Building automation systems: are insecure protocols the real problem?

TL;DR: 91% of building automation systems still communicate over insecure protocols, while 73% of organisations have Known Exploited Vulnerabilities in at least one BAS, leaving connected facilities exposed to disruption, physical access abuse and ransomware leverage, according to Armis. The governance gap is no longer just patching, but ownership, visibility and continuity control across IT and OT.

Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Early Warning Insights for Building Automation Systems”.

By the numbers:

• 91% of Building Automation Systems communicate over insecure protocols.
• 73% of organizations have Known Exploited Vulnerabilities in at least one BAS.
• 73% of organizations operate building automation systems of a type already used in ransomware attacks.

Key questions

Q: What breaks when building automation systems still rely on insecure protocols?

A: Insecure BAS protocols break the assumption that a connected controller is only reachable by trusted operators.

Q: Why do vulnerable building automation systems create operational risk so quickly?

A: Because exploited BAS weaknesses can affect access control, environmental stability and service continuity at the same time.

Q: What are the signs that BAS visibility is failing?

A: The clearest signs are unknown device inventory, unmanaged protocol exposure, repeated KEV entries and a remediation backlog that grows faster than maintenance windows.

Practitioner guidance

• Assign explicit BAS ownership Create a named owner for each building automation environment so patching, access decisions and outage tolerance are governed as a business continuity issue, not an orphaned facilities task.
• Inventory insecure protocol exposure Map every BAS asset that still uses BACnet, KNX, Modbus or LonWorks and segment those paths from enterprise systems that do not need direct control-plane access.
• Replace periodic scanning with continuous detection Use continuous monitoring and early warning intelligence to track exposed controllers, especially where maintenance windows are limited and devices cannot be taken offline.

Bottom line: Building automation security is now a governance and continuity issue because connected BAS can influence both digital operations and physical outcomes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →