Building automation systems are now an endpoint exposure problem

At a glance

What this is: Armis argues that building automation systems now behave like exposed endpoints, with ransomware actors able to disrupt physical operations rather than just data.

Why it matters: This matters to IAM practitioners because access control, remote administration, and credential governance increasingly extend into operational technology environments where building systems can become part of the attack path.

By the numbers:

• 73% of organizations operate building automation systems of a type already used in ransomware attacks.
• 73% carry Known Exploited Vulnerabilities in at least one building automation system.
• 91% of building automation systems communicate over insecure protocols.

Context

Building automation systems are the control layer for facilities functions such as HVAC, access control, lighting, alarms and elevators. When those systems are connected to corporate IT and cloud environments, they inherit the same exposure pressures as other internet-facing assets, but they often retain older protocols and weaker governance.

The key security problem is not only that these systems are reachable. It is that their operational importance gives attackers leverage, especially in hospitals and other critical facilities where downtime creates immediate physical and business pressure. That makes lifecycle control, segmentation and remote access governance part of the security conversation, not just facilities management.

Key questions

Q: What breaks when building automation systems are connected to enterprise networks without redesigning access controls?

A: The systems inherit hostile-network conditions while still relying on trust assumptions from closed environments. That means authentication, encryption and access governance may be too weak for the new exposure model, and attackers can use that weakness to disrupt physical operations rather than just IT services.

Q: Why do building automation vulnerabilities create more leverage than ordinary endpoint flaws?

A: Because the target is operational continuity. If an attacker can stop HVAC, badge issuance or elevator service, the organisation faces immediate physical and business pressure, even when core data remains intact. That leverage can make the attack more coercive than a typical data-only compromise.

Q: What are the signs that BAS risk is being underestimated in a security programme?

A: Common signs include unclear ownership, remote access paths that bypass standard identity controls, legacy protocols that remain trusted by default, and patching processes that assume maintenance windows will always be available. If those conditions exist, the programme is likely treating building systems as exceptions rather than endpoints.

Q: How should organisations govern privileged access to building automation systems?

A: Treat BAS administrators, vendor support accounts and embedded credentials as privileged identities with lifecycle controls, not as one-off facilities exceptions. That means inventorying access, removing standing privilege where possible, and aligning remote administration with the same approval and review discipline used for other high-risk systems.

Technical breakdown

Why legacy building protocols create persistent exposure

Many building automation protocols were designed for closed, air-gapped networks where devices on the wire were assumed to be trusted. Once those same systems are exposed through enterprise connectivity, the lack of native authentication and encryption becomes a structural weakness rather than a historical quirk. BACnet, KNX, Modbus and LonWorks were built for reliability, not hostile-network verification, so visibility tools alone cannot compensate for protocol trust assumptions that were never redesigned for internet adjacency.

Practical implication: Treat protocol choice and network placement as governance decisions, not just engineering preferences.

How inherited vendor stacks preserve hidden access paths

Long-lived building platforms often outlive the organisations that first deployed them, which means undocumented backdoors, hard-coded credentials and stale firmware can survive multiple ownership changes. That creates an access problem as much as a patching problem, because the environment may contain administrative paths that no current team fully understands. In practice, the risk is not merely technical debt but unowned identity and access state hidden inside operational systems.

Practical implication: Inventory administrative pathways and remove any credential or backdoor that no longer has a clear owner.

Why early warning matters more than periodic scanning

The report’s central operational point is that building automation teams cannot wait for public vulnerability listing cycles to catch up. If exploitation can begin before a vulnerability reaches the official catalog, then the relevant control is early warning paired with compensating controls, not calendar-based patch rhythm. For environments that cannot be taken offline, this shifts the problem from remediation scheduling to exposure reduction and threat-informed detection. See the Breach and Attack Simulation (BAS) Guide.

Practical implication: Use continuous monitoring and risk-based containment for BAS assets that cannot be patched on demand.

Threat narrative

Attacker objective: The attacker wants operational disruption that is painful enough to pressure the organisation into compliance without needing to encrypt the clinical record or other core data.

1. Entry occurs through exposed or insecurely managed building automation systems that were not designed for hostile-network access.
2. Escalation follows when attackers exploit weak protocol trust, hard-coded credentials or inherited administrative access paths.
3. Impact lands in physical operations, with HVAC, access control, elevators, lighting or safety systems disrupted to create leverage for extortion.

Breaches seen in the wild

• Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Building automation has become a governance problem, not just a facilities problem. Once HVAC, badge issuance, elevator control and access systems are network-connected, they inherit the same exposure logic as other endpoints. The practical failure is not simply that they exist, but that many programmes still manage them outside the identity, access and monitoring models used for enterprise systems. That gap leaves no clear owner for credentials, remote administration or offboarding, so the attack surface persists even when the business assumes it is covered.

Insecure-by-design protocols create a trust debt that conventional visibility cannot repay. Building systems often still rely on protocols that assume trusted networks and trusted operators, which means authentication and encryption are absent at the layer where control decisions are made. That is why the problem is not solved by more scanning alone; the protocol architecture itself preserves the trust gap. Practitioners should treat this as a structural exposure problem and align privileged access management with segmentation and remote access rules.

Early warning exposure gap: the real control failure is the delay between exploitation and public cataloguing, not the absence of a patch ticket. The article shows that active exploitation can precede official listing by years, which means security teams are operating with an outdated assumption that public advisories define the relevant response window. The practitioner conclusion is to govern BAS exposure as a live threat state, not a vulnerability calendar.

Identity and access governance now extends into operational technology. The article’s strongest identity lesson is that admin access to building systems can no longer be treated as a niche facilities exception. Where inherited vendor stacks carry hard-coded credentials and undocumented access paths, the issue is classic privileged access sprawl inside a non-traditional asset class. Teams that already govern service and machine access should apply the same lifecycle discipline to BAS access paths.

What this signals

Exposure-window management becomes the right control objective for BAS. The article shifts the question from whether a vulnerability exists to how long it stays exploitable before the organisation can contain it. That matters because operational systems often cannot accept the same patch tempo as IT assets, so the programme has to measure time-to-containment rather than ticket closure.

Building systems now sit inside the wider identity governance perimeter. When remote support, inherited vendor credentials and admin pathways are part of the attack surface, BAS governance becomes a privilege problem as much as a resilience problem. Teams that already manage privileged access management should extend those controls to operational technology rather than leaving facilities access outside their model.

Continuous detection will matter more than periodic review in connected facilities. Attackers exploit the gap between publication, cataloguing and remediation, and that gap widens when assets cannot be taken offline. Security teams should prepare for BAS monitoring that treats active exploitation as the signal, not the exception.

For practitioners

• Map the full BAS attack surface Identify every building automation asset that is reachable from corporate IT, remote support networks or cloud-connected management layers, then classify it by operational criticality and exposure path.
• Remove standing administrative access Review building system administrator accounts, vendor remote access and hard-coded credentials, then revoke or replace any path that is not tied to a current owner and approval workflow.
• Prioritise compensating controls for unpatchable assets Where a controller or protocol cannot be updated without outage, use segmentation, protocol monitoring and restricted remote access to reduce the exposure window instead of waiting for maintenance cycles.
• Adopt continuous threat-informed monitoring Track active exploitation indicators for BAS assets and compare them to your internal inventory so that detections and containment decisions are driven by exposure, not publication dates.

Key takeaways

• Building automation systems have become an extortion surface because attackers can disrupt physical operations even when the main clinical or business record stays online.
• The article’s numbers show a broad exposure problem, with 73% of organisations operating systems already seen in ransomware, 73% carrying Known Exploited Vulnerabilities and 91% communicating insecurely.
• The practical fix is not waiting for routine patch cycles but reducing exposure windows with segmentation, access governance and continuous threat-informed monitoring.

Related NHI Mgmt Group resources: Privileged Access Management Guide · Service Account Security Guide · Breach and Attack Simulation (BAS) Guide · Gravity SMTP CVE-2026-4020 API Keys Exposure

Key terms

• Building Automation System (BAS): Building Automation System (BAS) is the control system that monitors and automates heating, ventilation, air conditioning, lighting and other building functions. Because BAS devices often bridge IT and operational technology, attackers may use them for lateral movement or disruption. Operators should segment access, restrict remote administration and monitor controller changes and unusual commands.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.
• Insecure-by-Design Protocol: An insecure-by-design protocol is a communication standard that lacks modern security controls such as authentication or encryption because it was created for trusted networks. In building systems, that legacy design becomes dangerous once the protocol is exposed beyond its original air-gapped environment.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners extend lifecycle control into systems and access paths that behave like privileged identities.