Cybersecurity awareness focuses on educating employees to recognize risks, follow security practices, and reduce human-related vulnerabilities.
By Calli Schlientz, Director of Compliance, DataBank
As Cybersecurity Awareness Month wraps up, it’s worth asking: Why is building effective cybersecurity so difficult for so many organizations? The answer usually isn’t technical. It’s cultural.
Too many organizations view their security and compliance teams as the “department of no,” the people who exist to tell everyone what can’t be done and why their preferred approach won’t work. This adversarial mindset creates exactly what it aims to prevent. When teams see security as an obstacle rather than a partner, they work around it, avoid conversations until it’s too late, and treat compliance as a burden rather than a useful framework.
The path forward requires integrating security into conversations from the beginning and moving from prohibition to collaboration. When security teams ask, “How can we make this work securely?” instead of simply saying “no,” organizations build stronger defenses while maintaining operational efficiency. This cultural shift improves security outcomes, business agility, and customer confidence simultaneously.
It All Starts with Leadership
Consider how you build a physical structure. Before construction begins, architects and engineers calculate load requirements, soil conditions, and structural integrity. Nobody questions whether foundation planning belongs in early conversations. The same principle applies to cybersecurity infrastructure.
Leadership makes this happen through visible participation, not mandates:
- When executives complete security awareness training in the first week it’s available, completion rates across the organization increase dramatically
- When senior leaders report phishing attempts using the same channels employees use, it normalizes the behavior
- When project sponsors proactively request security architecture reviews, teams understand these aren’t bureaucratic obstacles but standard practice
People follow actions far more reliably than words. Leadership visibility transforms security from a requirement into an expectation.
From Policy to Practice: Making Documentation Useful
Most organizations have comprehensive information security policies that few employees have actually read. This isn’t a failure of discipline. It’s a failure of approach.
A 200-page security policy serves no practical purpose if people don’t know how to extract relevant information when they need it. The solution is teaching employees to treat security policies like reference tools they consult when needed, not documents they memorize. Show them how to use search functions effectively, understand how the document is organized, and locate specific guidance quickly.
Test whether your policies actually work as reference tools by creating quizzes that require employees to find information rather than recall it from memory. When people struggle, you’ve identified either a training gap or a documentation problem that needs fixing.
The security policy should answer questions, not create them. If employees can’t find guidance when they need it, even the most comprehensive or technically accurate policy has failed its purpose.
Compliance as Catalyst, Not Constraint
Compliance frameworks like SOC 2, FedRAMP, ISO, and PCI-DSS often get treated as burdens when they’re actually roadmaps that tell you exactly what needs protection and how to protect it.
Rather than viewing these as obstacles to overcome, use them as structured guides for building security practices. When frameworks mandate specific controls for patching, monitoring, or access management, they’re identifying security measures that actually matter based on industry experience and established risk patterns, not creating arbitrary work.
The key is integrating these requirements into planning conversations from the beginning. If you know FedRAMP compliance will eventually be required, design systems with those controls built in rather than retrofitting them later. When security and compliance participate in initial architecture discussions, evidence collection happens automatically throughout the year instead of becoming a scramble during audit season. This creates shared responsibility where everyone understands their role because they helped design processes from the start.
Frameworks and processes establish what needs to happen. Making it actually happen requires the human side of security.
Practical Best Practices for Building Security Culture
Building lasting security awareness requires three interconnected practices: helping people understand what they’re protecting, rewarding positive behavior, and creating safe reporting channels.
Start with the “why” behind security requirements. When employees understand that their actions protect customer data, intellectual property, or operational systems, they ask better questions and challenge processes that seem to bypass security controls. This isn’t a one-time training module but an ongoing conversation that evolves as systems change and new workflows emerge.
Reward people who identify security gaps or report potential issues. When someone flags a phishing email, acknowledge it publicly. When a team proactively requests a security review, recognize that initiative. Even when someone reports their own mistake that created a vulnerability, reward the transparency. Positive reinforcement encourages people to report problems rather than hide them.
Create environments where reporting feels safe by removing reprimand culture for honest mistakes. If employees fear consequences for admitting errors, security gaps stay hidden until they become incidents. The person who reports “I think I clicked a phishing link” deserves thanks for early warning, not punishment.
When Security Culture Becomes Customer-Facing
Internal security culture directly impacts customer relationships. When employees understand security principles and processes, they have better conversations with customers about protection, compliance, and risk management.
Sales teams educated in security fundamentals know when to involve specialists in customer discussions, creating comfort for customers to ask difficult questions about data protection, incident response, and compliance certifications. This proactive approach demonstrates that security isn’t an afterthought addressed when problems arise.
Transparency builds trust. Resources like trust centers that document security practices, compliance certifications, and privacy commitments give prospects detailed information without requiring custom responses for each inquiry. Security culture becomes a competitive advantage when customers see it reflected in every interaction, from initial sales conversations through ongoing service delivery.
Where to Begin
If you can only implement one security culture initiative, start with consistent micro-learning. Weekly security tips delivered via Slack, email, or team meetings work better than quarterly training marathons that nobody remembers.
Keep messages short and practical—badge security one week, phishing identification the next, password management the following week. Small, regular touchpoints build awareness over time without overwhelming people or disrupting workflows.
Make leadership participation visible. When executives complete training promptly, report suspicious emails, and request security reviews for their own projects, it signals organizational priority more effectively than any policy mandate.
Security awareness isn’t a destination you reach through annual training. It’s a culture you build through consistent, practical, positive reinforcement that makes security everyone’s responsibility, not just the security team’s job.
Connectivity enables data centers to link servers, storage, cloud platforms, and users, making infrastructure operational rather than isolated hardware.
By Tim Glatz, Head of Interconnection, DataBank
Most infrastructure decisions begin with the same question: What hardware do we need?
It’s a logical starting point. Organizations carefully evaluate server specifications, storage capacity, and processing power. They compare vendors, negotiate pricing, and plan for future upgrades. Yet, hardware selection represents only part of the infrastructure equation.
The other part–equally if not even more important–is connectivity. Without the right connectivity options, even the most powerful hardware would be left isolated, unable to deliver on its full potential. For example:
- Application servers can’t serve customers if network latency undermines response times
- Backup systems provide no protection if connectivity failures prevent replication
- GPU clusters can’t train AI models if they can’t efficiently sync data between nodes
In the era of AI, real-time data processing, and distributed applications, connectivity architecture has evolved from a supporting consideration to a primary driver of business outcomes.
To put it another way, the question isn’t whether your hardware is powerful enough. It’s whether your connectivity design allows that hardware to perform at the level your infrastructure demands.
Beyond Bandwidth: What Modern Connectivity Actually Means
When evaluating connectivity, most organizations default to a single question: How much bandwidth do we get? Yet, focusing on bandwidth alone leaves out other important parts of the story.
Latency, jitter, and packet loss often matter more than raw throughput, especially for applications requiring real-time responsiveness. A 10Gbps connection with inconsistent latency performs worse than a 1Gbps connection with predictable, low-latency characteristics.
Path diversity and redundancy architecture determine what happens when primary connections fail. A single high-capacity link creates a single point of failure. Multiple diverse paths, even with lower individual capacity, provide resilience that keeps applications running during network disruptions.
The quality of peering relationships and direct access to cloud on-ramps can have a real impact on performance and cost. Direct connections to AWS, Microsoft Azure, or Google Cloud bypass the public internet entirely, reducing latency and improving security while often lowering data transfer costs at scale.
For AI inference, financial transactions, and real-time collaboration, these connectivity characteristics directly determine whether applications can meet business requirements.
The Hidden Cost of “Good Enough” Connectivity
“Good enough” connectivity rarely reveals its costs through obvious outages. Instead, it degrades performance in ways that are difficult to measure and easy to overlook.
Application timeouts trigger retry attempts, which consume resources and cascade across dependent services. For example, pages load slightly slower, API calls take longer, interactive features feel less responsive. These incremental degradations often go unmeasured until customers complain or switch to competitors.
The compound effects become more severe in modern architectures. An additional 50ms of latency multiplies across microservices chains, turning acceptable response times into frustrating delays.
Perhaps, most significantly, inadequate connectivity creates opportunity costs.
- AI models requiring sub-100ms inference can’t be deployed. New markets remain inaccessible because connectivity quality can’t support customer expectations. Use cases requiring failover redundancy never launch because path diversity doesn’t exist.
- Perhaps most significantly, inadequate connectivity creates opportunity costs. For example:
- AI models requiring sub-100ms inference can’t be deployed
- New markets remain inaccessible because connectivity quality can’t support customer expectations
- Use cases requiring failover redundancy never launch because path diversity doesn’t exist
These limitations don’t just affect current operations; they constrain strategic growth and competitive positioning.
Connectivity Architecture for the AI Era
AI workloads have fundamentally changed connectivity requirements in ways that catch many organizations off guard. Training and inference represent opposite challenges: training demands massive bandwidth for moving datasets and syncing model parameters across distributed systems, while inference prioritizes ultra-low latency for real-time decision-making.
As AI models grow larger and more complex, the “data gravity” problem intensifies. Moving massive datasets to centralized training locations becomes increasingly impractical, yet moving trained models to distributed data sources introduces latency challenges for inference workloads.
These requirements force architectural decisions about when to use private direct connections versus internet transit, where to position edge locations for inference workloads, and how connectivity design impacts total cost of ownership.
Organizations planning AI deployments must recognize that connectivity infrastructure becomes the constraint faster than compute capacity. Today’s “sufficient” connectivity will bottleneck tomorrow’s AI capabilities.
The Interconnection Ecosystem: It’s Who You’re Connected To
Connectivity quality depends not just on specifications but on ecosystem. Carrier-neutral data centers with a wide array of interconnection options create exponentially more value than facilities offering limited connectivity choices.
Direct connections to cloud providers deliver measurable advantages over internet transit: lower latency, improved security, and often reduced costs at scale. For organizations running hybrid or multi-cloud architectures, these direct on-ramps become essential rather than optional.
The physical proximity to partners, customers, and data sources matters more than many realize. API integrations, B2B data exchanges, and real-time partner connections all perform better with direct interconnection. Organizations choosing data center locations based solely on cost or convenience often discover later that they’ve positioned themselves far from the ecosystems they need to access.
Strategic infrastructure positioning means locating where connectivity options are abundant.
Future-Proofing Connectivity Decisions
Technology evolution happens faster than infrastructure refresh cycles. Organizations making connectivity decisions today must anticipate requirements three to five years out, not just current needs.
Certain design principles transcend specific technologies: build for path diversity rather than single high-capacity links, prioritize low-latency options even when current applications don’t demand them, and choose locations based on ecosystem richness rather than just immediate connectivity requirements.
Vendor-neutral connectivity architecture preserves flexibility as business needs evolve. The ability to add new connections, switch providers, or pivot strategies without physical relocation provides business value that’s difficult to quantify but easy to recognize when needed.
From Infrastructure to Business Capability
Infrastructure decisions should begin with connectivity architecture, not hardware specifications. The right connectivity environment makes powerful hardware more valuable. Poor connectivity makes even the best hardware underperform.
Before your next deployment, ask: To whom and to what do we need to connect? What latency do our applications require? How will our needs evolve? What happens when primary paths fail?
Organizations that position themselves in connectivity-rich environments gain advantages that competitors struggle to replicate: faster application performance, more deployment options, and the flexibility to adopt emerging technologies as business demands change.
Without connectivity, your equipment is just hardware. With the right connectivity architecture, your infrastructure can become a new–and sustainable–competitive advantage.
The data and insights featured below come from DataBank’s latest research report, “Accelerating AI: Navigating the Future of Enterprise Infrastructure,” which focused on enterprise AI adoption, ROI, and infrastructure challenges.
In our previous articles, we explored how enterprises are achieving ROI from AI and what’s blocking those that haven’t gotten there yet. Now, in this third article in the series, we’ll examine where companies are actually running their AI workloads – and how that’s about to change dramatically.
The infrastructure choices organizations make for AI workloads have significant implications for performance, cost, security, and compliance. Our survey reveals that while cloud remains important, a major shift toward hybrid and distributed infrastructure is already underway.
Today’s Reality: Cloud Dominates, But Not Exclusively
Currently, nearly two-thirds (64%) of AI workloads run in either public cloud (49%) or private cloud (15%) environments. Another 15% favor third-party SaaS/web-based platforms like Salesforce.
On-premises and colocation data centers represent a much smaller portion today – just 22% of AI workloads according to our survey (15% on-premises/company-controlled and 7% colocation data centers).
This makes sense. Public cloud and SaaS solutions offer easy starting points for AI adoption, with minimal upfront investment and quick deployment times. However, as AI implementations mature, the limitations of a cloud-only approach become apparent.
Tomorrow’s Strategy: The Hybrid Shift
Looking ahead five years, 96% of respondents expect their AI infrastructure distribution to change. Only 4% report “no significant changes planned.”
Over half of respondents are planning substantial expansions in physical infrastructure:
- 31% will build more AI-dedicated private/on-premises data centers
- 22% plan to expand colocation data center deployments
Meanwhile, 43% still expect to increase their reliance on cloud for AI workloads, confirming that the future isn’t about choosing between cloud and physical infrastructure. It’s about strategically combining both.
What’s Driving the Hybrid Approach?
When we asked which factors are most critical in choosing between cloud and colocation for AI workloads, three priorities emerged:
- Security and compliance requirements (37% rated this most critical): Colocation facilities like those operated by DataBank provide robust physical security features including 24/7 surveillance, restricted access controls with biometric scanners and security guards, and secure equipment cabinets. They’re also certified with various industry and regulatory compliance standards such as ISO 27001, SOC 1/2, and PCI DSS.
- Performance considerations (33%): Low-latency requirements for advanced AI applications demand infrastructure closer to where data is generated and consumed.
- Scalability and flexibility (27%): Different workloads have different needs; hybrid approaches allow organizations to optimize each application’s infrastructure placement.
As Philips’ Chief Innovation Officer Shez Partovi noted in the research process: “In a de-globalized world, there is an increasing need to ensure that data is housed and processed in compliance with the specific country or jurisdiction, which is leading to a more decentralized approach.”
Geographic Distribution: AI Is Going Local
Perhaps, the most striking finding in our survey is the extent to which AI is driving geographic expansion of infrastructure. Over three-quarters of respondents (76%) expect their infrastructure to expand geographically over the next five years:
- 44% need expansion to be closer to data sources
32% need expansion to be closer to end-users
Only 11% anticipate consolidation into fewer, but larger, data hubs, while just 13% expect no significant impact on geographic distribution.
This geographic dispersion addresses multiple needs simultaneously. For compliance, it enables organizations to meet data sovereignty requirements by storing and processing data within specific countries or jurisdictions. For performance, it reduces latency for real-time AI applications like autonomous vehicles, smart city sensors, and industrial IoT.
“We operate in every corner of the world and there are obviously sovereign data requirements,” said Chris Bedi, ServiceNow’s Chief Customer Officer. “To make sure we are serving customers in each region, we need to have a geographically dispersed data center strategy.”
Training vs. Inference: Different Workloads, Different Strategies
Interestingly, while inference is becoming more distributed, AI training is moving in the opposite direction. Nearly three-quarters of respondents (73%) said that “training will be centralized while inference will be more distributed.” This split makes technical sense.
Training requires massive computational power and benefits from centralized, GPU-rich environments. Inference, by contrast, needs to happen close to users and data sources to minimize latency and ensure compliance with local regulations.
Challenges in Scaling Geographically
Expanding AI infrastructure across multiple regions isn’t without challenges. When we asked about major obstacles to geographic scaling, respondents cited:
- Security risks in distributed AI (27%)
- Access to GPU infrastructure for training (25%)
- Data sovereignty and compliance (23%)
- Network and latency concerns for inference (20%)
- Cost of infrastructure in key regions (19%)
- Power and energy constraints (18%)
According to DataBank CEO Raul Martynek, infrastructure readiness varies significantly by location. “It’s not just access to GPUs that matters. You also need somewhere to put them. Not all data centers can accommodate the power and cooling requirements of these infrastructures, and new facilities take time to deploy. That’s why we developed a Universal Data Hall Design for all our new data center builds. It allows us to configure each data hall more quickly in a new facility for whatever infrastructure need that market might have – from traditional air-cooled configurations capable of 15-30kW per cabinet, to liquid-cooled systems capable of 100-200kW per cabinet.”
The Bottom Line
The future of AI infrastructure isn’t an either/or proposition between cloud and physical data centers. It’s a strategic hybrid approach that places workloads where they perform best, meet compliance requirements, and deliver optimal cost-efficiency.
Less sensitive workloads leveraging public datasets can reside in public cloud. More sensitive applications requiring stringent security, compliance, or low-latency performance are increasingly deployed in colocation or private data centers—and those deployments are spreading geographically to be closer to the data and users that need them.
In our next article, we’ll explore how AI strategies are improving with approaches such as blending off-the-shelf applications, custom solutions, and tailored deployment models.
This is the third in a five-part series examining key trends in enterprise AI adoption based on our 2025 AI infrastructure survey. You can read our previous posts on AI ROI findings and what’s blocking AI success, or download the full report, “Accelerating AI: Navigating the Future of Enterprise Infrastructure.”