Cybersecurity checklist for AI-powered workplaces

As organizations scale AI and connected devices across operations, the potential for cyber vulnerabilities grows. A broad attack surface opens the door to bad actors that could take control of hardware and software, corrupt or steal data, and ultimately damage a brand’s business and reputation.

That cyber exposure is making facilities and real estate teams hesitant to fully embrace technologies that could transform how they operate and manage their workplaces. Business leaders responding to our 2026 AI survey cite cybersecurity concerns as the biggest barrier to expanding the use of AI to optimize facilities. Among facility managers surveyed, 22% identified cyberattack risk as the biggest threat to maintaining equipment performance and uptime, making it the most common response.

As cloud connectivity and AI become more deeply embedded in operations, cybersecurity needs to evolve in step. Scaling AI securely requires organizations to protect four things from the start: the connections between systems, the data that trains and powers AI, the identities allowed to access the systems and the governance controls that determine how AI is used.

Use this checklist to help ensure your cybersecurity strategy is ready to support your intelligent building plans.

✓ Build security into the AI strategy from the beginning

Cybersecurity should not be something added after workplace technologies have already been connected. As organizations expand their use of AI, security requirements should be part of decisions about architecture, integration and implementation from the start.

That means bringing facilities, workplace, IT and cybersecurity teams together to consider questions such as:

• What systems and data will the AI application access?
• What data will be used to train, optimize or inform AI models?
• What actions will AI be permitted to recommend or automate?
• How will that data move between the edge, cloud and other systems?
• Who or what will be authorized to access it?
• How will new integrations affect the organization’s attack surface?
• How will security policies be maintained as the workplace evolves?

These questions become increasingly important as AI moves beyond analytics and recommendations to support more automated building operations.

✓ Inventory every connected asset

You cannot protect what you cannot see. Start by understanding the devices, applications and systems exchanging data across the workplace.

That can include everything from occupancy sensors and HVAC equipment to cameras, badge readers, workplace applications and other IoT devices.

Check that you can:

• Identify connected devices and systems across the workplace
• Understand how they connect and communicate
• Determine what data they collect, transmit and receive
• Maintain visibility as devices are added, moved or retired
• Monitor the health and status of connected assets throughout their lifecycle

A complete view of the connected environment helps organizations identify potential vulnerabilities before they become blind spots.

✓ Verify every user and device

Traditional cybersecurity models often assume that devices or users inside a trusted network can be trusted themselves. Connected workplaces require a different approach.

Zero-trust cybersecurity begins with the assumption that no connection should be inherently trusted. Access is instead granted based on verified identities and defined policies.

Look for capabilities that:

• Authenticate users and devices before allowing connections
• Apply identity-based policies to determine who and what can communicate
• Use multi-factor authentication where appropriate
• Encrypt data moving between connected assets
• Limit access according to the principle of least privilege

OpenBlue Airwall uses cryptographic identities and identity-based policies to authenticate users and devices before establishing connections, helping organizations securely connect workplace and building technologies across IT, operational technology (OT), IoT and cloud environments.

✓ Limit how far threats can move

Connectivity creates value by allowing data to move across systems. It should not give a cyber threat the same freedom of movement.

Microsegmentation divides connected environments into smaller, isolated segments and establishes granular policies governing communication between them. If one endpoint is compromised, segmentation can help prevent an attacker or malware from moving laterally to other systems.

Check that your cybersecurity architecture can:

• Isolate critical devices and systems
• Restrict communication to approved connections
• Prevent unauthorized lateral movement
• Contain a potential intrusion without unnecessarily disrupting the wider environment

OpenBlue Airwall uses microsegmentation and encrypted private overlay networks to isolate connected assets, helping limit lateral movement and contain potential intrusions.

✓ Protect AI data throughout its lifecycle

AI is only as effective as the quality, security and availability of the data that powers it. In an intelligent workplace, that can include data about occupancy, equipment, energy consumption, environmental conditions and how people interact with spaces.

Protecting that data throughout its lifecycle is therefore fundamental to protecting AI-powered operations.

Your data architecture should provide:

• Encryption for data in transit and at rest
• Access controls that restrict data to authorized users
• Secure connections between edge devices and cloud applications
• Governance that establishes how data can be accessed and used
• Controls that help detect manipulated, corrupted or anomalous data
• Protection for the applications and interfaces through which data is accessed

Look for specific safeguards that put these principles into practice, including encrypted data transmission, AES-256 encryption at rest, web application firewalls and a zero-trust cloud architecture.

These protections are built into the OpenBlue Data Platform, a secure, scalable foundation that brings data from building systems, equipment, meters, occupancy sensors and other sources into a unified, AI-ready data layer. OpenBlue Intelligence builds on that foundation, using AI to turn building data into insights, recommendations and automation that can help improve building performance.

By securing the underlying data layer, organizations can confidently scale their investments in AI and connected technology while helping protect the building data those capabilities depend on.

✓ Restrict remote access by identity

In addition to employees working away from the office, facilities teams, service providers, technology vendors and other partners may all require remote access to connected systems.

That access can improve responsiveness and reduce the need for on-site intervention, but it should be limited to the specific resources each user needs.

Make sure you can:

• Authenticate remote users before establishing connections
• Assign access according to user or device identity
• Limit vendors and contractors to authorized resources
• Remove or change permissions when roles change
• Encrypt remote connections from end to end

Identity-based policies can help organizations provide the access necessary to operate and maintain intelligent workplaces without broadly exposing the network.

OpenBlue Airwall provides secure remote access through identity-based policies and encrypted tunnels, allowing authorized employees, vendors and third parties to connect to specific resources without extending access to the wider network.

✓ Continuously reassess risk

An AI-powered workplace is not static. Devices change, applications are updated, employees and vendors come and go, and new connections are introduced frequently.

Cybersecurity therefore requires continuous visibility and management rather than a one-time deployment.

Build processes to:

• Monitor connected devices and system health
• Keep software and security protections current
• Review access privileges regularly
• Identify and address vulnerabilities
• Document changes and controls
• Reassess cybersecurity as AI use cases expand

Continuous oversight helps organizations identify and address security risks as they add new technologies, connections and AI-powered capabilities.

Build intelligence on a secure foundation

The connected technologies that power AI applications make workplaces more intelligent, but they also make cybersecurity a fundamental consideration in technology procurement, implementation and ongoing management.

Organizations should not have to choose between intelligence and security. As AI becomes more deeply embedded in workplace operations, cybersecurity must evolve from a technology safeguard into a foundational business capability. The organizations that scale AI successfully will be those that build trust, visibility and resilience into their digital infrastructure from the start.

OpenBlue brings together a unified, AI-ready data foundation, zero-trust cybersecurity and AI-powered intelligence. Together, these capabilities help organizations securely connect building systems, workplace technologies and IoT devices. This integrated approach helps organizations expand workplace intelligence while protecting the identities, connections and data that make it possible.