---
title: "S&P warns data-center cyber risk is growing against $2 trillion of assets and $10 billion of premium"
description: "S&P Global Ratings counts insurable data-center assets passing $2 trillion by 2027 against about $10 billion of new premium in 2026, and warns one attack could hit many tenants at once. Landlords and regulators are already rationing tenants by credit rating, and the Fed is set to keep raising the cost of the debt that funds the build-out."
publisher: "The Inference"
section: "Data Center"
published: 2026-11-14T18:19:18.070Z
modified: 2026-11-14T18:19:18.070Z
canonical: https://theinference.org/article/s-p-warns-data-center-cyber-risk-is-growing-against-2-trillion-of-assets-and-10-billion-of-premium
language: en
keywords: "Data Centers, Cyber Risk, Insurance, S&P Global Ratings, Project Finance"
---

# S&P warns data-center cyber risk is growing against $2 trillion of assets and $10 billion of premium

> S&P Global Ratings counts insurable data-center assets passing $2 trillion by 2027 against about $10 billion of new premium in 2026, and warns one attack could hit many tenants at once. Landlords and regulators are already rationing tenants by credit rating, and the Fed is set to keep raising the cost of the debt that funds the build-out.

## S&P says one attack could hit every tenant at once

On November 13, [S&P Global Ratings](https://theinference.org/markets/companies/s-p-global-ratings) [published a report](https://zpravy.kurzy.cz/881891-investice-v-bilionech-ale-slabe-zabezpeceni-sp-o-rizicich-datovych-center/) whose title is the finding: "Data Center Cyber Risk Is Increasing And Underrecognised" [1]. One successful attack on a large facility or its supply chain could strike many tenants at once, across banking, healthcare and public services, analyst Cristina Polizu writes, with "potentially extensive financial and operational impacts" [1].

## Two trillion of assets, ten billion of premium

The exposure compounds on the same curve as the build-out. S&P counts capital spending by [Amazon](https://theinference.org/markets/companies/amazon), [Microsoft](https://theinference.org/markets/companies/microsoft), [Alphabet](https://theinference.org/markets/companies/alphabet), [Oracle](https://theinference.org/markets/companies/oracle), [Meta](https://theinference.org/markets/companies/meta) and [SpaceX](https://theinference.org/markets/companies/spacex) at about $470 billion in 2025, roughly $870 billion this year and more than $1.3 trillion in 2027, much of it into data centers [1].

Hyperscale sites, the largest class of data center, should generate about $10 billion of new insurance premium in 2026, while insurable data-center assets pass $2 trillion next year [1]. S&P publishes no measure of whether that premium is adequate, so the pairing marks the scale of the exposure, not a tested shortfall [1].

*Chart: **Six builders' capex nearly triples from 2025 to S&P's 2027 forecast** Column chart of combined capital spending by Amazon, Microsoft, Alphabet, Oracle, Meta and SpaceX: about $470 billion in 2025, about $870 billion in 2026 and more than $1.3 trillion forecast for 2027.*

*Combined capital expenditure of Amazon, Microsoft, Alphabet, Oracle, Meta and SpaceX, in US$ billions; 2027 is S&P Global Ratings' forecast, as summarized on November 13, 2026. [1]*

## The plumbing is the attack surface

The weak part is structural. Cooling, power distribution, backup generators and fire suppression once ran as isolated systems; they are now managed remotely on wider corporate networks [1]. The SANS Institute, a cybersecurity research body, found 58% of 2025 attacks on operational technology entered through compromised IT, and threat researcher Cyble counted more than 2,400 control-system vulnerabilities disclosed by 152 industrial vendors that year [1].

![Aerial view of a large data-center roof packed with rows of cooling units and white back-up generator enclosures](https://storage.googleapis.com/theinference-public/img/394f09ac8bf867f6.jpg)

*Cooling and back-up power on a data-center roof in Mesa, Arizona. S&P says those systems, once isolated, are now managed remotely on wider corporate networks, which is where the cyber risk enters. (Rsparks3 / CC0)*

## Landlords and regulators already price tenant credit

The repricing began before the note landed. [Applied Digital](https://theinference.org/markets/companies/applied-digital), a data-center developer, caps the capacity it leases to junk-rated neoclouds, startups that rent out AI computing, such as [CoreWeave](https://theinference.org/markets/companies/coreweave), and chief executive [Wes Cummins](https://theinference.org/markets/people/wes-cummins) says he prefers a mix of 70% investment-grade tenants [2].

*Chart: **A junk-rated tenant is 30% of one landlord's contracted revenue** Bar chart of Applied Digital's contracted revenue by tenant: all investment-grade tenants 69.6%, one tier-one hyperscaler 55.8%, junk-rated CoreWeave 30.4%.*

*Share of Applied Digital's $36.2 billion of contracted revenue as of May 31, 2026, in percent. Investment-grade tenants together account for a stated 69.6% ($25.2 billion), which includes the single tier-one hyperscaler shown. [3]*

CoreWeave pays about $1.83 million per megawatt a year at its Polaris Forge campus in North Dakota, roughly 10% above the rate investment-grade hyperscalers pay, while its [unsecured bonds yield about 16%](https://theinference.org/article/ai-debt-now-has-two-prices-15-for-coreweave-6-25-for-iron-mountain) [3]. Tenant credit has become a number in the rent.

*Chart: **CoreWeave's capex and its debt both outgrew operating cash, to $66 billion by Q3 '26** Line chart of CoreWeave's capital expenditure, operating cash flow and total debt by quarter from Q2 2024 to Q3 2026: capex rises from $2.2 billion to $9.4 billion, operating cash flow stays between a negative $0.1 billion and $3.0 billion, and debt climbs from $10.6 billion to $66.2 billion.*

*CoreWeave's quarterly capital expenditure, operating cash flow and total debt in US$ billions, as reported in its SEC filings; Q2 2024 and Q3 2024 debt was not reported. Capex exceeded operating cash flow in all ten quarters. [9]*

Power follows. Wisconsin's regulator [ruled in May that large customers rated below A- must post financial security](https://www.bloomberg.com/news/articles/2026-11-14/tech-giants-face-more-grid-cost-pressure-on-democratic-sweep), which left Oracle, whose rating falls short, facing a letter of credit above $7 billion, more than $100 million a year; it sued in June and dropped the suit in August [2].

[NiSource](https://theinference.org/markets/companies/nisource), an Indiana utility parent, has placed five gigawatts of generation in a separate unit whose big customers, among them Amazon, Google and Microsoft, fully fund the plants that serve them, outside household rates [2][4]. [Barclays](https://theinference.org/markets/companies/barclays) counts $300 billion to $320 billion of bond issuance this year from the hyperscalers, the largest cloud and AI operators [2].

## The builders say the contracts already hold the risk

The other camp answers with contract terms. CoreWeave's 15-year lease at Polaris Forge is take-or-pay, meaning it pays whether or not it uses the capacity, and since March parts of it sit in a subsidiary rated A3 with a parent guarantee behind it [3][5].

Microsoft energy director Jeff Riles calls his company "committed to paying our own way" [4], Oracle calls its commitment to pay for its own Wisconsin power "unwavering" [2], and New York Fed President John Williams expects "a decade of high, strong growth" from the AI boom [6].

Those instruments answer for a tenant walking away, not for a facility going dark, and S&P itself says banks' recovery processes cannot fully remove third-party and concentration risk [1].

## Three dates will settle what the risk costs

The Fed meets on December 8 and 9, with futures markets pricing quarter-point increases there and at the January and March meetings, after core prices rose 0.3% in October for a third straight month [6][7]. PJM, the largest US grid, auctions capacity next month; [its monitor forecasts data centers will add $5 billion to $10 billion](https://www.bloomberg.com/news/articles/2026-11-12/watchdog-rebukes-largest-us-grid-over-data-center-power-costs), after $29.4 billion locked in across four earlier auctions [8].

Applied Digital reports in January, its first full quarter with 250 megawatts live at Polaris Forge [3]. By then, tenant credit will have been priced in rent, collateral and coupon; the cyber risk S&P describes still has no line item anywhere.

## Takeaway

S&P counts $2 trillion of insurable data-center assets next year against about $10 billion of new premium in 2026, and warns one attack could hit many tenants at once. The repricing already under way is about tenant credit, not cyber risk, which still has no line item anywhere.

## Sources

1. [oPojištění.cz via Kurzy.cz, "Investice v bilionech, ale slabé zabezpečení: S&P o rizicích datových center", 13 November 2026](https://zpravy.kurzy.cz/881891-investice-v-bilionech-ale-slabe-zabezpeceni-sp-o-rizicich-datovych-center/)
2. [Bloomberg, Michelle Cheng and Dawn Lim, "Tech Giants Face More Grid Cost Pressure on Democratic Sweep", 14 November 2026](https://www.bloomberg.com/news/articles/2026-11-14/tech-giants-face-more-grid-cost-pressure-on-democratic-sweep)
3. [Yahoo Finance (TIKR), David Hanson, "CoreWeave Has 'a Sentiment Problem.' Its Landlord Applied Digital Has $11 Billion Riding on It", 10 November 2026](https://finance.yahoo.com/markets/stocks/articles/coreweave-sentiment-problem-landlord-applied-190206049.html)
4. [Business Wire via Morningstar, "NiSource announces long-term agreement with Microsoft expected to increase customer savings and support Indiana's economic growth", 16 October 2026](https://www.morningstar.com/news/business-wire/20261015675062/nisource-announces-long-term-agreement-with-microsoft-expected-to-increase-customer-savings-and-support-indianas-economic-growth)
5. [Foreign Policy Journal, Ewan Scott, "Applied Digital Carries $11 Billion in CoreWeave Exposure as Tenant's Bonds Signal Deep Distress", 11 November 2026](https://www.foreignpolicyjournal.com/2026/11/11/applied-digital-nasdaq-apld-carries-11-billion-in-coreweave-nasdaq-crwv-exposure-as-tenants-bonds-signal-deep-distress/)
6. [Briefs.co, Andre Savage, "New York Fed's John Williams says inflation is still too high, signals more tightening ahead", 13 November 2026](https://www.briefs.co/news/new-york-fed-s-john-williams-says-inflation-is-still-too-hig/)
7. [Yahoo Finance (via TheStreet), Hillary Remy and Aparajita Chatterjee, "Goldman Sachs sees a new problem emerging for the Federal Reserve", 13 November 2026](https://finance.yahoo.com/economy/policy/articles/goldman-sachs-sees-problem-emerging-171700613.html)
8. [Bloomberg, Naureen S. Malik, "Watchdog Rebukes Largest US Grid Over Data Center Power Costs", 12 November 2026](https://www.bloomberg.com/news/articles/2026-11-12/watchdog-rebukes-largest-us-grid-over-data-center-power-costs)
9. [CoreWeave, quarterly figures from its SEC filings, retrieved 14 November 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001769628)


---

S&P warns data-center cyber risk is growing against $2 trillion of assets and $10 billion of premium — The Inference. Canonical: https://theinference.org/article/s-p-warns-data-center-cyber-risk-is-growing-against-2-trillion-of-assets-and-10-billion-of-premium