Neoclouds have shown they can bring dense compute online faster than traditional platforms, emerging as specialized cloud providers built to deliver large-scale GPU capacity and AI infrastructure services. However, as GPU footprints expand across metros, facilities and customer environments, security considerations must move upstream. If specialized cloud providers are focused only on what happens inside the cluster, the traffic path that feeds it, sells it and keeps it available could be going unchecked.

For AI infrastructure providers, the network path is no longer passive. It is where customer data enters, how inference traffic reaches end users and what enables customer APIs to stay reachable. Unwanted and malicious traffic on critical paths isn’t just a cybersecurity concern—it poses a tangible threat to GPU availability and utilization.

The 2026 Lumen Defender℠ Threatscape Report examines how modern threat activity increasingly takes shape upstream. The report reinforces why network-level visibility matters and how early threat detection can help protect availability, performance and trust. For neocloud operators, that points to three critical security priorities as AI infrastructure scales across customers, metros and data centers.

Cybersecurity considerations for neoclouds

Unlike traditional cloud environments, the combination of distributed infrastructure, massive-volume data movement and customer expectations for always-on performance means neocloud operating models prompt distinct security priorities. For neoclouds, security strategy should reflect how traffic moves across the platform.

The attack surface extends beyond the GPU cluster

Most security conversations around AI infrastructure focus on what’s inside the environment: workload isolation, access controls and GPU node hardening. While these controls remain relevant, limiting neocloud security to only inter-environment considerations overlooks how the attack surface extends beyond cluster boundaries.

GPU platforms include internet-facing services and APIs, ingress and egress flows, customer connections, inter-data center transport and the operational pathways that keep distributed AI services online. Customers expect the platform to remain reachable even during traffic surges or when malicious actors probe the edge of the service.

Availability is a security outcome for neoclouds

For neoclouds, security cannot be separated from utilization. DDoS events, command-and-control activity and malicious IP traffic may degrade customer access, interrupt inference delivery, slow onboarding or force engineering teams into reactive mitigation efforts, directly affecting the outcomes neoclouds sell: performance, reliability and trust.

The more a neocloud provider evolves from GPU supply into enterprise platform delivery, the more this issue matters. Enterprise customers need confidence that compute resources remain reachable, predictable and sustainable under real operating conditions.

Protection should align with the AI traffic flow

With training data arriving in bursts, variable inference demand and sustained high-volume inter-data center traffic, neocloud environments are anything but predictable. Aside from creating operational complexity, these traffic patterns determine where risk emerges across the platform and shape both security and performance requirements.

For internet-facing AI services and APIs, upstream visibility helps identify and block DDoS attacks and malicious traffic before they reach critical infrastructure, protecting availability and reducing strain on downstream security controls. For deterministic east-west data movement between data centers, dedicated optical transport can provide predictable performance and isolation from shared-path variability.

Embedded network security is crucial for neocloud operators

The practical takeaway is simple: do not make security wait until traffic reaches the cluster. By then, the cost of handling unwanted traffic may already be showing up in operations, performance, support queues or customer confidence.

A more durable model considers the following:

• Identify where customer traffic enters the environment.
• Determine which public-facing services are most critical to revenue.
• Decide what traffic should be stopped before it reaches the customer edge.
• Evaluate how the network architecture protects utilization as demand scales across metros.

As neocloud differentiation moves beyond access to GPUs, operators increasingly win by delivering consistent performance and high availability, requiring network paths that move AI traffic predictably and help address threats before they disrupt workflows.

Where the Lumen network advantage becomes clear

Every new metro, customer connection and public-facing API increases the attack surface. Retrofitting protection after the architecture is established can create more complexity and opportunity for risk.

Lumen operates one of the largest and most deeply peered networks in the world, backed by the threat intelligence and security research expertise of Black Lotus Labs®, the threat research and operations division of Lumen. This global network visibility allows Lumen to identify malicious traffic earlier in the attack path. For neocloud operators, that means threats can be addressed before they consume capacity or impact application performance and inference delivery.

Get the 2026 Lumen Defender℠ Threatscape Report for Black Lotus Labs intelligence on upstream threat behavior, network-level signals and practical defense guidance.

_{¹Lumen Threatscape Report, 2026.}

_{This content is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided "as is" without any warranty or condition of any kind, either express or implied. Use of this information is at the end user's own risk. Lumen does not warrant that the information will meet the end user's requirements or that the implementation or usage of this information will result in the desired outcome of the end user. All third-party company and product or service names referenced in this article are for identification purposes only and do not imply endorsement or affiliation with Lumen. This document represents Lumen products and offerings as of the date of issue. Services not available everywhere. Lumen may change or cancel products and services or substitute similar products and services at its sole discretion without notice. © 2026 Lumen Technologies. All Rights Reserved.}