Geopolitical Risk Strategy for Tech Companies Is Now a Physical Security Problem

Iran's IRGC formally designated 18 major U.S. technology companies — Apple, Microsoft, Google, Meta, Nvidia, Oracle, Tesla, HP, Intel, IBM, Palantir, Cisco, Dell, GE, Boeing, and JPMorgan among them — as military targets in the Middle East. That announcement landed Wednesday with a specific operational edge: IRGC-affiliated Telegram channels warned employees at named companies to "leave workplaces immediately to protect their lives." Geopolitical risk strategy for tech companies is no longer a boardroom exercise. It is a live operational and communications problem with a clock attached.

The attacks confirm this. Iranian drones struck three Amazon Web Services data centers across the UAE and Bahrain earlier this month — the first known military strikes against a hyperscaler's infrastructure — taking them offline and triggering outages across the region's banking, payment systems, and enterprise software layers. Palantir's Gulf infrastructure was struck separately. The IRGC's formal designation of 18 companies on Wednesday was a pattern announcement following demonstrated capability.

When the Gulf AI Investment Thesis Became a Geopolitical Liability

The past 18 months produced billions in announced Gulf AI infrastructure investment. Hyperscalers, chipmakers, and cloud providers moved into the UAE and Saudi Arabia on the strength of sovereign AI ambitions, capital-rich sovereign wealth funds, and favorable regulatory postures. The geopolitical risk strategy for tech companies operating in those markets shared a common assumption: commercial investment provides its own protective logic.

The drone strikes dissolved that assumption in a single news cycle.

The IRGC does not distinguish between a company's commercial operations and its role in U.S. military infrastructure. Amazon's Bahrain data center was struck specifically because its cloud infrastructure supports U.S. military workloads. The targeting logic is explicit: American commercial infrastructure in the Gulf is treated as American military infrastructure.

Every company that announced a Gulf AI deal in 2024 or 2025 and said nothing about physical security risk now carries a gap between its investor disclosures and what the operating environment has demonstrated. That gap is a communications liability, a financial disclosure question, and in some cases a board-level governance failure.

Geopolitical Risk Strategy: What Named Companies Must Do Now

The 18 named companies have the most urgent version of this problem. Every company doing business in the Gulf has the general version.

Technical incident response — "servers are back online, services have been restored" — is not a geopolitical communications strategy. It answers the operational question while leaving the strategic one unanswered. Investor audiences, enterprise clients, and congressional oversight are not asking whether the data center is functional. They are asking whether leadership understands the operating environment it placed its infrastructure in, and whether the company has a position on geopolitical risk that extends beyond operational continuity.

Standard commercial property and business interruption insurance policies frequently exclude acts of war. Companies that have not secured specialized war risk coverage — and have not disclosed that gap to investors — are carrying undisclosed financial exposure in an active conflict zone. That is a material consideration, and legal and investor relations teams should be reviewing disclosure obligations now.

Government affairs leaders at named companies need direct contact with State and Commerce today — to understand available support, expected disclosures, and the regulatory posture of U.S. agencies toward companies operating in Gulf conflict zones. Congressional oversight attention on tech companies in exposed geographies is accelerating. The companies that engage proactively will navigate it on their own terms.

Data Centers Are Strategic Assets in Modern Conflict

The Iran war has made concrete what was previously theoretical in corporate board conversations: digital infrastructure is physical infrastructure, and physical infrastructure in geopolitically contested regions carries the risk profile of those regions.

The Gulf AI buildout concentrated enormous commercial computing power in a small number of geographic clusters. That concentration served cost, latency, and partnership objectives. It also created a target density that state actors with precision drone capability can and will exploit. The companies building AI infrastructure — hyperscalers, colocation providers, power and cooling equipment suppliers — now face a proactive engagement imperative with DHS and DoD on resilience standards. The alternative is to have those standards written for them, after the next strike, in the worst possible political environment.

Perception of operational competence in a conflict environment directly shapes enterprise value. The companies that demonstrate they understand their geopolitical operating environment — and that their communications systems are calibrated for it — will be positioned differently with every audience that matters: investors, enterprise buyers, regulators, and congressional oversight.

The window to shape that narrative is shorter than most boards have modeled.

Frequently Asked Questions

What does it mean when the IRGC formally designates a U.S. tech company as a military target?
A formal IRGC designation moves a company from incidental geopolitical risk to named operational target. It creates immediate investor disclosure questions, enterprise client concerns, and a government affairs engagement imperative that standard crisis communications protocols are not built to address. Named companies should treat this as a material event, not a media inquiry.

What is the difference between a technical incident response and a geopolitical communications strategy?
A technical incident response addresses operational questions — whether systems are online, what the service impact was, and what remediation steps were taken. A geopolitical communications strategy addresses the strategic question: whether leadership understands the operating environment, what the company's posture is on geopolitical risk in its infrastructure decisions, and how the company is engaging government stakeholders on resilience and disclosure. Named companies on the IRGC list need both — and most have only delivered the first.

Are Gulf AI investments now a financial disclosure liability for U.S. tech companies?
Standard commercial property and business interruption insurance policies frequently exclude acts of war. Companies with Gulf infrastructure that have not secured specialized war risk coverage — and have not disclosed that gap to investors — are carrying undisclosed financial exposure in an active conflict zone. Legal counsel and investor relations teams should be reviewing disclosure obligations immediately.

What should in-house government affairs leaders at named companies be doing today?
Government relations leaders at named companies should be in direct contact with the State Department and Commerce Department to understand available support, expected disclosures, and the regulatory posture of relevant U.S. agencies. Congressional oversight attention on tech companies operating in Gulf conflict zones is accelerating; companies that engage proactively will navigate that scrutiny on their own terms.

How should companies with undisclosed Gulf AI investments respond if they are not on the IRGC list?
Companies with undisclosed Gulf AI exposure should expect inbound press and analyst inquiries regardless of whether they appear on the formal list. The appropriate response includes an investor communications update that addresses the physical security calculus of their Gulf infrastructure, a review of war risk insurance coverage, and proactive engagement with their government relations teams on what regulatory guidance applies to their specific footprint.

Annie Moore and Victor Lopez are Co-Founders and Managing Partners of Imperio Chaos, a global strategic advisory firm operating at the intersection of capital, policy, and digital ecosystems. We advise companies navigating high-stakes regulatory, political, and reputational environments where perception directly affects enterprise value, market position, and deal outcomes. When political headwinds, activist pressure, or narrative attacks threaten a company's bottom line, we generate the leverage to change the outcome.