TL;DR: 91% of building automation systems still communicate over insecure protocols, while 73% of organisations have Known Exploited Vulnerabilities in at least one BAS, leaving connected facilities exposed to disruption, physical access abuse and ransomware leverage, according to Armis. The governance gap is no longer just patching, but ownership, visibility and continuity control across IT and OT.
At a glance
What this is: This Armis report shows that BAS security risk is being driven by insecure legacy protocols, exposed vulnerabilities and the operational reach of building systems into physical environments.
Why it matters: It matters because BAS now sits at the IT and OT boundary, where weak identity, poor visibility and slow remediation can translate into facility disruption, safety impact and privileged physical access.
By the numbers:
- 91% of Building Automation Systems communicate over insecure protocols.
- 73% of organizations have Known Exploited Vulnerabilities in at least one BAS.
- 73% of organizations operate building automation systems of a type already used in ransomware attacks.
- around 28% of vulnerabilities are exploited the same day they are published on the CISA KEV catalog.
Context
Building automation systems are no longer isolated controllers hidden inside mechanical rooms. They now connect HVAC, lighting, access control, energy management and fire-and-life safety into shared environments that sit directly on the boundary between IT and OT, which changes the risk model from local device failure to enterprise-wide operational exposure.
The central governance problem is that many BAS platforms still rely on protocols and operating assumptions built for closed networks, while modern estates treat them as always-on, interconnected infrastructure. When BAS identity, access and monitoring are weak, the result is not only cyber risk but the possibility of physical access abuse, service disruption and delayed recovery across critical facilities.
Key questions
Q: What breaks when building automation systems still rely on insecure protocols?
A: Insecure BAS protocols break the assumption that a connected controller is only reachable by trusted operators. Once those systems sit on shared networks, unauthenticated or weakly authenticated traffic can influence building functions, creating a path from cyber exposure to physical disruption. The real failure is governance, because the environment was designed for a closed world that no longer exists.
Q: Why do vulnerable building automation systems create operational risk so quickly?
A: Because exploited BAS weaknesses can affect access control, environmental stability and service continuity at the same time. When a controller governs doors, HVAC or safety functions, compromise can force workarounds or shutdowns that are more disruptive than data loss. The risk increases when remediation lags and the system remains continuously reachable.
Q: What are the signs that BAS visibility is failing?
A: The clearest signs are unknown device inventory, unmanaged protocol exposure, repeated KEV entries and a remediation backlog that grows faster than maintenance windows. If teams cannot say which controllers are reachable, which facilities depend on them and which compensating controls are in place, visibility is already failing.
Q: Should security teams treat building automation like OT or like enterprise IT?
A: They need both lenses, but neither alone is sufficient. BAS behaves like OT because it controls physical processes, yet it is increasingly managed through IT networks and cloud-connected platforms. That means ownership, segmentation, identity controls and continuity planning must be aligned across both domains rather than delegated to one team.
Technical breakdown
Why legacy BAS protocols create trust gaps
Building automation environments often rely on BACnet, KNX, Modbus and LonWorks, protocols that were designed for reliability inside closed networks rather than for authenticated, segmented communications across enterprise networks. That matters because many of these systems assume trust at the transport layer rather than at the device or session layer, so a controller that is reachable can often be queried or influenced without strong identity assurance. Once these systems are network-connected, the old air-gap assumption collapses and every exposed endpoint becomes a potential control surface.
Practical implication: treat BAS protocol exposure as an identity and segmentation problem, not only a patching problem.
How BAS exposure turns into physical and operational impact
BAS is unusual because compromise can produce tangible real-world consequences. Attackers do not always need to steal data or deploy ransomware payloads to create leverage. If they can manipulate building controls, they may affect badge access, lock states, environmental controls or safety-related operations, which can force shutdowns or create pressure on incident response teams. In this class of environment, the asset is not just the controller itself but the continuity of the building function it governs.
Practical implication: map BAS control paths to business services and safety outcomes so containment decisions reflect real operational impact.
Why remediation backlogs matter more in BAS than in conventional IT
Armis points to a fast-moving exploit environment where many vulnerabilities are weaponised quickly and some exploited CVEs never make it into the primary catalog teams track. That creates a mismatch between the rate of exposure and the pace of operational remediation, especially because BAS equipment often cannot be taken offline for conventional maintenance windows. The result is that periodic scanning alone creates a false sense of control while known weaknesses remain live for long periods.
Practical implication: replace scan-and-wait models with continuous discovery, prioritisation and compensating controls for BAS assets.
Threat narrative
Attacker objective: The attacker aims to turn building infrastructure into a disruption vector and a source of physical or operational leverage.
- Entry occurs when attackers reach building automation controllers or connected management platforms exposed through insecure protocols and flat network placement.
- Escalation follows when the attacker abuses the controller's implicit trust to influence physical functions or pivot toward adjacent enterprise or OT assets.
- Impact emerges when the compromised BAS is used to disrupt operations, manipulate access control or create leverage consistent with ransomware-style extortion.
Breaches seen in the wild
- Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Building automation has become an identity and continuity problem, not just an OT hygiene problem. Once HVAC, access control and safety systems sit on shared networks, the question is no longer whether the device is patched, but whether the system has a defensible trust model and a named owner. That makes BAS governance similar to NHI governance in one important way: unmanaged access paths persist long after teams think they have visibility. Practitioners should treat the environment as operationally critical infrastructure with explicit accountability.
Insecure protocols are the named concept this category keeps exposing. BACnet, Modbus and related protocols were not built for hostile network conditions, and the article shows how that design choice now creates a durable exposure surface. The failure mode is not just legacy technology, but legacy trust assumptions surviving inside modern connected estates. For security teams, the practical conclusion is that segmentation, protocol-aware monitoring and compensating controls matter more than hoping to retire every vulnerable device quickly.
The remediation backlog is the control gap that matters most in BAS. If nearly a third of vulnerabilities can be exploited the same day they enter public tracking, periodic review is already behind the threat. In environments that cannot be taken offline, the governance assumption that remediation can keep pace on its own is false. This is where continuous detection and exposure reduction become the real control objective, especially for facilities that underpin safety or business continuity.
BAS risk now bridges cyber operations and physical access control. That intersection is what makes the domain different from ordinary enterprise IT: a compromised controller can alter who gets in, what stays powered and whether a site remains safe to operate. Identity and access teams should therefore be involved in BAS governance, not because BAS is a classic IAM workload, but because privileged physical actions now depend on digital control paths. Practitioners should align OT ownership, access governance and incident response before an incident forces the decision.
Continuous visibility is the only credible response to systems that cannot be routinely removed from service. The article is pointing to a structural constraint, not a tooling gap. When devices remain online through vulnerability cycles, teams need to know what is exposed, what is compensating for weak controls and which facilities carry the highest operational consequence. That means shifting from compliance snapshots to exposure-managed operations, with clear ownership and escalation paths.
What this signals
Building automation now deserves the same governance discipline as other operationally critical environments. The problem is not only exposure, but the organisational habit of treating BAS as a facilities afterthought until an incident reveals how much business continuity depends on it. Teams should tie BAS ownership to risk acceptance, segmentation and recovery planning, not to maintenance schedules alone.
Insecure protocol exposure creates a durable control gap that patching alone will not close. Where legacy BAS protocols remain in use, the practical answer is to reduce reachable surface area and enforce stronger network boundaries around controllers and management planes. Security programmes should expect these environments to remain in service long enough that compensating controls matter more than theoretical replacement plans.
Continuous visibility is the right operating model for connected facilities. BAS cannot be managed safely with periodic snapshots when the remediation queue is longer than the maintenance window and exploitation can arrive quickly after disclosure. Practitioners should focus on real-time inventory, priority ranking and containment paths that work even when devices stay online.
For practitioners
- Assign explicit BAS ownership Create a named owner for each building automation environment so patching, access decisions and outage tolerance are governed as a business continuity issue, not an orphaned facilities task.
- Inventory insecure protocol exposure Map every BAS asset that still uses BACnet, KNX, Modbus or LonWorks and segment those paths from enterprise systems that do not need direct control-plane access.
- Replace periodic scanning with continuous detection Use continuous monitoring and early warning intelligence to track exposed controllers, especially where maintenance windows are limited and devices cannot be taken offline.
- Prioritise compensating controls for KEV-listed BAS Treat BAS assets with Known Exploited Vulnerabilities as active operational risk and add segmentation, restricted management access and alerting while remediation waits.
Key takeaways
- Building automation security is now a governance and continuity issue because connected BAS can influence both digital operations and physical outcomes.
- The report's core evidence points to a large inherited exposure surface, with insecure protocols and exploited vulnerabilities still common across BAS estates.
- The most effective response is to name ownership, reduce reachable exposure and maintain continuous detection where devices cannot be taken offline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006;TA0008;TA0040 — Credential Access; Lateral Movement; Impact | The article describes controller abuse, pivot risk and disruption as the core threat pattern. |
| Recommendation — Map BAS exposures to attack paths that end in impact and hunt for controller-to-network pivot routes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | BAS governance hinges on who can reach management planes and physical-control interfaces. |
| Recommendation — Restrict BAS management access and validate entitlements for every control path into building systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Shared and unmanaged accounts are a recurring weakness in operational environments with long-lived controllers. |
| Recommendation — Review BAS account ownership, remove orphaned access and tie each account to an accountable owner. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is directly relevant where BAS access can affect both facilities and adjacent networks. |
| Recommendation — Apply least-privilege access to BAS operators, engineers and remote maintenance paths. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | Privileged access to building controls needs explicit governance because compromise has physical consequences. |
| Recommendation — Define and review privileged access rights for BAS management interfaces and remote support channels. | ||
Key terms
- Building Automation System (BAS): Building Automation System (BAS) is the control system that monitors and automates heating, ventilation, air conditioning, lighting and other building functions. Because BAS devices often bridge IT and operational technology, attackers may use them for lateral movement or disruption. Operators should segment access, restrict remote administration and monitor controller changes and unusual commands.
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
- Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management in the context of real operational risk. It helps security, IAM and infrastructure teams align identity controls with the systems they are responsible for.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org