The FORGE lens: five domains

Risks are organized under five infrastructure domains that spell FORGE:

F — Fleet integrity: trust in the hardware, firmware, software artifacts, images, dependencies, and supply paths that make up the fleet.

O — Operations & management planes: privileged systems used to control and administer AI infrastructure, including BMCs, schedulers, orchestration, automation, and admin tooling.

R — Resource isolation: the boundaries that separate tenants, workloads, execution environments, and reused infrastructure across shared AI systems.

G — Grid: the networking fabrics and facility systems that connect AI clusters and keep them powered, cooled, and operational.

E — Evidence & exposure management: the evidence customers need to understand provider security maturity, audited scope, exposed services, and patch velocity.

The 2026 Top 10 risks

Ordered by severity, highest first.

1. FORGE-01 — Hardware & Firmware Integrity Compromise — Critical

2. FORGE-02 — Network & Interconnect Vulnerabilities— Critical

3. FORGE-03 — Unsafe Multi-Tenant Isolation and Resource Reuse — Critical

4. FORGE-04 — Insecure Out-of-Band Management Plane— Critical

5. FORGE-05 — AI Infrastructure Supply Chain Compromise— Critical

6. FORGE-06 — Insecure Facility & Data Center Management Systems — High

7. FORGE-07 — Insecure Data and Artifact Handling — High

8. FORGE-08 — Certification Gaps & Provider Transparency Failures— High

9. FORGE-09 — Insecure Operational Infrastructure Services — High

10. FORGE-10 — Vendor Embargo Gaps & Patch Velocity Failures— Medium

Each risk follows a consistent structure: Definition, Description, Impact and Failure Modes, Prevention and Mitigation Strategies (for providers and for customers), Attack Scenarios, and References.

Threat model

Controls are calibrated against the full set of realistic adversaries, not just the external attacker: compromised cloud customers, malicious insiders on both the enterprise and provider side, contractors and system integrators with scoped access, in-transit adversaries in the hardware supply chain, upstream suppliers, and AI agents acting on behalf of any of them.

How risks were selected

Candidate risks were drawn from:

• Analysis of security research, incident reports, and published CVEs affecting AI-specific components.

• Review of vendor security documentation from NVIDIA, AMD, and major cloud providers.

• Observed vulnerability patterns across neocloud environments and ML orchestration platforms.

• Discussions with security practitioners working in AI infrastructure across multiple verticals.

Each candidate was evaluated against three dimensions, Likelihood, Impact, and Detection Difficulty, with the highest-scoring risks selected for inclusion.