Marksman Security / Titan Security Group, moderator
• Charles Margiotta, Senior Vice President, Corporate Security at QTS Data Centers
• Greg Bowman, CPP,  Director, Physical Security - Design & Construction at Crusoe AI
• Lee Cochran, Global Security Manager, Meta

Though these numbers are rapidly changing, the U.S. market included 5,427+ data centers, with 75 potential data center sites blocked in 2026. There’s a common misconception that China is the leader in data centers and has a jump on the United States. The panelists dispelled that, noting that the U.S. has 45% of the global market.

Security needs to be part of the data center plan at its inception, before the community is notified and well before any signage is erected and ground is broken, the panelists agreed. However, the three distinct phases – pre-groundbreaking, construction and operation – all have unique security needs.

Phase 1: Pre-Groundbreaking

The media is full of reports of community opposition to data centers, and as a result, 14 states and many more cities and counties have enacted moratoriums on data center development. 70% of Americans as polled opposed nearby data centers.

These were listed as the most common concerns driving opposition: water consumption, electricity price increases, noise pollution, environmental land use impact, suspicious behind-the-scenes political deals, and the limited job creation, post-construction.

As information and misinformation spread, the pre-construction threat levels surface.    Threat levels 1,2 and 3 can develop rapidly.

Level 1: Community organizing. Social media groups, planning commission appearances, petitions, misinformation campaigns targeting specific site proposals

“I want to point out the irony here. The opposition is being put together on social media. That’s data centers folks. If you have a phone, you’re participating in the data center environment,” noted Moten.

 Level 2. Formal opposition, legal challenges, zoning appeals. This is where lawsuits and attorneys get involved.

Level 3. In-person protests.

“The key factor there is you actually have to have the site, right? You want to have an on-site protest. So once it moves past the city commission meeting, until there's a point where there's a shovel on the ground, there's not much that can be done. There's not the quiet before the storm. But then when you actually break ground, that's when you start to have the on-site protest,” said Moten.

Top Level. Violence. The top level could be physical violence and sabotage directed towards data center executives, with several real-world incidents this year.

Public relations campaigns aimed at the communities can make some inroads with the first three levels. “We've gone into communities and we've tried to get there early on to show the benefits of what these data centers actually do right. We've been able to sort of check off on a couple of those concerns. Water usage, we're using closed loop systems. Electricity, we're going to be generating our own power depending on where we are….Especially at QTS, what we're trying to do is get to the community early on and to be a part of that community before we even start taking down trees, clearing land, and setting up the infrastructure,”  Margiotta said.

Early community engagement can counter some of the threats and spreading of misinformation, Bowman agreed, recommending that data centers put a public, personal face out in the community. “If you have a question, you have a face, you have a name, you have a contact number, and a real person, reach out to me. I'll have to answer your question for you. And those engagements, that relationship, it's not the big bad corporation of Charlie's data center company or Lee's data center company coming in to take over our community. We're here as a partner. The best reality of it is we want to be a community partner, having those conversations early, the sooner you can get in with the room, sit down with partners, communicate, and it goes a long way. It's been very successful for us.”

Phase 2: Construction

Physical site security comes to the forefront when construction begins, bringing forward the threats of onsite protests and vandalism, as well as life safety concerns and the need to keep workers and utilities secure.

Before construction, fencing and cameras need to be installed and materials must be secured. During construction, hundreds of subcontractors are going to be bringing in and training thousands of workers daily. Multiple entities that are governing the badging and access control process, creating significant challenges while trying to provide that layer, multi-layer of security.

“This is where the rubber hits the road. This is now you've gone from a field that has been vacant for dozens of years, maybe a generation to now. You've got 6,000 people swarming over it with hundreds of pieces of moving equipment. fiber coming in, there's a lot of disruption in the community. With disruption comes problems,” said Bowman.

“Vulnerability and threats have now shifted. Okay, so we've gotten past the public opposition. It's going to happen. Bulldozers are coming in. Here comes the actual physical workforce,” said Moten. He recommends low profile site management and limiting public branding if possible. “It doesn't necessarily have to have a Bucky's billboard, right?”

For a large build, some 10,000 construction workers are on the site every single day are the first asset that must be protected. They can also serve as part of the security team by being encouraged to report anything out of the ordinary.  The second group needing protection is the utility companies. Their teams are brought onsite to install the utilities needed to support the data centers.

Phase 2 recommendations:

Surveillance from day 1. Deploy PTZ cameras and 24/7 remote monitoring before trailers arrive. Many data center owners mandate full surveillance prior to any vertical construction.

Contractor vetting program. Require background checks on all trades via a consistent vendor program. Badge and register all workers; enforce escort policies.

High-value material controls. Catalog and mark copper, cable, generators and electrical equipment. Use just-in-time delivery; do not pre-order materials more than 72 hours before installation.

Tiered perimeter security. Fencing, gating and badge-controlled entry from mobilization. Separate material staging zones. Perimeter should be site-mapped and progressively hardened.

After-hours patrol protocol. Most construction theft occurs between 10 p.m. and 5 a.m. Manned patrols or contracted guard service during off hours is cost-effective vs. theft and insurance issues.

Construction OPSEC. Restrict visibility of site layout, utility routing and server hall footprint. Blueprints have been stolen from construction sites to facilitate future intrusion planning.

Phase 3: Commissioning

Once data center construction is finished and all the surveillance and access control systems and locks are operational, protecting the high-value equipment takes on greater importance. The workforce is now smaller and more permanent, with subcontractors and construction and utility workers no longer on site.

Phase 3 recommendations:

Multi-layer access control. Mantrap/airlock entry, multi-factor biometric credentials (fingerprint + facial + PIN), strict escort policies for all vendors. Minimum 3-5 security zones. Anti-Spoofing for biometrics. Liveness detection for facial recognition.

Zero-Trust Physical Access. Just-in-time, time-limited credentials. No standing access for any role. Immediate revocation upon terminations, project completion, or anomaly detection.

AI-Enhanced Video Analytics. AI-assisted CCTV for anomaly detection, crowd behavior analysis and automated tailgating alerts. Integrate with access control for real-time response.

Insider Threat Program. Pre-employment screening and continuous vetting for sensitive roles. Behavioral analytics monitoring. e after hours combined with unusual network traffic is a high-confidence indicator. Physical and cyber must share a single operations center.

Key Takeaways

The Boom is real – and so is the target. 1,331 U.S. projects in the pipeline, $700 billion investment, doubling global capacity by 2030. The scale creates an unprecedented target-rich environment.

Community Opposition is now a security threat. $130 billion in projects were blocked in early 2026. Online threats to physically sabotage facilities are proliferating. Treat opposition through a security lens. Not just PR

Traditional security approaches are no longer sufficient. Legacy perimeter models were built for static, single-phase threats. Hyperscale environments require intelligence-led, lifecycle-integrated programs that adapt from groundbreaking through steady-state operations.

Security must be lifecycle integrated from Day 1. Intelligence at announcement. Perimeter at mobilization. Access control at fit-out. Threat programs at commissioning. Starting at ribbon-cutting means you’ve missed the point.

Converge Physical and Cyber, no exceptions. 55% of incidents have insider involvement.