Smart buildings face growing cyber threats

Access control around critical infrastructure remains weak.

As buildings across Asia become smarter, they are also becoming more vulnerable.

The rapid rollout of building management systems — software that controls everything from air conditioning to lighting and security — is creating new cyber risks for property owners, even as demand for the technology accelerates.

Analysts warn that without stronger safeguards, real estate assets could become prime targets for hackers.

“A good example is physical vulnerabilities, which allow cybercriminals to access systems and disrupt buildings,” Tommy Crowley, vice president for Asia‑Pacific at WiredScore Ltd., a US‑based certification firm focused on digital connectivity and smart buildings, told Real Estate Asia.

She cited basic lapses such as unsecured telecommunication rooms or passwords written on sticky notes that can expose entire buildings.

In some markets, including India, access control around critical infrastructure remains weak, she pointed out.

Southeast Asia’s market for building management systems is expected to grow 12% annually to $17.64b by 2034, according to Research and Markets Ltd.

That growth reflects the push toward energy efficiency, automation and smarter offices. It is also widening the digital attack surface.

The bigger problem is visibility. Despite mounting pressure on property managers to secure both information and operational technology, many owners don’t know how many connected devices are operating inside their buildings.

“Cyber assessments may expect 30 to 40 devices, but scans can reveal 400,” Crowley said via Zoom, citing vendor connections, legacy systems, and poor decommissioning practices.

The consequences can be severe. In New York, a single phishing attack shut down heating, ventilation, lighting, and CCTV systems in one building for 90 days, she said.

Operational technology often falls through organisational cracks because it’s typically managed by property teams rather than information technology (IT) departments — requiring a cultural shift as well as clearer accountability, Crowley said.

Some markets are further along. Singapore and Hong Kong have emerged as regional leaders in building cyber resilience, according to WiredScore.

Cheo Wei Ming, director of technology at Savills Singapore, said landlords in the city increasingly treat digital resilience as a commercial differentiator.

“The return on investment for cyber resilience must be evaluated less through IT cost savings but more on commercial outcomes,” he said in an emailed reply to questions.

“These investments mitigate business interruption, reputational and insurance risks, whilst strengthening asset liquidity and valuation resilience,” he added.