Topic starter
25/10/2026 11:11 am
TL;DR: 73% of organisations are operating building automation systems already seen in ransomware, with 73% carrying Known Exploited Vulnerabilities and 91% communicating insecurely, according to Armis. BAS exposure now needs continuous monitoring and tighter segmentation before physical operations become the pressure point.
Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Your Building is Now an Endpoint: Closing the BAS Exposure Window in 2026”.
By the numbers:
- 73% of organizations operate building automation systems of a type already used in ransomware attacks.
- 73% carry Known Exploited Vulnerabilities in at least one building automation system.
- 91% of building automation systems communicate over insecure protocols.
Key questions
Q: Why do building automation vulnerabilities create more leverage than ordinary endpoint flaws?
A: Because the target is operational continuity.
Q: What are the signs that BAS risk is being underestimated in a security programme?
A: Common signs include unclear ownership, remote access paths that bypass standard identity controls, legacy protocols that remain trusted by default, and patching processes that assume maintenance windows will always be available.
A: The systems inherit hostile-network conditions while still relying on trust assumptions from closed environments.
Practitioner guidance
- Map the full BAS attack surface Identify every building automation asset that is reachable from corporate IT, remote support networks or cloud-connected management layers, then classify it by operational criticality and exposure path.
- Remove standing administrative access Review building system administrator accounts, vendor remote access and hard-coded credentials, then revoke or replace any path that is not tied to a current owner and approval workflow.
- Prioritise compensating controls for unpatchable assets Where a controller or protocol cannot be updated without outage, use segmentation, protocol monitoring and restricted remote access to reduce the exposure window instead of waiting for maintenance cycles.
Bottom line: Building automation systems have become an extortion surface because attackers can disrupt physical operations even when the main clinical or business record stays online.
Glossary terms: Exposure Window, Building Automation System (BAS), Insecure-by-Design Protocol, Compensating Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Building automation has become a governance problem, not just a facilities problem. Once HVAC, badge issuance, elevator control and access systems are network-connected, they inherit the same exposure logic as other endpoints. The practical failure is not simply that they exist, but that many programmes still manage them outside the identity, access and monitoring models used for enterprise systems. That gap leaves no clear owner for credentials, remote administration or offboarding, so the attack surface persists even when the business assumes it is covered.
A question worth separating out:
Q: How should organisations govern privileged access to building automation systems?
A: Treat BAS administrators, vendor support accounts and embedded credentials as privileged identities with lifecycle controls, not as one-off facilities exceptions. That means inventorying access, removing standing privilege where possible, and aligning remote administration with the same approval and review discipline used for other high-risk systems.
👉 Read our full editorial: Building automation systems are now an endpoint exposure problem
This post was modified 7 days ago by NHI Mgmt Group