Topic starter
23/10/2026 12:46 am
TL;DR: A large share of building automation estates still depends on insecure protocols and known exploited vulnerabilities, according to Armis. BAS networks now need ownership, visibility and continuity planning because compromised controllers can affect both physical access and service uptime.
Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Early Warning Insights for Building Automation Systems”.
By the numbers:
- 91% of Building Automation Systems communicate over insecure protocols.
- 73% of organizations have Known Exploited Vulnerabilities in at least one BAS.
- 73% of organizations operate building automation systems of a type already used in ransomware attacks.
Key questions
Q: Why do vulnerable building automation systems create operational risk so quickly?
A: Because exploited BAS weaknesses can affect access control, environmental stability and service continuity at the same time.
Q: What are the signs that BAS visibility is failing?
A: The clearest signs are unknown device inventory, unmanaged protocol exposure, repeated KEV entries and a remediation backlog that grows faster than maintenance windows.
Q: What breaks when building automation systems still rely on insecure protocols?
A: Insecure BAS protocols break the assumption that a connected controller is only reachable by trusted operators.
Practitioner guidance
- Assign explicit BAS ownership Create a named owner for each building automation environment so patching, access decisions and outage tolerance are governed as a business continuity issue, not an orphaned facilities task.
- Inventory insecure protocol exposure Map every BAS asset that still uses BACnet, KNX, Modbus or LonWorks and segment those paths from enterprise systems that do not need direct control-plane access.
- Replace periodic scanning with continuous detection Use continuous monitoring and early warning intelligence to track exposed controllers, especially where maintenance windows are limited and devices cannot be taken offline.
Bottom line: Building automation security is now a governance and continuity issue because connected BAS can influence both digital operations and physical outcomes.
Glossary terms: Building Automation System (BAS), Operational Technology, Compensating Control, Known Exploited Vulnerability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:48 am
Building automation has become an identity and continuity problem, not just an OT hygiene problem. Once HVAC, access control and safety systems sit on shared networks, the question is no longer whether the device is patched, but whether the system has a defensible trust model and a named owner. That makes BAS governance similar to NHI governance in one important way: unmanaged access paths persist long after teams think they have visibility. Practitioners should treat the environment as operationally critical infrastructure with explicit accountability.
A question worth separating out:
Q: Should security teams treat building automation like OT or like enterprise IT?
A: They need both lenses, but neither alone is sufficient. BAS behaves like OT because it controls physical processes, yet it is increasingly managed through IT networks and cloud-connected platforms. That means ownership, segmentation, identity controls and continuity planning must be aligned across both domains rather than delegated to one team.
👉 Read our full editorial: Building automation security gaps widen as insecure protocols persist
This post was modified 6 days ago by NHI Mgmt Group