OWASP Top 10 Neocloud & AI Data Center Security Risks

Security guidance for the infrastructure powering AI

AI workloads depend on complex infrastructure spanning accelerators, high-speed networks, storage, orchestration platforms, identity systems, management planes, firmware, and physical facilities. In neoclouds and AI data centers, these layers support high-value workloads and may be shared across multiple customers, making weaknesses in isolation, configuration, and operational controls especially consequential.

The OWASP Top 10 Neocloud and AI Data Center Security Risks provides a practical, vendor-neutral framework for understanding and reducing the most significant security risks across these environments. It helps providers, operators, customers, and security teams assess architectures, evaluate security controls, prioritize improvements, and establish a shared language for AI infrastructure security.

What this project covers

This framework focuses on the security of AI infrastructure and the data centers that house it: the physical hardware, networking fabrics, management planes, orchestration systems, storage systems, and operational environments on which AI workloads run.

It does not focus on AI models themselves or application-layer risks such as prompt injection, insecure agent behavior, model abuse, or model-level evaluation. Those risks are addressed by frameworks focused on other parts of the AI stack, including the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework, and ISO/IEC 42001. Together, these resources give practitioners a more complete picture of AI security, from governance and application-layer risks down to the underlying compute infrastructure.

Who it is for

• Neocloud providers and data center operators can benefit from the framework as a practical guide to the AI infrastructure threat landscape, attack surface review, environment hardening, security prioritization, and maturity demonstration.

• Neocloud customers can benefit from the framework as a practical guide for procurement, security reviews, contractual requirements, provider comparison, and assessing resilience against realistic tenant-to-infrastructure compromise.

• Hybrid Cloud security teams can benefit from this framework as a practical guide for configuring, maintaining, and securing their on-premise footprint against modern attacks, which can quickly pivot between environments.