Why building technology is hard to run.

Buildings now run on networks, software and connected devices supplied by many vendors. The research below, drawn from government, academic and industry sources, shows why that technology is hard for owners to see, secure and keep running, and what it costs when it isn't.

Figures are cited to their original source and dated. Where a source was commissioned by a vendor, we say so.

13%

of commercial real estate and retail leaders say their building systems are fully integrated.[1]

75%

of organizations have building management devices with known exploited vulnerabilities.[7]

48%

of breaches involved a third party, such as a vendor or supplier.[11]

5–30%

of commercial building energy is wasted by faults in control systems.[17]

The network, cameras, door access, HVAC, elevators and lighting in a typical property are bought, installed and serviced separately. Each vendor is accountable for its own system and nothing else.

In a 2024 Forrester survey commissioned by Johnson Controls, nearly two-thirds of respondents worked with several partners who each handle one type of building system. 56% reported misalignment between those partners, and 65% struggled to get accurate information from them.[2]

The problem isn't new. A 2004 NIST study put the cost of poor interoperability in U.S. capital facilities at $15.8 billion a year, most of it landing on owners during operations and maintenance.[3]

65%

struggle to get accurate information from the partners who run their building systems.[2]

62%

report lower operating efficiency because building data isn't integrated.[1]

$15.8B

a year lost to poor interoperability across U.S. capital facilities, two-thirds borne by owners and operators.[3]

A building lasts for decades. The controllers, switches and software inside it are supported for a fraction of that, and they are rarely replaced on schedule.

Most commercial buildings in the U.S. predate the networks now running through them.[4] The protocols those buildings depend on were designed for closed systems. Researchers reviewing BACnet in 2017 noted that security was not a priority when it was designed.[5] Secure communication was only added to the standard in 2019, with BACnet Secure Connect, and older equipment doesn't support it.[6]

46%

of U.S. commercial buildings were built before 1980; 75% before 2000.[4]

2019

the year BACnet, the main building automation protocol, gained built-in encryption and authentication.[6]

Building systems were connected to networks for convenience: remote monitoring, vendor support, energy reporting. Many were connected without the controls an IT team would apply to a server.

Claroty's 2025 study of more than 467,000 building management systems across 529 organizations found that 69% of organizations had devices with vulnerabilities used in confirmed ransomware attacks.[7] In 2017, researchers counted 16,485 BACnet devices reachable from the public internet.[5]

In 2013, security researchers found that the building management system at Google's Sydney office was running outdated software that exposed its users' credentials.[9] In 2024, researchers showed that more than three million hotel door locks at over 13,000 properties could be opened; eighteen months after disclosure, only about 36% had been updated or replaced.[10]

75%

of organizations have building management devices with known exploited vulnerabilities.[7]

51%

have such devices that are also insecurely connected to the internet.[7]

#3

where building management systems rank among the riskiest operational technology devices. Access control ranks #4.[8]

In most buildings, the vendors who install a system also keep the administrator accounts, the remote access and the documentation. Ownership often can't say who can log in, or shut that access off on its own.

That matters because attackers use the same path. Verizon's 2026 report found third parties involved in 48% of breaches.[11] The 2013 Target breach began with network credentials stolen from a refrigeration and HVAC contractor.[12] Vendors themselves are targets: Johnson Controls reported a 2023 ransomware attack cost it about $27 million.[13]

48%

of breaches in the 2026 Verizon DBIR involved a third party.[11]

$27M

what a 2023 ransomware attack cost building technology vendor Johnson Controls, net of insurance.[13]

How a building's systems are actually wired together often lives in the heads of a few people: a chief engineer, a long-serving vendor technician, the integrator who did the last renovation.

NIST identified poor communication and maintenance of as-built information as a driver of operating costs two decades ago.[3] The people holding that knowledge are leaving. IFMA's 2026 salary report found nearly 40% of facility managers expect to retire within ten years.[14] When they go, or a vendor contract ends, the record goes with them.

~40%

of facility managers expect to retire within the next ten years.[14]

17 wks

the average time it now takes to fill a facility management vacancy.[14]

The costs show up in three places: incidents, outages and the slow waste of systems no one is tuning.

IBM's 2026 report puts the average breach at a record $4.99 million.[15] MGM Resorts told regulators its 2023 cyberattack would cut about $100 million from third-quarter Adjusted Property EBITDAR.[16] Day to day, Lawrence Berkeley National Laboratory estimates faults and errors in control systems waste 5–30% of commercial building energy,[17] and PNNL found re-tuning existing controls can cut consumption by 10–30%.[18]

$4.99M

the global average cost of a data breach in 2026.[15]

~$100M

the expected hit to MGM Resorts' third-quarter Adjusted Property EBITDAR from its 2023 cyberattack.[16]

10–30%

the energy savings available from re-tuning a building's existing controls.[18]

None of this requires replacing what's in the building. It requires someone accountable to ownership for the whole picture. Four things make the difference.

Know what exists

A current inventory of every system, device and vendor, checked on site rather than taken from paperwork.

Hold your own credentials

Administrator and remote access that ownership can see and revoke without asking a vendor.

Map the dependencies

Which doors, cameras and systems fail when a switch, a circuit or a vendor goes down.

Test recovery

Backups and outage procedures that have been run, not just written down.