OT And BMS Convergence: Why Your Building’s Network Is A Security Blind Spot

Operational technology (OT) refers to the hardware and software that monitors and controls physical processes — industrial control systems, SCADA platforms, and the connected devices that manage real-world infrastructure.

Building Management Systems (BMS) sit within the broader OT category — controlling the physical environment of facilities through interconnected sensors, controllers, and management platforms.

Historically, both OT and BMS environments operated in isolation. Industrial systems ran on dedicated networks. Building systems ran on proprietary, closed infrastructure. Neither connected to corporate IT networks or external systems in any meaningful way.

That isolation is gone.

The demand for real-time operational data, remote management capability, cloud-connected analytics, and integrated facility operations has driven widespread connectivity between OT environments, BMS platforms, and corporate IT networks. Systems that were once air-gapped now share network infrastructure, communicate across domain boundaries, and in many cases are accessible from the public internet.

The security controls that once provided passive protection through isolation have been removed — but in most organizations, they have not been replaced with active defenses.

Learn more: IT/OT Convergence: Why Connecting Corporate and Operational Networks Creates New Risks

They Fall Between Organizational Responsibilities

Corporate IT security teams are responsible for servers, endpoints, cloud services, and user accounts. Facilities teams are responsible for building operations and physical infrastructure. Neither group typically claims ownership of BMS cybersecurity — and in the gap between them, building system networks go unmonitored.

This organizational ambiguity is not a failure of either team. It is a structural consequence of technology convergence that has outpaced governance. BMS platforms were facilities equipment when they were deployed — the fact that they are now connected, internet-accessible cyber assets has not always been reflected in how organizational responsibility is assigned.

The result is that building system networks frequently have no security ownership, no monitoring coverage, and no incident response process — despite being directly connected to corporate infrastructure.

Standard Security Tools Cannot See Them

Even where security teams are aware of BMS environments, the tools they use to monitor IT infrastructure are largely ineffective in building system networks.

Endpoint protection platforms cannot run on BMS controllers and field devices. SIEM platforms cannot interpret BACnet, Modbus, or LonWorks traffic. Vulnerability scanners can disrupt or damage sensitive building system devices if deployed without careful validation. Network detection tools built for IT protocols generate noise rather than signal when pointed at OT and BMS network segments.

The monitoring gap in building system networks is not simply a matter of organizational oversight — it is also a tooling gap. The technology required to monitor BMS environments effectively is specialist, protocol-aware, and fundamentally different from the tools that work in IT environments.

They Are Architecturally Complex and Poorly Documented

BMS environments accumulate complexity over time. Buildings are renovated, systems are upgraded, new devices are added, and connectivity requirements change — but the network architecture documentation rarely keeps pace.

The result is that even facilities teams with security awareness frequently cannot provide an accurate picture of what is connected to their building networks, how those networks connect to corporate infrastructure, or what remote access pathways exist for vendors and contractors.

You cannot monitor what you cannot see — and in most BMS environments, achieving basic visibility requires dedicated discovery work before any meaningful security program can be established.

Attackers Exploit What Defenders Cannot See

The absence of monitoring in building system networks is not merely a gap in visibility — it is an operational advantage for attackers.

Threat actors conducting reconnaissance of target organizations actively look for poorly monitored network segments. BMS networks connected to corporate infrastructure but excluded from security monitoring provide exactly what attackers need — a foothold that can be established and maintained without triggering alerts, and a network position that offers visibility into adjacent systems.

An attacker who establishes persistence on a building system network can conduct extended reconnaissance, harvest credentials, and map pathways into corporate IT — all from a network segment where no security monitoring is in place.

Learn more: Lateral Movement in IoT Environments: How Attackers Pivot from IT to OT

Ransomware Operators Have Identified the Gap

Ransomware groups are increasingly aware that building management systems represent an under-defended entry point into organizational networks.

BMS platforms connected to corporate IT provide a pathway for lateral movement into the environments where ransomware is most destructively deployed. And compromised BMS infrastructure provides additional leverage — the threat of disrupting building operations alongside data encryption increases pressure on victims to pay.

The convergence of OT and BMS environments with corporate networks has effectively expanded the ransomware attack surface — without a corresponding expansion in the monitoring and response capability required to defend it.

Critical Systems Operate Without Security Oversight

In many organizations, building systems that have direct life safety implications — fire detection, suppression, evacuation, and environmental control in critical facilities — operate on networks with no cybersecurity monitoring whatsoever.

The consequences of a successful attack on these systems extend beyond operational disruption and financial impact. In healthcare facilities, data centres, and critical national infrastructure sites, compromised building systems can have consequences that are genuinely life-threatening.

The absence of security monitoring in BMS environments is not an acceptable risk posture for organizations that depend on those systems for operational continuity and occupant safety.

Establish Organizational Ownership

The first step is resolving the governance gap. Clear ownership of BMS cybersecurity must be established — defining which team is accountable for security of building system networks, how that accountability interfaces with both IT security and facilities management, and what escalation processes exist for BMS security incidents.

In most organizations, this means extending the scope of the IT security function — or the managed security service responsible for IT monitoring — to explicitly include OT and BMS environments. Joint governance between security and facilities teams, with shared risk ownership and regular review, provides the organizational foundation.

Deploy Specialist Monitoring

Closing the visibility gap in BMS environments requires specialist, protocol-aware monitoring — tools designed to passively observe BMS network traffic, interpret industrial and building automation protocols, and detect anomalous behavior without disrupting operations.

This is not a capability that can be provided by repurposing IT security tools. It requires platforms purpose-built for OT and BMS environments — capable of understanding BACnet, Modbus, KNX, and LonWorks traffic, baselining normal device behavior, and generating meaningful alerts when that behavior deviates.

Integration of BMS monitoring with broader security operations — correlating building system events with IT security telemetry in a unified monitoring platform — provides the cross-domain visibility required to detect attacks that span both environments.

Learn more: What Is IoT Security? A Beginner’s Guide for Businesses

Map and Control Connectivity

Establishing accurate documentation of BMS network architecture — every device, every connection, every remote access pathway — is a prerequisite for effective security. Without this map, monitoring cannot be configured accurately, segmentation cannot be validated, and incident response cannot be scoped correctly.

Once connectivity is documented, network segmentation should be reviewed and enforced — ensuring that BMS environments are isolated from corporate IT with controlled, monitored pathways rather than open or poorly documented connections.

Include BMS in Security Governance and Compliance

BMS cybersecurity should be explicitly addressed in security policies, risk frameworks, audit scope, and compliance programs. The default assumption — that cybersecurity governance applies to IT infrastructure and building systems are out of scope — must be challenged and corrected.

Regulatory frameworks and industry standards increasingly reflect the security risks of connected building systems. Organizations that have not extended their security governance to cover BMS environments face growing compliance exposure alongside the operational and safety risks already described.