The signal is clear. As building systems become more connected, facilities leaders are inheriting a new layer of operational risk.

For years, facilities management has been defined by physical performance.

Keep the building safe. Keep systems running. Reduce downtime. Manage vendors. Support the people inside the environment.

That mandate hasn’t changed. However, the infrastructure behind it has.

Building systems that once operated independently now sit on networks, connect to cloud platforms, integrate with identity tools, and rely on remote access for maintenance and support. HVAC controllers, badge access systems, lighting platforms, occupancy sensors, and building management systems are no longer just operational tools. They’re connected systems with real digital exposure.

Additionally, this shift is changing accountability.

Facilities leaders aren’t being asked to become cybersecurity practitioners. They’re not expected to configure firewalls or run incident response. However, they are increasingly responsible for environments that can now be disrupted through cyber means. When those systems fail, the consequences aren’t theoretical. Buildings become inaccessible. Climate control is lost. Operations stop. Safety and continuity are put at risk.

This is the signal more organizations need to recognize.

Cybersecurity isn’t only an IT issue when the systems that keep a facility running are part of the attack surface.

The Signal Behind the Shift

A pattern is emerging across commercial buildings, schools, healthcare environments, and critical infrastructure. The line between physical operations and digital systems is disappearing.

For decades, many building systems were effectively isolated. HVAC, access control, fire panels, and other operational systems ran in their own environments. In many cases, they were separated by design limitations rather than deliberate security strategy. That separation created a degree of protection.

However, that protection is fading.

Modern facilities infrastructure is increasingly IP-enabled, cloud-connected, and remotely managed. These changes create real benefits. Teams gain centralized visibility, predictive maintenance, energy optimization, and better control across multiple sites. Furthermore, they allow organizations to operate more efficiently across distributed environments.

At the same time, connectivity introduces exposure.

Every connected controller, sensor, gateway, and vendor access point becomes part of a broader system that has to be governed, monitored, and secured.

Many of these technologies weren’t built with modern threat conditions in mind. Some rely on outdated firmware. Some still use weak authentication. Others were connected for convenience without a clear security review. Additionally, many sit in a grey zone between IT, operations, and third-party vendors, where accountability is diffuse and visibility is limited.

This isn’t hypothetical. Federal agencies are now actively warning about attacks targeting operational technology environments, including systems used across government services and facilities. Recent guidance in a joint cybersecurity advisory from CISA and federal partners highlights ongoing exploitation of internet-connected control systems designed to cause operational disruption.

This is the deeper issue. The risk isn’t simply that building systems are connected. The risk is that they’re connected without a corresponding shift in how organizations manage and secure them.

What the Incidents Are Telling Us

The warning signs are no longer subtle.

In February 2025, Baltimore City Public Schools disclosed a cyberattack that compromised sensitive employee and student information after attackers gained access to district IT systems in February. The story was covered as a data breach, but the more important lesson is broader. When institutional systems are disrupted, operational continuity is part of the blast radius. That matters for any organization whose building environments now depend on connected infrastructure.

Additionally, the same pattern has been visible in the vendor ecosystem.

In September 2023, Johnson Controls, one of the largest providers of building automation and HVAC systems, experienced a major ransomware attack. The company later disclosed that the incident involved stolen data and more than $27 million in remediation and related costs. That matters not just because Johnson Controls is large, but because providers like this sit deep inside customer environments and operational workflows.

Furthermore, in January 2024, Schneider Electric’s sustainability division was hit by a ransomware attack that affected its EcoStruxure Resource Advisor platform, a system used by thousands of organizations to monitor energy and resource data. That incident reinforced the same point. The exposure is not limited to internal systems. It extends through the platforms and vendors organizations depend on to manage modern environments.

Taken together, these incidents point to something more structural.

They aren’t isolated failures. Instead, they reflect a broader weakness in how operational technology, vendor access, and building systems are deployed and secured. Attackers aren’t just targeting traditional IT assets. They’re looking for environments where controls are weaker, ownership is unclear, and the operational impact is high.

That makes facilities infrastructure an increasingly attractive entry point.

The takeaway is straightforward. When a building system is compromised, the impact isn’t abstract. It can shut down access, impair climate control, interrupt operations, and force facilities teams into response whether they were prepared or not.

Why This Is No Longer Just a Facilities Issue

It’s easy to assume this belongs entirely to IT or security.

IT owns the network. Security owns cyber risk. Vendors manage the systems. In theory, each function covers its domain.

However, in practice, that model breaks down.

Facilities teams often select the vendors, manage contracts, oversee deployments, and understand which systems are critical to daily operations. They know what’s been upgraded, what remains legacy, what has remote access enabled, and what would happen if a system failed during business hours.

That operational context is essential.

If an access control system fails, facilities manages the physical consequences. If a building automation system goes offline, facilities manages continuity. If a connected environmental system is compromised, facilities is immediately part of the response.

This isn’t about shifting cybersecurity ownership. It’s about recognizing an expansion of stakeholder responsibility.

This is where the issue shifts from a facilities concern to an operational and governance concern that IT and business leadership can’t ignore.

Facilities leaders now sit closer to cyber-exposed operational systems than most organizations have accounted for. They don’t need to own every control. However, they do need visibility, alignment, and a defined role in how risk is managed.

The System Failure Most Organizations Are Missing

The core issue isn’t just technology. It’s coordination.

In many organizations, risk sits across three overlapping systems:

  • The vendor system. Third-party vendors install, maintain, and access building technologies. They often control credentials, updates, and support processes.
  • The IT and security system. IT and security teams manage networks, monitoring, identity, and response. However, they may lack visibility into operational technology or vendor-managed environments.
  • The facilities operations system. Facilities teams understand system criticality and operational dependencies. However, they may not have visibility into security controls or exposure.

When these systems aren’t aligned, risk accumulates in the gaps.

This is where most organizations get exposed. Not because a single team failed, but because no one established a unified operating model across connected infrastructure.

The Blind Spots That Create Exposure

Several patterns show up consistently.

  • Vendor-managed access with limited oversight. Many systems rely on third-party access for support. However, organizations often lack clear visibility into how that access is controlled, how often it’s reviewed, or how quickly it can be revoked.
  • Legacy systems connected to modern networks. Older systems were built for reliability, not security. Once connected, they become persistent exposure points.
  • Uninventoried devices. Sensors and controllers are often added incrementally. Over time, this creates a layer of operational technology that isn’t fully tracked or secured.
  • Unclear ownership. IT assumes facilities owns it. Facilities assumes IT owns security. Vendors assume their role is limited. As a result, no one sees the full picture.

These issues aren’t usually the result of negligence. They’re the result of infrastructure evolving faster than governance.

What This Looks Like in Practice

Recognizing the risk is the first step. Operationalizing it is where most organizations fall short.

In environments where this is handled well, the shift shows up in how teams actually operate.

1. Build a shared inventory of connected operational systems

This shouldn’t live only in a facilities spreadsheet or inside an IT asset register. It should become a unified view of connected building systems across the organization.

That includes systems such as:

  • building management platforms
  • access control systems
  • environmental monitoring tools
  • vendor-connected devices
  • any other networked infrastructure that can affect operations

If it has an IP address and can disrupt the environment, it belongs in scope.

2. Define ownership at the system level

Most gaps exist because ownership is assumed rather than assigned.

For each critical system, leadership should be able to answer:

  • Who owns uptime and operations?
  • Who owns security controls?
  • Who owns vendor access?
  • Who owns incident response?

In many cases, those answers will be shared. However, they still need to be explicit.

3. Treat vendor access as a managed risk

Remote access is often one of the easiest paths into these environments. Yet it’s still commonly treated as a convenience rather than a control point.

A stronger model usually includes:

  • time-bound access where possible
  • defined authentication requirements
  • visibility into who connected and when
  • clear offboarding when vendors, contracts, or support arrangements change

For many organizations, this is one of the fastest ways to reduce exposure without launching a large transformation project.

4. Segment based on operational impact

Not every system deserves the same level of control.

However, systems tied to:

  • safety
  • access
  • climate control
  • critical business workflows

shouldn't be treated casually or left on lightly governed environments.

The right question isn’t simply whether a device is connected. It’s what happens if that device fails, is manipulated, or becomes unavailable during a critical moment.

5. Establish a coordinated response model

When a building system is impacted, the issue rarely stays within one function.

IT sees a network issue. Facilities sees an operational disruption. Security sees an incident. Operations sees business continuity risk.

Without a shared response path, time is lost and accountability gets blurred.

Teams should know in advance:

  • how these events escalate
  • who joins the response
  • what matters most in the first hour
  • which systems take priority for containment and continuity

6. Make this part of the operating rhythm

This shouldn’t be a one-time conversation or a static review.

Organizations that handle this well revisit these issues as part of:

  • vendor reviews
  • infrastructure changes
  • risk discussions
  • resilience planning
  • operational governance

That is the real shift. Connected building infrastructure now requires a shared operating model across facilities, IT, security, and operations.

A Practical Starting Point for Leadership Teams

For most organizations, the goal isn’t to launch a massive facilities cyber initiative. It’s to close the most obvious coordination gaps before they become operational failures.

A practical starting point looks like this:

  • Identify the systems that would create the most disruption if they failed tomorrow.
  • Bring facilities, IT, security, operations, and vendor stakeholders into the same conversation.
  • Clarify ownership, especially where responsibilities are currently assumed.
  • Review vendor access and remote support pathways.
  • Prioritize the systems that need stronger segmentation, visibility, or response planning.

This is where progress usually starts. Not with abstract policy, but with clearer ownership and more disciplined operating assumptions around the systems the business already depends on.

Why This Matters Beyond IT

This shift extends beyond technology.

As connected infrastructure expands, the issue moves into business continuity, vendor governance, resilience, insurance, compliance posture, and executive accountability.

In practical terms, this is moving from a technical concern to a governance issue.

Organizations that recognize this early will be better positioned to manage risk and maintain operational continuity. Those that don’t may only recognize the exposure once something fails.

Where a Trusted Advisor Helps

Most organizations don’t have a single internal owner for this layer of risk. The challenge sits between infrastructure, operations, security, vendor management, and resilience planning. That is exactly why it gets missed.

This is often where an outside perspective creates leverage.

At The Deady Group, we help organizations make sense of infrastructure complexity, identify where accountability is fragmented, and connect leadership teams with the right technology, service, and advisory partners to close the gap. That can mean pressure-testing the current operating model, evaluating areas of exposure, or helping leaders think more clearly about what should be addressed first.

The value isn’t in adding more noise. It’s in creating clarity, aligning the right stakeholders, and helping organizations move from awareness to action.

Closing Thought

Facilities leadership has always been about keeping environments functional, safe, and dependable.

That hasn’t changed. However, the systems behind that responsibility have.

A building can appear operational while still being digitally exposed. In a connected environment, that exposure can quickly become an operational problem.

Facilities teams didn’t set out to become cybersecurity stakeholders. However, the convergence of physical and digital infrastructure has made that role unavoidable.

The question isn’t whether building systems belong in the security conversation.

It’s whether your organization is ready to treat them that way.

Send me a DM or start a conversation here. For more field perspectives on readiness, modernization, and operational clarity, see Insights.

This issue also ran on LinkedIn, where you can follow Signals & Systems.