Beyond uptime: Managing security, crisis and insurance risks for data centers

Hello, and welcome to this episode of The WTW podcast, Digital Uptime. It's dedicated to digital infrastructure and data center risk management. I'm George Haitsch. And I'm delighted to be your host today. I currently lead the tech media industry team here at Willis, a WTW business.

It's a real pleasure to be joined today by my colleagues-- Kate Colberg, Alert:24 Risk Advisory Lead for North America; and Pete Bransden, head of crisis management for North America. Both Kate and Pete bring deep expertise across data center security, resilience, risk management, and insurance. Welcome, Kate and Pete. Perhaps you could take a moment to introduce yourselves.

KATE COLBERG: Thanks, George. My name is Kate Colberg. I am the head of risk advisory for Alert:24 North America, based out of Houston, Texas.

PETE BRANSDEN: I'm Pete Bransden. And I lead crisis management in North America. And I'm here in sunny South Florida.

GEORGE HAITSCH: Terrific. In this episode, we're exploring the evolving risk landscape of the data center sector. We'll discuss why data centers have become one of the world's most important asset classes, how community concerns are shaping resilience and security strategies, and what distinguishes best-in-class risks from an insurance perspective.

We'll also examine where organizations are most vulnerable in crisis preparedness, discuss practical approaches to mitigating security threats, and explore what separates a well-structured insurance and risk financing program from one that may face challenges when losses occur or market conditions change. So let's jump right in. This first question is for Kate. Kate, why have data centers become one of the most strategically important asset classes in the world? And how does that change the risk landscape for owners and operators?

KATE COLBERG: Yeah, it's very interesting because AI has become so extraordinarily important, almost a linchpin for many industries. And that is a direct correlation as to why data centers have become so strategically important. And obviously, that raises their risk profile because anything that is regarded as strategically important immediately becomes an attractive target for hostile groups, nefarious individuals, anyone who wants to cause any of disruption.

Beyond the anti-AI slash anti-data center activists, any activist group, a terrorist organization looking for a good target to seriously affect the everyday population, data centers are an extraordinarily attractive target. And now that data centers are not only looking to protect themselves against everyday threats, protests and such, they need to start considering that bigger terroristic organizations may find them as attractive target as well and, as such, protect themselves against that.

GEORGE HAITSCH: Thank you. That's very thoughtful and comprehensive. Well, we've all heard stories about community resistance to data centers. It's in the press all the time. Can you share a few examples of the local issues operators are increasingly facing and why those concerns matter from a security and a resilience perspective?

KATE COLBERG: Yeah. So the issue with community resistance has been ongoing for quite some time. But what is concerning is we've seen escalating violence, particularly over the last 6 to 8, even 12, months, really. And this is where that security and operational resilience issue comes into play.

There have been a number of incidents where protests have turned into a serious safety issue with vessels, balloons. And other objects filled with dangerous chemicals have been thrown at sites. Sometimes, it's the data center construction site. And sometimes, it's the data center themselves.

We've seen attacks on a CEO. A Molotov cocktail was thrown at his house. And this is where data centers really need to make sure that they have a strong security response and operational resilience program in place. Because if the past is any indication of the future, then these activist groups that conduct these increasingly violent protests are just going to continue ratcheting up the pressure.

So how much more violent can they get? They've already started harassing leadership. And even the politicians who support data centers have had attacks and harassment. Will they start harassing the regular employees? And what might that look like?

A strong security program and strong operational resilience program is going to help deter some of these issues. And if they don't, they will be able to mitigate the damage to the data centers.

GEORGE HAITSCH: I appreciate that perspective. This next question is for you, Pete. What characteristics make a data center portfolio attractive to insurers? And what characteristics may cause concern?

PETE BRANSDEN: I think from a terrorism political violence underwriting perspective, which is a world I came from, I think data centers are actually viewed quite favorably because operators of data centers understand that uptime is everything. So when we present these risks to insurers, we spend a lot of our time highlighting the resilience features that are built into the facilities.

And I know that underwriters want to hear about things like redundant power feeds, backup generation, the physical security, business continuity planning, and the crisis management capabilities. These are engineered to withstand disruptions in a way that many other industries of a similar value are not. And of course, they don't have to deal with legacy systems. So those are the rule of the positives. And of course, we emphasize those positives extensively.

I think where concerns arise are around things like the concentration of exposure and, of course, now the strategic importance. These data centers have become critical infrastructure, national security infrastructure almost for the digital economy. And the disruption can impact not just a single company but potentially hundreds or thousands of organizations at the same time.

So as geopolitical tensions increase, the insurers that we speak to are asking more questions about whether these facilities could become symbolic or economic, strategically significant targets. I think they're also looking closely at issues like the clustering of assets, dependence on external power infrastructure, the community opposition that we've mentioned before.

So we take our job as brokers very seriously in demonstrating that while these facilities are critical, they're also among the most resilient and well-prepared assets in the built environment. And the operators that can clearly evidence those resilience measures generally achieve the best outcomes in the market.

GEORGE HAITSCH: Very comprehensive. Thanks, Pete. Based on your experience advising center operators, where do you see organizations most commonly unprepared? And frankly, what are the consequences when a crisis occurs?

PETE BRANSDEN: One of the biggest gaps that we see is that organizations, sadly, in my mind, they still think about security threats through a traditional lens, while what we're seeing is that the threat environment is evolving significantly. So as I mentioned, data centers are this critical infrastructure ecosystem. So they're exposed to a real broad spectrum of politically motivated activity.

In the US, traditionally, operators have purchased terrorism insurance through the TRIA-backed program, the Terrorism Risk Insurance Act-backed program, or TRIP. And they assume that they're protected against politically motivated loss events. What they can overlook, though, is that not every hostile act will meet this very strict definition within TRIA of a certified act of terrorism.

Things like acts of sabotage, malicious damage, other politically motivated activity may sit outside of that TRIA definition. And that creates a whole that I think is really important to address. Because if those same exposures or losses are excluded in a property program, there's a coverage gap that's created that needs to be filled.

We're also seeing a growing discussion around what's called gray zone activity, which are situations that fall somewhere between peace and conventional warfare-- so not explicit acts of war but essentially state-sponsored infrastructure sabotage or events where the attribution is difficult because no one's leaving receipts. These kind of scenarios create a lot of uncertainty as to around traditional coverages and how they should respond and which policy is intended to pick up the loss. And there's a degree of finger pointing.

So as a result, there's an increase, almost surprisingly, in standalone political violence coverage, even for United States assets. It's still rare. But we're seeing, particularly in 2026, a huge increase in clients seeking quotes for war coverage in the US and, indeed, abroad. So it's all about understanding how evolving geopolitical threats impact operations and ensuring that traditional risk strategies can keep pace with those.

GEORGE HAITSCH: Excellent. So Kate, turning to solutions, how should data centers try to mitigate their security risk?

KATE COLBERG: There's a multi-layered answer to that. They really need to start with intelligence and scenario-led risk management. So a strategic threat assessment and site assessment security risk reviews throughout the development of the life cycle, identifying anticipated risks from activism, extremism, criminality, and even broader geopolitical drivers.

We have worked with clients. And we've done estimated maximum loss assessments, assessing credible threat scenarios and modeling potential operational, financial, and reputational impacts to support risk management. This is where we've had significant success around the Middle East.

An activism risk management program, which is a structured framework incorporating activist threat assessments, stakeholder mapping, intelligence monitoring, protest forecasting, this includes a preparedness for protest management, site lockdowns, business continuity arrangements, evacuation, and incident management. And then operational resilience consulting, which is designing resilient operating models capable of anticipating, withstanding, and recovering from disruptive events-- this includes identifying critical activities and dependencies, assessing vulnerabilities across sites, and supply chains, developing response and recovery capabilities, and exercising crisis management arrangements, strengthening their resilience through the construction and operational phases. So from the very beginning.

GEORGE HAITSCH: Terrific. So Pete, when a data center operator approaches the insurance market, what distinguishes a well-structured program from one that is likely to face challenges at renewal or following a major loss?

PETE BRANSDEN: I think that the best programs start with a clear understanding of what the organization's risk profile really is rather than just a shopping list of traditional insurance products. We see that sophisticated operators, when they're at their best, articulate what the critical dependencies are. They've quantified downtime impacts. They can demonstrate resilience measures and show how physical, how cyber, or operational third-party risks interact.

That allows us to show insurers or to elicit confidence within the insurers that the risk management system is robust and that we can build risk transfer solutions to fit the exposure. I think when programs struggle is when they view these risks in isolation. So where a cyber event may trigger physical consequences, that's where we see a lot of gaps. Where power disruption can create contractual liabilities or if a community issue evolves into an operational disruption-- if those connections aren't understood beforehand, these traditional insurances can be exposed to coverage gaps. So I think the strongest programs are built on, of course, robust risk management and a knowledge that insurance works best when it complements resilience rather than just replaces and transfers it.

GEORGE HAITSCH: Got it. What trends are you seeing from insurers now that will shape data center risk transfer strategies perhaps over the next three to five years?

PETE BRANSDEN: I think there are three major trends. I think first, insurers are becoming more interested in systemic exposures. They're looking beyond individual facilities and asking the question of what happens if a regional power grid fails, if a critical technology supplier is disrupted, if multiple events happen at the same time.

I think second, there's a growing focus on the convergence of cyber and physical risk, which is something I alluded to earlier. Historically, these have been viewed by both risk managers and the insurance market as separate. But I think, increasingly, there's a recognition that cyber events can cause physical damage.

I think third is there's a greater scrutiny around energy resilience, climate resilience, and operational continuity. I think as data centers become more important, they continue this path onto their strategic economic importance, insurers are going to want confidence that they can operate during periods of real stress and uncertainty.

GEORGE HAITSCH: Got it. So Kate, looking ahead, what risks do you believe will have the greatest impact on the data center sector that are not receiving enough attention today?

KATE COLBERG: This is an interesting one because this is something that our team at Alert:24 we've talked about quite a bit. It actually has come around in literally the last couple of weeks to be a little more front and center. But it's still something that we're talking about.

The biggest underappreciated risk is that data centers are no longer just critical infrastructure. They're becoming a symbolic infrastructure. So as concerns around AI, energy consumption, water use, noise, the labor displacement issue grow, data centers are increasingly likely to become a focal point for activism and political intervention and social disruption.

I think that's where the market is still slightly behind the curve. The sector spends an enormous effort thinking about the cyber, physical security, and resiliency engineering but less time considering how data centers could become a contested assets in the same way that airports, pipelines, fossil fuel projects, and other strategically important infrastructure have been in recent years. Those assets get attacked from every angle of risk, all with the intention to slow and disrupt.

So as AI integration accelerates, so will resistance to it. And opposition to AI is likely to further coalesce into a prominent driver for protests globally, creating conditions for coordinated campaigns that could extend across the national borders. In terms of not receiving enough attention, they are recognized. But I'm not fully sure that it's understood and certainly not the full plausible scenario analysis of how this might evolve and impact them in the future.

GEORGE HAITSCH: I agree completely. It's evolving every week. It's amazing, the pace of change and the attention that it's getting. So Pete, maybe you could share an example of how a sophisticated risk financing strategy helped one of our data center clients address a difficult exposure.

PETE BRANSDEN: Absolutely, yeah. And maybe I can address the elephant in the industry, which is regarding capacity. There's been a lot of discourse about how data centers will stress or exhaust capacity in the industry.

So I can talk to the political and violence or the terrorism political violence insurance market, which is growing. It's very deep but isn't limitless. So when a client came to us seeking billions of dollars of terrorism coverage to satisfy lenders requirements, that is a struggle in the TPV market, where normal limits somewhat rarely approach a billion.

So where I think the Willis sophistication comes into play is utilizing our knowledge of public pools-- in this case, it's the TRIA pool or the Terrorism Risk Insurance program-- and accessing that through a client's captive-- and indeed, we can assist in creating captives, on lending out captives-- and then seeking reinsurance for anything that the public pool doesn't cover, which essentially means that you're buying reinsurance for a fractional amount of the normal insurance that you would buy when accessing the direct market without going through this captive pool.

So it's something that allows our clients to tap into billions of dollars of limit while keeping their third-party risk transfer costs relatively small. It's tried and tested. And it certainly satisfies this kind of growing need for billion dollar limits in the industry.

GEORGE HAITSCH: Excellent. So this is a question for both of you. How does the combination of Alert:24's risk advisory services and Willis' global broking platform create a stronger solution for clients? Kate, maybe you first.

KATE COLBERG: I can start, yeah. I think it's an extraordinary benefit for our clients because I believe that we are one of the only industry, if not the only, that has a capability such as Alert:24 in-house. So all of the clients, all of Peter's clients and his team's clients, have the ability to not only come to them for their solutions in terms of insurance. But as they're walking through their risks, as they're walking through their concerns, we can sit alongside of them and start helping them address those concerns. And as we're doing that, the broker is seeing that their clients are already starting to address things that might be a concern to an underwriter.

PETE BRANSDEN: I totally agree. I'm probably just going to be echoing what you said, Kate. But I think we have a really powerful combination, which is that we're able to address both sides of the equation, risk mitigation and risk transfer.

The worst case scenario is when organizations engage security advisors that don't understand insurance and insurance brokers that aren't involved in operational security. I think that what's different at Willis with Alert:24 is that we can help clients identify, assess, mitigate the risks through intelligence, resiliency planning, and crisis management support before we've even considered going to the insurance market such that when we do, we're in a really powerful position.

GEORGE HAITSCH: Terrific. Great answers from both of you. And I love how they tie together. We're coming up against time. So thank you, Kate and Pete, for sharing your expertise and valuable perspectives.

SPEAKER 1: Thank you for joining this podcast from Willis, a WTW company, featuring the latest thinking and perspectives on people, capital, climate and risk in the construction industry. For more information, visit wtwco.com. WTW offers insurance-related services through its appropriately licensed and authorized companies in each country in which WTW operates.

For further authorization and regulatory details about our WTW legal entities operating in your country, please refer to our WTW website. It is a regulatory requirement for us to consider our local licensing requirements. The information given in this podcast is believed to be accurate at the date of publication. This information may have subsequently changed or have been superseded and should not be relied upon to be accurate or suitable after this date.

This podcast offers a general overview of its subject matter. It does not necessarily address every aspect of its subject or every product available in the market. And we disclaimer all liability to the fullest extent permitted by law.

It is not intended to be and should not be used to replace specific advice relating to individual situations. And we do not offer and this should not be seen as legal, accounting, or tax advice. If you intend to take any action or make any decision on the basis of the content of this podcast, you should first seek specific advice from an appropriate professional.

Some of the information in this podcast may be compiled from third-party sources we consider to be reliable. However, we do not guarantee and are not responsible for the accuracy of such. The views expressed are not necessarily those of WTW.