Building Automation Systems (BAS) have evolved significantly: what were once isolated control environments are now increasingly connected platforms bringing together HVAC, lighting, access control, energy management and fire and life-safety systems.

This evolution delivers greater efficiency and centralized control, but it also introduces a new cybersecurity challenge.

According to the latest research from Armis (Early Warning Insights for Building Automation Systems), modern Building Automation Systems increasingly sit at the intersection of IT and OT environments.

At the same time, many of the protocols on which these systems rely were originally designed for closed, isolated networks rather than today’s interconnected infrastructures.

An Installed Base That Was Not Designed for Today’s Threat Landscape

The findings highlighted reveal the scale of the challenge:

• 91% of Building Automation Systems communicate using insecure protocols;
• 73% of organizations have Known Exploited Vulnerabilities in at least one BAS;
• 73% of organizations operate types of building automation systems that have already been used in ransomware attacks.

Protocols such as BACnet, KNX, Modbus and LonWorks were designed primarily with reliability and operation in closed environments in mind.

As these environments have become increasingly interconnected, the security assumptions behind those protocols have changed dramatically.

Cyber Risk Can Become Physical Risk

One of the most important aspects of Building Automation security is that a cyberattack may have consequences that extend well beyond data and traditional IT services.

When systems responsible for functions such as access control, environmental management, or other building operations are involved, compromised devices can potentially become both a source of disruption and a pivot point toward more sensitive networks.

This makes BAS security more than an IT security issue. It is increasingly connected with operational resilience and business continuity.

The Vulnerability Management Challenge

Traditional vulnerability management is also facing increasing pressure.

Armis reports that approximately 28% of vulnerabilities are exploited on the same day they are published in the CISA Known Exploited Vulnerabilities catalog.

The research also states that Armis for Early Warning tracks more than 4,200 exploited CVEs that never reach the catalog.

For Building Automation environments, the challenge is particularly significant because equipment cannot always simply be taken offline for remediation. According to the research, this contributes to remediation backlogs growing faster than security teams can address them.

From Periodic Assessment to Continuous Visibility

Protecting these environments therefore requires a broader approach.

The Armis research highlights the importance of treating building automation as a business continuity system with clear ownership, while reducing the exposure window through continuous detection rather than relying exclusively on periodic scanning.

For organizations managing increasingly interconnected IT, OT, IoT, and building automation environments, gaining visibility into assets, vulnerabilities, and emerging threats becomes a fundamental component of a more proactive security strategy.

How IDC Can Help