Building management systems now sit on the same networks as your corporate IT, run protocols with no built-in security, and in October 2026 were used to spoil food across hundreds of European supermarkets. This is what has changed this year and what a CISO should do about it. 

Why building management system security is an OT problem 

A building management system (BMS) is a network of controllers that monitors and runs a building's technical services: heating and cooling, lighting, elevators, fire alarms, access control, water and energy metering. Hospitals, data centres, airports and hotels all depend on one. Strip away the facilities vocabulary and it is operational technology: it controls physical processes, it has safety consequences, and it can't simply be switched off for patching. 

The trouble is that most organisations don't treat it that way. Ownership usually sits with facilities or an outside contractor, the security team has no asset list for it, and the vendor's remote-access tool was set up years ago by someone who has since left. When accountability belongs to neither IT nor OT, controls are rarely tested or reviewed. 

Three things make the exposure worse every year: 

• Convergence. Cloud dashboards, tenant apps, energy analytics and vendor support all push BMS traffic onto networks it was never designed for. 

• Old protocols. BACnet and Modbus were designed before cybersecurity was a concern, and they lack encryption and authentication, so anyone who can reach the network can talk to the devices. 

• Physical blast radius. A compromised BMS can affect door locks, elevators, fire systems and cooling, and it is an entry point into other business systems. 

For a CISO, the practical conclusion is simple: if a building system can stop a hospital ward, a trading floor or a cold chain, it belongs in your OT risk register next to the plant floor. 

What changed in 2026: the latest developments 

This year moved building system attacks from conference-talk theory to physical damage with a price tag. The events below are the ones a CISO should know, newest first. 

One pattern runs through every row: the attacker doesn't need to be clever about the building. They need a reachable controller, a default or leaked credential, and a vendor tunnel nobody is watching. 

The numbers behind building management system security 

Two large datasets, one from Claroty's Team82 and one from Armis, point the same way. Their samples and definitions differ, so read them as two readings of the same problem rather than one trend line. 

Claroty's own summary lists the usual culprits: outdated devices and operating systems, weak authentication, internet exposure, and unmanaged third-party remote access tools and open ports. None of those is exotic. All of them are fixable with ordinary OT hygiene, which is why the gap is a governance failure more than a technology one. 

Why a BMS is harder to secure than a plant floor 

It is tempting to apply your ICS playbook and move on. That works about half the time. TechTarget's IoT Agenda makes the point that BMS networks are far more interconnected than ICS networks, so a flat segmentation model built for a production line doesn't map cleanly onto a building. 

Where the building differs from the plant: 

1. Many small vendors in one estate. HVAC, lifts, fire, lighting, access control and metering each arrive with their own supplier, controller family and support contract. 

2. Contractors with standing access. Remote support was often added for convenience and rarely reviewed again. This is how the 2013 Target breach started, and it is still a common pattern. 

3. Long lifecycles, no maintenance windows. Controllers installed a decade ago still run the lobby and the chillers. Many cannot take a modern agent, and some cannot be restarted during occupied hours. 

4. Public documentation. As Ernie Hayden has pointed out, manuals available online often contain default passwords an attacker can use. 

5. Findable from the internet. Tools like Shodan index connected building systems by type and location, so discovery costs the attacker almost nothing. 

6. No natural owner. Facilities owns the asset, IT owns the network, a contractor owns the credentials, and security owns the risk. Nobody owns all four. 

The last point is the one to fix first. A named owner and a shared asset list will do more for your posture than any single tool. 

Four incidents worth studying 

Target (2013): the side door. Attackers stole credentials from a third-party HVAC contractor that had network access to monitor energy use and temperatures. That access wasn't segmented from payment infrastructure, and card data for more than 110 million accounts was exposed. The lesson is about vendor access and segmentation, not HVAC. 

Lappeenranta, Finland (2016): the cold apartments. A DDoS attack took out the building management systems of two apartment blocks from late October until 3 November, cutting heating and hot water. The controllers, made by Fidelix, rebooted in a loop and administrators lost remote access. It was a mild week for Finland. In January it would have been a safety incident. 

Danfoss refrigeration (October 2026): the spoiled stock. Hackers used online control systems to defrost refrigerators in European supermarkets, causing tens of millions in lost food. Claroty's Sean Tufts called the sector a time bomb and noted that set-point tampering is what researchers had worried about for years. Danfoss told AFP it had long advised customers to update firmware and migrate legacy systems. Reports differ on the scale: Facilities Dive describes hundreds of European supermarkets, while The Register focuses on French stores and mentions fires. 

A Canadian hospital (August 2026): the locked doors. Ransomware disrupted door access controls, central HVAC monitoring and staff card issuing. Clinical systems may have been untouched, yet the hospital was operating around a failed building. Armis Labs makes the same point: interrupting access control and elevators works as well as stealing data when the goal is ransom. 

Taken together, these show the three attacker goals you should model: use the building as a path into IT (Target), stop a service (Lappeenranta, the hospital), or cause physical loss (Danfoss). 

Vulnerabilities by vendor: what recent research shows 

The point of this section isn't to name and shame vendors. Every major platform has advisories. The point is that the same flaw classes keep recurring, and they map directly onto the controls in the playbook below. 

Tridium is worth special attention. Honeywell says more than a million Niagara instances exist worldwide, bridging building systems and enterprise applications. Nozomi's chain was fully exploitable only on misconfigured systems, which is a useful reminder that hardening guidance is a security control, not a footnote. 

The Metasys advisory also shows a timing problem. Version 15.0 was patched in March 2026, yet the CISA alert arrived in August. Anyone waiting for a public advisory before patching was months behind. 

Regulation: building systems are already in scope 

Smart buildings are rarely named in legislation, but regulators increasingly expect demonstrable measures wherever physical systems affect health, safety or continuity. Three frameworks matter most right now. 

• NIS2. The directive explicitly extends its requirements to OT, with systematic risk management under Article 21 and defined incident reporting. Germany's implementing act has been in force since 6 December 2025, a useful signal for other member states. If your BMS supports an essential or important entity, it is in your scope. 

• EU Cyber Resilience Act (Regulation 2024/2847). It entered into force on 10 December 2024 and reporting obligations for manufacturers began on 11 September 2026, with the main product requirements phasing in after that. It is mostly a vendor regulation, but Forescout argues that asset owners carry more responsibility than they realise, because failing to deploy disclosed patches while in NIS2 scope compounds your exposure. 

• CISA and NIST guidance. CISA's current OT guidance, as summarised in a facility guide reviewed in August 2026, calls for removing operational assets from the public internet, secure remote access, strong authentication, least privilege, disabling dormant accounts, and the ability to operate manually. NIST SP 800-82 Rev. 3 is the usual reference for OT security programmes. 

For control frameworks, IEC 62443 and ISO 27001 are becoming the default benchmarks across OT environments. This is general information, not legal advice, so confirm your own scope with counsel. 

A CISO playbook for building management system security 

The ten steps below are ordered by how much risk each removes per unit of effort. The first four need no new technology. 

1. Name one accountable owner. Put the BMS in the OT risk register and agree who decides when a patch, a vendor connection or a firewall rule affects both safety and security. 

2. Build a real asset inventory. Include controllers, gateways, field devices, supervisory servers and the cloud connectors that sit above them. You can't segment or patch what you haven't found, and passive discovery avoids disturbing fragile BACnet and Modbus devices. 

3. Take BMS off the public internet. Check your own address ranges the way an attacker would, using internet-scanning services. Where remote access is needed, make it intentional, limited and authenticated. 

4. Control vendor and contractor access. Use a managed access path with multi-factor authentication, named accounts, time-boxed sessions and logging. Retire shared credentials and tunnels nobody can explain. 

5. Segment the building. Give BMS its own zones, separate from corporate IT, and put access control, fire and lifts behind controlled conduits. Johnson Controls' own Metasys advice is network segmentation. 

6. Fix identity and credentials. Change defaults on the system, workstations and field devices, disable dormant accounts, and plan for devices with hardcoded credentials, which need isolation rather than a password change. 

7. Run a patch process built for OT. Monitor vendor bulletins and CISA advisories, rank by known exploited status and exposure, test, then schedule. Where a device can't be patched, document the compensating control and its owner. 

8. Monitor at the protocol level. Watch for new devices, unexpected writes to set-points, abnormal scan activity and gateway behaviour. Set-point tampering looks like normal traffic unless you know what normal is. 

9. Plan to operate without the BMS. Document local control procedures, safe states, contact lists and trained staff, and test them. Manual operation varies by system and can itself be hazardous, so involve qualified engineers. 

10. Raise the bar on procurement. Require patch support periods, vulnerability disclosure commitments and secure-by-default configuration in contracts, and ask suppliers how they will meet the Cyber Resilience Act. Set an end-of-support plan for legacy controllers. 

Questions a board should ask in the next quarter 

• How many building systems can reach the internet, and who approved each one? 

• Who can connect remotely, and when did we last review that list? 

• If the BMS went down at our most critical site tomorrow, how long could we operate manually? 

• How quickly do we learn about, and act on, a vendor advisory for our building controllers? 

How Shieldworkz approaches building OT security 

Shieldworkz is an end-to-end industrial OT cybersecurity company. It secures SCADA, OT and IoT environments and brings platform, services and solutions together as one bundle, so a building management system doesn't have to be handled as a separate project from the rest of your critical infrastructure. 

That matters here for a practical reason: the playbook above crosses several disciplines at once. Asset visibility, network segmentation, secure remote access, patch management and incident readiness are usually bought from different suppliers and owned by different teams. A single OT-focused partner can treat them as one programme, with one asset list and one risk view across plant, campus and building. 

If you are starting out, the most useful first conversation is an assessment of what is connected, what is reachable and who has access. Talk to the Shieldworkz team about a building and OT exposure review for your sites. 

Frequently asked questions 

What is building management system security? 

Building management system security is the practice of protecting the controllers, networks, software and remote access paths that run a building's heating, cooling, lighting, lifts, fire and access control systems. It applies OT security methods, such as asset inventory, segmentation and protocol-aware monitoring, to facilities. 

Why are building management systems targeted by attackers? 

They are often reachable, rarely patched and poorly monitored, and an outage creates immediate pressure on the victim. Attackers use them as an entry point into other systems, to stop a service, or to cause physical loss, as in the October 2026 supermarket refrigeration attacks. 

Is a BMS part of operational technology? 

Yes. A BMS monitors and controls physical processes and has safety consequences, which is the working definition of OT. It should sit in the same risk register and governance as industrial control systems. 

What are the biggest BMS vulnerabilities? 

The recurring ones are internet exposure, default or hardcoded credentials, unpatched firmware, insecure protocols such as BACnet and Modbus that lack encryption and authentication, and unmanaged third-party remote access. 

How do you secure remote access to a BMS? 

Remove the system from the public internet, route access through a managed gateway with multi-factor authentication and named accounts, limit sessions to what the vendor needs, log everything, and disable dormant accounts. 

Does NIS2 apply to building management systems? 

NIS2 extends to OT, so a BMS that supports an in-scope essential or important entity falls within its risk management and reporting duties. Check your national transposition and take legal advice on scope. 

Can a BMS be patched without downtime? 

Often not, because controllers run continuously and some can't restart during occupied hours. Plan maintenance windows, test updates, and where patching is impossible use isolation and monitoring as documented compensating controls.