Physical, Supply Chain, and the Converged Incident

A cyber incident on an AI campus is rarely only cyber. The same adversary who owns a credential may also own a cloned badge; the intrusion that begins in software may have begun in the supply chain, planted in firmware months earlier. Convergence means the incident is physical, digital, and supply-borne at once. The response must span all three or it addresses a symptom and misses the disease.

Integrate physical security into the operations center, do not run it as a separate guard function. Badge readers, cameras, door contacts, and visitor logs are telemetry. Fuse them with the digital picture and new detections become possible: a console login with no corresponding badge-in -- the operator is remote or the credential is stolen; a badge-in to the data hall at 3 a.m. followed minutes later by a physical console session on a segregated controller; a tailgating event on camera correlated with a rogue device appearing on the network. The physical and digital layers corroborate or contradict each other, and the contradiction is often the first true sign of an intrusion. An adversary who can walk into the building defeats most network controls -- physical access is the ultimate privilege escalation -- so the operations center that cannot see the doors is defending half the castle.

Supply chain is the second converged front, and the most patient. AI infrastructure is assembled from thousands of components -- accelerators, network gear, power and cooling equipment, and the firmware inside all of it -- sourced through long vendor chains. Each is an insertion point. A compromised firmware image in a power distribution unit, a backdoor in a building-management controller, a tampered dependency in the software bill of materials, a malicious update pushed through a legitimate vendor channel: these are intrusions that arrive pre-installed and dormant. Defending this front is provenance discipline. Know what is in every image. Sign and verify firmware and software artifacts. Maintain a software bill of materials and a hardware equivalent, so that when a vulnerability or a compromise is disclosed you can answer, in minutes, whether you run the affected component and where. Vendor remote access is the live edge of the supply chain -- every maintenance session into the power train or the cooling system is a trust relationship an adversary would love to inherit, so broker those sessions through monitored, time-boxed, recorded access and treat a vendor account touching operational technology as a high-severity signal by default.

When the incident is converged, the response coordinates all three fronts at once. Consider a realistic sequence: a vendor account is compromised, used to push a firmware update to a batch of controllers, which opens a foothold that the adversary reaches through a badge cloned at the loading dock. Handle only the cyber foothold and you leave the cloned badge active and the poisoned firmware in place. The converged response runs three workstreams under one commander -- a digital stream eradicating the software foothold and rotating credentials, a physical stream revoking the cloned badge, reviewing camera footage, and hardening the access point, and a supply stream identifying every device that received the malicious firmware and restoring known-good images. The workstreams share one timeline because they are one incident, and the commander sequences them so that eradication on one front does not tip off the adversary on another.

This reframes scope permanently. In a converged environment, the question what is the blast radius is never a purely digital one. It includes which doors were accessed, which vendor sessions were active, which firmware batches are suspect, and which physical systems the adversary could reach. An investigation that scopes only the network will consistently understate the incident, declare eradication too early, and watch the adversary return through the physical or supply-chain door it never examined.

Build the convergence into the organization, not just the incident. Physical security, IT security, operational-technology security, and supply-chain assurance are frequently four separate teams with four budgets and four reporting lines -- and an adversary who moves fluidly across all four. The operations center is where they converge in practice: shared telemetry, shared detections, shared response, one command structure. Treat physical access as privilege escalation, treat firmware and vendor sessions as attack surface, and scope every incident across all three fronts. The threat surface of AI infrastructure is IT, operational technology, physical, and supply chain simultaneously. The defense has to be simultaneous too.