Nobody Drew the Line: The Quiet Risk Sitting Inside Every Building Management System

Why BMS Vendor Installations Are a Hidden Security Blind Spot for CRE Owners

Installed by default, not by design

Here’s what actually happens when a building management system goes in. A vendor – HVAC, elevator, access control, doesn’t matter which – shows up to install their equipment and connects it to the network the way they always do: whatever’s already there. Unless someone explicitly says “put this on its own segment, isolated from everything else,” it goes straight onto the same network running leasing platforms, financial systems, and tenant data.

This isn’t a shortcut or a corner cut. It’s simply the default behavior of an install with no instructions to the contrary. The vendor isn’t doing anything wrong by their own standard – they were never told there was a line to respect in the first place. That missing line has to come from somewhere – and the only party positioned to draw it is the building’s owner, not the vendor who was never asked to.

How a BMS Network Encroachment Happens Without Anyone Noticing

In property terms, there’s already a word for a structure that crosses a boundary nobody specified: an encroachment. It’s not usually anyone’s fault, in the sense of intent. It’s what happens when a fence goes up before anyone pulled the survey. A BMS installed onto the primary network is the same event, just digital – a system crossing a line that was never drawn.

Why BMS Network Vulnerabilities Persist for Years Without Detection

A fence built two feet over the property line eventually gets discovered – a sale triggers a new survey, a neighbor complains, somebody notices. A network encroachment has no equivalent trigger. The HVAC controller installed on the main network in 2019 is, in all likelihood, still sitting exactly where it was installed. Nobody’s gone back to segment it. Nobody’s reviewed whether the vendor who set it up still needs the access they were given. Nobody’s asked whether the elevator system talking to the same network as the leasing portal is actually fine, or just something nobody’s gotten around to questioning.

That’s the second half of the problem: a holdover. What started as an unremarkable installation default becomes, over years of inattention, a permanent and unexamined condition. The building operates normally. Nothing looks broken. And the boundary that should have existed from day one simply never gets drawn, because there’s no natural moment that forces the question.

Stale Vendor Credentials: The Holdover Risk Nobody Closes Out

The holdover compounds in a specific, predictable way over time. Technicians move on to other jobs. Contracts get renegotiated. Vendors get replaced by competitors who win the next bid. Each of those ordinary business changes should trigger a corresponding change on the network – an old login disabled, a departing tech’s access revoked, a former vendor’s credentials closed out. In practice, it rarely does.

What’s left behind is a system quietly populated with logins tied to people who no longer work on the account, sitting open and unwatched because closing them was never anyone’s job. And because attention naturally follows what’s visible, the systems those logins connect to are often the last in line for security patches – not out of neglect exactly, just because nobody’s looking at them closely enough to notice they’ve fallen behind. A holdover credential and an unpatched system tend to arrive together, and each one makes the other worse.

Why Unsegmented BMS Networks Create Real Business and Security Risk

The instinct is to file this under “IT problem, not my problem” – a technical detail for whoever manages the network to sort out eventually. That instinct is understandable and, in our experience, almost universally wrong for one specific reason: building systems and business systems increasingly live on the same digital footprint, and the failure mode isn’t abstract. That’s not just a cybersecurity concern – it’s a question of operational resilience, and how well a business can absorb and recover from disruptions that originate in systems nobody thought to watch.

The risks aren’t abstract either.

The Target Breach: What a BMS Vendor Access Failure Looks Like in Practice

When an HVAC or access-control system sits unsegmented on the same network as everything else, “who can adjust the thermostat” and “who can reach tenant financial records” can end up being the same answer. That’s not a hypothetical – it’s the exact structural condition behind one of the most-cited breaches in retail history.

The Target breach, now over a decade old, originated through credentials stolen from an HVAC vendor with remote access into Target’s network; once inside, the attacker moved from the building-systems side into the systems handling customer payment data. It’s an old case, but it’s the one that put vendor access on the map as a named category of risk – and the pattern hasn’t gone anywhere since.

Johnson Controls Ransomware Attack: When the Vendor Itself is the Prize

More recently, in September 2023, Johnson Controls – the world’s largest building automation vendor – was hit by a ransomware attack that stole an estimated 27 terabytes of data, including building floor plans, industrial control system designs, and security details for buildings the company serviced, reportedly including U.S. federal facilities.

The company confirmed remediation costs exceeding $27 million. Different mechanism than Target, same underlying lesson: the vendor managing a building’s systems is a high-value target in its own right, and a compromise on their end can expose exactly the kind of building-specific access and design information that makes every property they service more vulnerable.

That exposure doesn’t stay in the IT department – it reaches the balance sheet, which is why the vendor managing a building’s systems has become a concern that financial leadership can no longer delegate entirely to IT.

The vendor wasn’t the target in either case. The vendor was the boundary nobody had drawn. That kind of exposure surfaces at the worst possible moment – not during a quiet operational review, but when a transaction, an audit, or an incident forces the question and the answer is already expensive.

When BMS Security Gaps Surface During Due Diligence and Transactions

As I said above, these security gaps are, increasingly, the kind of thing that surfaces at the worst possible moment: during a lender’s due diligence ahead of a refinance, during a buyer’s technical review before an acquisition, or in the aftermath of an incident when everyone’s asking how it happened and the honest answer turns out to be “nobody ever drew that line.” Establishing cybersecurity guardrails for business leaders is precisely how that line gets drawn before a transaction, audit, or incident forces the question.

What a CRE-literate view of this actually looks like

Most IT and cybersecurity guidance treats vendor system access as a generic problem – monitor it, review it – and most of it works reasonably well, for what it’s built for. It’s written for a business operating inside a building, managing its connections out to the rest of the world: the bank, the EDI partner, the SaaS vendor, anyone reached across a wire the organization deliberately chose to run. Those relationships get treated carefully precisely because they look like what they are – an external connection, established on purpose, with an obvious boundary to define and defend.

BMS Systems Aren’t Vendor Connections – They’re Built Into the Structure

A BMS vendor’s system doesn’t look like that at all. It isn’t a connection reaching out to the building from somewhere else – it’s physically installed inside it, indistinguishable at a glance from anything else running on the same network. Nobody sits down to “establish a connection” with the elevator controller the way they’d set up a banking integration; the vendor just wires it in, and from that point on it’s simply part of the building, not a relationship anyone remembers to review.

That’s the actual reason this category of risk gets missed by frameworks that otherwise handle third-party risk well: those frameworks are built to watch the doors. A BMS install doesn’t come in through a door. It’s poured into the foundation.

That’s the gap a CRE-aware view closes – not a better version of generic vendor-risk guidance, but a recognition that building systems were never going to be caught by guidance written for wired connections, because they were never wired in the way those connections were. They were simply built.

Walking the Digital Boundary Lines of Your Buildings

At ProtectMyIT, that’s the distinction we start from: a building’s systems aren’t a vendor relationship to be managed at arm’s length, they’re part of the structure itself – and the standard toolkit for watching the doors was never going to notice something that came in through the foundation.

If you’ve never had anyone walk the digital boundary lines of your buildings the way a surveyor walks the physical ones, you’re not alone – almost nobody has, yet. It’s worth knowing where those lines actually sit. If you want a glimpse of how we approach mapping your BMS boundary, you can find that here.