The Building That Runs the Cloud
The Building Is Part of the Cloud
The servers are easy to see. The systems that keep them alive often are not.
Walk into a data center and listen.
Fans. Pumps. Air moving through the room. A generator running its weekly test outside. Doors clicking open and shut. Rows of servers with blinking lights. Screens glowing in the operations center.
What you can't hear is the conversation underneath.
The cooling controller telling a chiller what to do. A sensor reporting from the hottest corner of a server hall. The uninterruptible power supply, or UPS, reporting to the power monitoring system. The badge reader deciding who gets through the secure door. The camera watching the loading dock. The vendor connection waiting quietly for someone to log in from far away.
Every time you ask an AI a question, a cooling system somewhere works a little harder.
A data center is a building that keeps servers alive. The cooling plant holds the temperature. The UPS and generators carry the load when the grid drops. Badge readers and cameras keep the right people in and the wrong people out. Sensors and alarms warn the team before a drift becomes an outage.
When all of that works, nobody thinks about it. That's the whole idea.
Less room for error
An AI rack runs hot. Really hot. AI chips, called GPUs, pack a lot of heat into a small space. Many new systems pipe liquid right to the hottest parts and use air for the rest.10
Uptime Institute's July 2026 survey found typical racks getting denser slowly, while more operators now run some racks at 30 kilowatts or more. The shift is real, but every hall is different.9
Liquid cooling also adds more small computers to watch. Pumps move the coolant. A cooling unit hands the heat from the rack's loop to the building's cooling. Sensors report leaks, temperature, flow and pressure. Some connect through a controller instead of having their own login.1211
How much time do you get if cooling stops? It depends on the load, the cooling design and the backup. Know your own number before the night you need it.
For an AI cloud company, stopped work can mean computing time it can no longer bill. For a colocation provider, the cost depends on what its contracts promise. Use your own numbers.
The scope stays clear. This book is about the building around the GPUs. Findavi does not protect the GPUs themselves or the fast network between them. Support for each liquid-cooling device, and each action, is confirmed at your site first.
Five teams, one building
Five teams. Five budgets. One building that has to keep running.
The security team usually doesn't own these devices. Facilities owns the cooling plant. Data center operations owns uptime. A specialist vendor maintains the generator, the UPS or the building management system. Physical security owns the cameras and badge readers. IT runs the network they all share.
When a device belongs to five teams, its security can belong to none of them. The gaps hide in ordinary places. An old controller that can't be patched without a shutdown. A vendor account that still works years after the install. One password shared across a whole fleet of sensors. A management screen reachable from a network it should never touch.
None of these announce themselves. They sit there doing their jobs, until one of them becomes the way in.
Just facilities?
It's tempting to call a cooling controller or a badge reader "just facilities."
That's like calling the engine "just part of the truck."
A cooling device doesn't need to run an application to take one down. If it fails, gets changed by the wrong person, or gets cut off from the system it reports to, the temperature in a server hall starts climbing. The same goes for the systems that watch power, control access, raise alarms and coordinate an emergency.
A problem in the building becomes a problem for everyone using the cloud.
The question at 1:42 a.m.
ILLUSTRATIVE
Picture a quiet night.
A cooling controller starts reaching for an address it has never contacted before. It should only talk to the building management system, the approved monitoring tools and, during scheduled maintenance, one known vendor service. This address is none of those.
The security team sees the alert. They could cut the controller off right now.
Before acting, they need an answer.
If we isolate this controller, will the server hall still be cool at 2:00?
Without knowing what depends on the controller, the team faces two bad options. Act fast and hope nothing important breaks. Or wait for someone to investigate while a possible attacker keeps moving.
Teams can do better. Know what the device can reach. Decide ahead of time which actions are safe. Contain only what needs containing. Then check two things. Is the unauthorized path closed? Is the building system still doing its job?
In a data center, a security fix that causes an outage is just a different kind of outage.
Try this
Could your team answer these five questions by tomorrow morning?
Can you list every connected device that affects cooling, power, alarms, environmental monitoring or physical access?
Do you know who owns each one from a security point of view?
Do you know which vendor connections are active, which are approved, and which should have been shut off years ago?
If a cooling controller acted strangely tonight, could you contain it without losing readings, alarms or temperature control?
Could you prove the service still worked afterward?
If any answer is "I'm not sure," start there.