Shifting Paradigms: Cybersecurity in CRE

In 2026, the definition of a "secure building" has fundamentally shifted.

For decades, property managers viewed security through the lens of physical barriers: access control systems, gated garages, security cameras, and roaming guards. But in today’s environment, the most dangerous intruder is often not the one climbing the fence – it is the one quietly entering through an unsecured HVAC controller or a vulnerable building automation network.

Commercial real estate has entered the era of cyber-physical convergence, where a digital breach is no longer just a technology issue. It can quickly become a life-safety, operational, and financial crisis.

The Death of the Air Gap: Why Buildings are Targets

Historically, building systems were isolated from the internet. Mechanical equipment operated on closed networks, and many systems were never designed with cybersecurity in mind.

That isolation – the so-called “air gap” – has largely disappeared.

Modern smart buildings integrate dozens of interconnected systems:

• Building Management Systems (BMS)
• HVAC controls
• Elevators
• Lighting systems
• Access control platforms
• Energy management systems
• Tenant experience applications
• IoT sensors and smart devices

​
This integration drives efficiency, sustainability, and tenant comfort. But it also creates something else: a massive digital attack surface.

The Reality Property Managers Face Today
​
Cyber risks in commercial buildings are no longer theoretical. Several trends are reshaping the threat landscape.

The Lateral Leap: Attackers rarely begin with critical systems. Instead, they exploit lower-security devices – such as smart thermostats, conference-room displays, or digital signage players.

Once inside the network, attackers can move laterally toward more sensitive operational technology.

Physical Ransomware: Cyberattacks no longer stop at stolen data. In extreme cases, attackers can:

• Disable HVAC systems during extreme temperatures
• Lock elevator systems
• Interrupt lighting or energy systems
• These incidents can disrupt building operations and create immediate pressure to pay a digital ransom.

Legacy Protocol Vulnerabilities: Many buildings still rely on older communication protocols such as BACnet or Modbus.

These systems were designed decades ago for reliability and performance—not security. Many transmit data in plaintext, making them vulnerable to modern automated scanning tools and AI-driven cyber reconnaissance.

Real-World Cyber Risks in Commercial Buildings

For asset managers and property managers, these vulnerabilities translate into real operational risks.

Water Treatment System Manipulation: Cooling towers and water treatment systems are increasingly monitored and adjusted remotely. A cyber intruder who gains access could alter chemical balances, potentially causing rapid equipment corrosion – or in extreme scenarios, creating conditions that allow biological hazards such as Legionella to develop.

Access Control System Breaches: Cloud-based access control systems provide convenience and scalability. However, if compromised, attackers could potentially grant themselves unauthorized credentials to sensitive tenant spaces – such as law firm file rooms, research labs, or data centers – without leaving a traditional physical trace.

Energy Demand Manipulation: Smart lighting and HVAC systems can be manipulated to create artificial spikes in electrical demand. In markets where peak demand charges determine a significant portion of annual energy costs, such manipulation could dramatically increase operating expenses for an entire year.

Cybersecurity Is the New Fire Safety

Commercial real estate has long treated fire and life safety systems with rigorous oversight: inspections, redundancy, code compliance, and emergency protocols.

Cybersecurity now requires the same level of discipline. Property managers are increasingly becoming the front line of digital defense.

The Shift in Responsibility

From Maintenance Issue to Security Event

Historically, if a door controller stopped working, the response was simple: call maintenance. Today, if a cloud-connected door lock stops responding, the issue might not be mechanical – it could be a credential-stuffing attack or compromised API connection.

In many organizations, the first call may now go to a Security Operations Center (SOC) rather than a technician.

Vendor Governance: The Weakest Link

Many cyber incidents begin through third-party vendors with remote access to building systems. Property managers must adopt Zero Trust principles when managing contractors and service providers.

Best practices now include:

• No permanent vendor remote access
• Multi-Factor Authentication (MFA) required for all system connections
• “Just-in-Time” access permissions that automatically expire when work is completed
• Continuous logging and monitoring of vendor activity​

The 2026 Cybersecurity Toolkit

Leading commercial real estate organizations are adopting defense-in-depth strategies to protect their assets.

Network Segmentation

Operational technology (OT) networks should never share unrestricted access with tenant networks or guest Wi-Fi. Separating these systems using VLANs and firewalls ensures that a breach in one environment cannot easily spread to critical building systems.
​
AI-Driven Threat Detection

Modern buildings generate millions of data signals every day. Human teams cannot
monitor this volume manually. AI-based monitoring platforms learn the “normal behavior” of building systems. When unusual activity occurs – such as a device sending data to an unfamiliar server – the system can automatically isolate the device before damage occurs.

Cyber Insurance and Lender Requirements

Cybersecurity is now influencing insurance underwriting and financing decisions. Many insurers and lenders increasingly require evidence of cybersecurity controls, risk assessments, and incident response plans before providing favorable terms.

In effect, buildings are now evaluated for “digital resilience” in much the same way
they are evaluated for physical risk.

Real Estate Is Becoming Physical Cloud Infrastructure
​
Commercial buildings are no longer just physical structures – they are digitally
integrated infrastructure platforms.

From energy systems to tenant apps to smart sensors, modern properties operate much
like complex technology ecosystems.

That reality means cybersecurity is no longer simply an IT concern. It is a core competency of modern property management – essential for protecting tenant safety, maintaining operational continuity, and preserving asset value.

---