The hidden enterprise risk inside connected buildings

Key takeaways

• Digital building transformation creates risks at the IT/OT boundary
• Building automation systems are designed for availability, not security, and often lack access controls
• Common IT/OT risks include lateral movement, default credentials, legacy firmware and third-party access
• Building a cybersecurity governance framework starts with the recognition that the IT/OT boundary is now an enterprise risk management issue

As organizations connect more building systems to improve operations, they also expand the number of potential cyber entry points. What was once considered facilities infrastructure is now part of the digital enterprise, creating new pathways between operational technology (OT), information technology (IT) and critical business systems.

In simple terms, IT includes the digital systems that manage data, applications and business operations. OT includes the physical systems that keep buildings and equipment running. OT such as sensors, controllers and building automation systems (BAS) can improve efficiency and visibility, but they also create hidden pathways between physical operations and digital systems.

The digital transformation security risk grows when connected devices sit between traditional IT and OT environments. These systems may collect operational data, support automation or connect building equipment to enterprise platforms, creating exposure that neither IT nor facilities teams fully own. Recent research from Forescout's Vedere Labs found that, on average, industrial network segments contain 54 devices across four device types. The result is a significant "blast radius" if any of these IT or OT devices are compromised.

If attackers compromise connected building systems, they may move laterally into software systems or databases. As a result, IT/OT boundaries shift from a technical issue to a C-suite governance challenge.

Why the IT/OT boundary is now an enterprise risk issue

Historically, IT and OT systems were separate, which provided a natural security barrier. While OT platforms and devices connected via local intranets, attackers had no direct pathway from information to operational layers.

Industry 4.0 blurred this line. As companies recognized the benefits of always-connected systems that can share and analyze data on demand, IT and OT moved closer together. While this offers significant benefits, it also introduces new challenges.

Connected building systems can create new entry points

These systems were designed for availability and comfort, not cybersecurity. Many don't have dedicated access controls, and those that do may not be updated from their default states. Connecting these systems to corporate networks expands the number, type and origin point of potential threats.

Evolving cybersecurity guidance

The NIST Guide to Operational Technology (OT) Security describes best practices for securing industrial control systems, BAS and physical environment measurement systems. While the most recent revision was published in 2023, NIST has released a draft of Revision 4, which expands the discussion of OT risk management within the broader context of enterprise risk management and restructures the guidance to better align with the NIST Cybersecurity Framework (CSF) 2.0.

Cyber-physical incidents

Unlike traditional cyber incidents, cyber-physical attacks can simultaneously affect operations, safety, customer experiences and revenue-generating activities. Compromised building control systems can create safety issues and production delays, leading to revenue loss. Even after identifying risks, companies must still spend time and money finding and remediating root causes. Repeated breaches may also lead to reputational damage if customer data is exposed.

Top cyber-physical risks at the IT/OT boundary

While OT systems face similar risks to their IT counterparts, they also pose unique challenges.

Lateral movement from building systems to corporate networks

Weak network segmentation allows attackers who compromise a building management system (BMS) or HVAC controller to pivot and access sensitive IT systems. This is especially problematic if the initial compromise doesn't trigger security controls. Malicious actors could remain undetected for weeks or months, even as they move into protected systems.

Potential compromise pathways include smart building middleware and OT devices themselves. Real-world examples include:

• A 2025 vulnerability in facilities management software let attackers manipulate physical systems and move laterally into more sensitive networks
• Recent vulnerabilities in uninterruptible power supply (UPS) and HVAC controllers show how attackers can exploit building systems without valid credentials, creating potential pathways into operational environments

Default credentials and weak authentication

Credentials and authentication are also issues. Many BMS platforms ship with factory-default passwords that IT or OT teams never change. If attackers can identify the devices in use, they can search online for the make and model and find the default password.

Changing login credentials improves security but doesn't eliminate the risk. If attackers use phishing or other social engineering techniques to discover new passwords, they can still access OT systems. Mitigating this issue requires implementing multi-factor authentication (MFA) on all OT endpoints and third-party vendor remote access tools, but this task often falls to the bottom of cybersecurity checklists.

Legacy firmware and unpatched systems

Replacing OT devices can be costly and time-consuming. As a result, many companies use a combination of old and new equipment, which can complicate patch management. Newer devices may have monthly or weekly updates, while legacy tools may be outside of vendor support and receive only occasional fixes for critical security risks.

OT patch cycles can also conflict with uptime requirements. This creates a governance coordination issue:

• Which systems are prioritized for patching?
• When does patching occur to minimize downtime?
• What fail-safes are in place to mitigate lost time if conflicts occur?

Third-party supply chain access

Third-party providers and vendors often require access to enterprise networks, but this introduces risk. Many third parties use non-enterprise-grade remote access tools that aren't properly managed, making it easier for attackers to slip through.

Third-party providers may also fall victim to cyberattacks. If these attacks aren't detected or mitigated, attackers may move laterally into OT environments. The result is an attack surface that extends beyond the building perimeter and along the entire supply chain.

The governance gap: Why technical controls alone are not enough

Risk registers, change-control processes and incident-response plans help mitigate cybersecurity concerns. But many organizations maintain separate versions for IT and OT, creating gaps that let attackers slip through unnoticed.

The solution is to go beyond technical controls and govern risk as a unified enterprise concern. In many cases, however, this is easier said than done due to cultural division.

IT security teams prioritize confidentiality. Consider the recent uptake of zero-trust initiatives, whose core principle is "never trust, always verify." For security professionals, minor inconvenience is a small price to pay for safety. OT and facilities teams, meanwhile, are focused on availability. They want maximum uptime and minimum friction. Security is still a concern, but it's lower on the list.

These differing approaches create security blind spots. OT teams may inadvertently leave digital doors open, and IT teams may not even be aware that these doors exist. Reducing this exposure requires shared ownership, coordinated controls and visibility across both environments.

Five executive actions to govern cyber-physical risk

Unified governance is the key to reducing boundary risks, but it requires more than just asking IT and OT teams to coordinate. Leaders need clear ownership, shared processes and visibility into how cyber-physical risks affect business continuity. Here are five steps to build an actionable cyber-governance framework.

1. Build a unified inventory of connected building assets

Protection requires visibility. This starts with a unified asset inventory that catalogs and maps all physical, digital and hybrid devices connected to the enterprise’s networks. Common assets include production line equipment and machinery, HVAC and lighting systems, PLC controllers and IoT sensors, third-party applications, facilities management software and any existing security controls.

2. Establish shared ownership across IT, OT and facilities

Risks don't exist in isolation. A compromised HVAC network opens the door to software security issues, while social engineering efforts may enable attackers to take control of power or lighting systems. Executive leaders and board risk committees should require cross-functional governance frameworks that clarify ownership, escalation paths and risk reporting, aligned to guidance such as NIST CSF 2.0. IT/OT teams should meet regularly to align goals and identify risk targets.

3. Align change control across IT and OT environments

Require IT, OT and facilities teams to coordinate change control so security updates, operational constraints and downtime risks are managed together. Legacy systems may not support modern controls or rapid patch cycles, so teams need a shared process for prioritizing updates, documenting exceptions and reducing risk without disrupting critical operations. Risk management standards such as ISO 31000 can help teams evaluate control gaps and align decisions to enterprise risk.

4. Deploy continuous monitoring at boundary points

Continuous monitoring tools at boundary points such as network gateways, user access portals and third-party application connectors provide early warning about potential threats. Chief Information Security Officers (CISOs) can provide the knowledge and expertise necessary to identify key points of compromise and create effective monitoring strategies.

The International Society of Automation’s ISA/IEC 62443 Series of Standards offers guidance for industrial automation and control systems in OT environments and helps enterprises identify where monitoring is required and how to implement it.

5. Test response plans across digital and physical operations

Require joint tabletop exercises that test both digital and physical consequences of a cyber incident. A response plan should clarify who makes decisions, how teams communicate, which systems must stay operational and how the organization will recover if building systems, enterprise systems or third-party access are compromised.

From risk register to resilience: The executive imperative

Cyber-physical security at the IT/OT boundary is a strategic governance issue, not a procurement decision. Attackers thrive where confusion exists — if IT and OT teams aren't on the same page, attacks are more likely to penetrate defenses, go undetected and cause long-term damage.

Rather than racing to connect and modernize, the organizations that focus on connectivity governance will see the most benefit from digitalization. This approach better positions leaders to protect operations, reduce exposure and modernize their building portfolios with confidence.