Building automation systems: what practitioners need to close first

TL;DR: Building automation systems have become a ransomware leverage point because many still use insecure protocols, carry known exploited vulnerabilities and sit outside standard security coverage, according to Armis. The control gap is not visibility alone but shrinking the exposure window before physical operations become the bargaining chip.

Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Your Building is Now an Endpoint: Closing the BAS Exposure Window in 2026”.

By the numbers:

• 73% of organizations operate building automation systems of a type already used in ransomware attacks.
• 73% carry Known Exploited Vulnerabilities in at least one building automation system.
• 91% of building automation systems communicate over insecure protocols.

Key questions

Q: What breaks when building automation systems are connected to enterprise networks without redesigning access controls?

A: The systems inherit hostile-network conditions while still relying on trust assumptions from closed environments.

Q: Why do building automation vulnerabilities create more leverage than ordinary endpoint flaws?

A: Because the target is operational continuity.

Q: What are the signs that BAS risk is being underestimated in a security programme?

A: Common signs include unclear ownership, remote access paths that bypass standard identity controls, legacy protocols that remain trusted by default, and patching processes that assume maintenance windows will always be available.

Practitioner guidance

• Map the full BAS attack surface Identify every building automation asset that is reachable from corporate IT, remote support networks or cloud-connected management layers, then classify it by operational criticality and exposure path.
• Remove standing administrative access Review building system administrator accounts, vendor remote access and hard-coded credentials, then revoke or replace any path that is not tied to a current owner and approval workflow.
• Prioritise compensating controls for unpatchable assets Where a controller or protocol cannot be updated without outage, use segmentation, protocol monitoring and restricted remote access to reduce the exposure window instead of waiting for maintenance cycles.

Bottom line: Building automation systems have become an extortion surface because attackers can disrupt physical operations even when the main clinical or business record stays online.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →