Advanced threats, intelligent buildings: 7 best practices facility leaders can implement to reduce cybersecurity risk

As building systems become more connected, cybersecurity is becoming an operational priority. This article outlines what facility leaders need to know to help reduce risk and strengthen resilience.

For many organizations, building automation systems have evolved from stand-alone operational tools into connected platforms that support comfort, energy performance, occupant experiences and day-to-day business operations. This connectivity and digital transformation can deliver significant benefits but it also expands the potential attack surface. Cyber threats continue to evolve and advances in artificial intelligence are helping threat actors to identify and exploit vulnerabilities faster than ever before.

The result is a growing need for organizations to view building cybersecurity as part of their broader risk management strategy. Understanding where vulnerabilities may exist is an important first step toward strengthening resilience. This first step applies to all circumstances, whether it’s in relation to a commercial office, healthcare facility, educational campus or industrial site.

What’s driving the increase in BAS cybersecurity risk?

Three trends are reshaping the cybersecurity landscape for building automation systems:

• More connected buildings and remote access capabilities
• Greater integration between building systems and enterprise IT networks
• Attackers increased use of AI-powered tools to identify and exploit vulnerabilities

In 2026, Johnson Controls commissioned a landmark study to evaluate the state of building technology and operations. This study focused on the goals and challenges facing building and facility leaders. This latest study is the largest of its kind. Drawing from 5 years of trendline data and insights, the study captures perspectives from 2,019 leaders that are responsible for building systems and operations across more than 2,000 organizations. Respondents included both end-user organizations and supply-side providers across multiple industries including data centers, healthcare, advanced manufacturing, life sciences and pharmaceuticals, university campuses and airports.

We found that leaders consider “accelerating digital transformation” one of the top 3 business priorities over the next 12 months, ranking directly behind profitability and revenue growth. Together, these trends and concerns are changing how organizations think about connected building risks. Proactive cybersecurity planning is now more important than ever.

Internal expertise and the skills gap

As organizations scale AI, longstanding barriers around cost and internal expertise persist. At the same time, cybersecurity and data privacy have emerged as the leading concerns around AI implementation.

The intensity varies by industry:

• Cybersecurity concerns are highest in industrial manufacturing and universities
• Implementation costs are most pronounced among airports
• Skill gaps and difficulty proving ROI are chief concerns amongst industrial manufacturers and life sciences

The overall pattern is remarkably consistent across audiences. Cybersecurity risks, data privacy concerns, implementation costs and skills gaps rank among the leading concerns for both end users and supply-side providers. The differences are primarily matters of emphasis rather than fundamentally different priorities.

Cybersecurity and data privacy are top concerns, with nuances by industry

The same concerns are reflected across mission-critical industries. Cybersecurity and data privacy consistently rank at the top of the list, though the level of intensity varies. Industrial manufacturing, universities, data centers and commercial real estate (CRE) demonstrate the most concern around cybersecurity and data privacy. This is consistent with the nature of the data they protect. Each sector handles information that is proprietary, sensitive or critical to downstream operations. This raises the stakes in the event of a breach.

The picture shifts when it comes to high implementation or maintenance costs. Here, healthcare, airports and industrial manufacturing come out on top. This is consistent with the operational complexity of each sector.

• Airports: Implementation must happen across multi-system environments without disrupting operations
• Healthcare: To ensure effective implementation and deliver returns, aging infrastructure must be upgraded for AI
• Industrial Manufacturing: Due to a zero-downtime standard, reliability must be proven before anything scales

An outlier worth noting – Life Sciences – is particularly concerned with the lack of internal skills or expertise. This is consistent with the highly specialized nature of lab environments, where AI deployment must meet strict compliance requirements, and finding talent with both AI and industry expertise can be difficult.

7 best practices that facility leaders can implement to reduce cybersecurity risk

With data privacy and cybersecurity a top concern across industries, facility teams should regularly evaluate seven areas to strengthen BAS resilience and performance:

1. Technology lifecycle and software currency
Regularly evaluate the health and support status of building systems – including software versions, patch levels and long-term modernization plans – to help maintain security, reliability and performance.

2. Remote access security practices
Review how remote access is enabled across building systems and ensure that secure connectivity methods, governance policies and cybersecurity best practices are consistently applied.

3. Identity and access management
Assess user access privileges, authentication methods and credential management practices. Consider role-based access controls, single sign-on and multi-factor authentication to strengthen security and simplify administration

4. Cyberhealth visibility and monitoring
Establish ongoing monitoring practices that provide actionable insights into system health, security posture and potential areas for improvement across the building environment. For example, a healthcare organization managing multiple facilities across a campus can benefit from centralized cyberhealth visibility. This helps teams prioritize maintenance activities, identify unsupported devices and maintain more consistent security posture across sites.

5. Alignment with cybersecurity standards and compliance requirements
Periodically evaluate cybersecurity programs against recognized industry standards, regulatory requirements and organizational policies to support ongoing compliance and operational resilience.

6. Readiness for an evolving threat landscape
Review cybersecurity strategies regularly to address emerging threats and technologies. Maintaining strong cybersecurity fundamentals, current software versions and proactive security practices helps organizations stay prepared as the threat landscape evolves.

7. Modernization and upgrade planning
Evaluate opportunities to modernize building systems through phased upgrades that reduce operational disruption while improving cybersecurity, efficiency and long-term system performance.

What does a cyber-resilient facility look like?

While every facility has unique requirements, organizations with the strongest cybersecurity posture often share several characteristics:

• Building systems are actively maintained and regularly updated
• Remote access is tightly controlled and monitored
• Users are granted only the level of access necessary for their roles
• Security events and vulnerabilities are continuously monitored
• Cybersecurity practices align with corporate IT policies and recognized industry standards
• Modernization plans account for both operational performance and cyber resilience

Airports: Managing the magnitude of motion

For aviation hubs, performance means balancing operational variability with continuous delivery. Airport leaders look for a comprehensive view of their infrastructure, citing a holistic view of the facility as their most valued AI capability (61%). The need for consistent oversight is reinforced by their top three AI applications – monitoring (76%), cybersecurity (76%) and physical safety (73%).

Rather than treating cybersecurity as a one-time project, these organizations view it as an ongoing process of assessment, improvement and collaboration between facilities and IT teams.

Building resilience starts with a proactive approach

Cybersecurity is no longer solely an IT responsibility. As building systems become increasingly connected, facility leaders, IT teams and business stakeholders all have a role to play in managing risk. Organizations that invest in modernization, visibility and secure-by-design technologies today will be better positioned to maintain operational continuity, support compliance objectives and adapt to emerging threats tomorrow.

Modernization does not have to be disruptive. New tools and automated readiness assessments can help reduce upgrade complexity and – in some cases – shorten deployment timelines by approximately 40%. This enables organizations to address cybersecurity gaps more efficiently.

Solutions such as Metasys 16.0 support these efforts through capabilities such as secure communications, identity management integrations, cybersecurity monitoring tools and alignment with recognized cybersecurity standards. Taking a proactive approach now can help reduce risk while creating a stronger foundation for long-term building performance and resilience.

Ready to get started?

Assess your current environment, review your modernization plans and speak with our building technology experts about opportunities to strengthen security, resilience and long-term facility performance.