by Lachlan MacQuarrie

Big Vision, Smart Start

Ambition is high in commercial real estate (CRE) when it comes to digital transformation. Whether the goal is better cybersecurity, ESG reporting, energy optimization, or tenant experience, smart building strategies are no longer a “nice to have”—they’re becoming essential for competitive, resilient portfolios.

But here’s the reality: For most organizations, turning that vision into action doesn’t start with a sweeping initiative across 50 properties. It starts with one building and one well-defined problem.

At Intelligent Buildings, we’ve seen this approach unlock clarity, accelerate progress, and reduce risk for leaders across the CRE spectrum—from REITs and private equity firms to enterprise occupiers and asset managers.

If you’re looking to build momentum in your smart building strategy, starting small may be the smartest thing you can do.

Why Start with One Building?

There’s a good reason the pilot approach is so widely used in transformation projects: it’s fast, it’s low-risk, and it creates immediate learning opportunities. For CIOs, CTOs, and operations leaders trying to advance building intelligence, this approach offers multiple advantages:

• Quick Wins: Focusing on a single site lets you target a specific challenge—like unknown OT assets, untracked vendor access, or inefficient HVAC runtime. The result is tangible improvement, often in 30–60 days.
• Clear ROI: When success is measured against one known issue, it’s much easier to calculate return on investment (ROI). You can show leadership how solving one problem in one building creates a model for many.
• Controlled Complexity: Every building has its quirks. Starting with one site lets you build context before scaling. You’ll better understand vendor relationships, system architecture, and policy gaps without getting overwhelmed.
• Data-Driven Storytelling: A single successful pilot generates meaningful data. That data becomes the basis for funding, prioritization, and executive support across your portfolio.

Three Impactful Areas to Start

You don’t need a massive upgrade budget or sweeping scope to get started. Many CRE leaders begin by solving one of these common, high-value challenges:

1. Mapping Unknown OT Systems

Do you know every device connected to your building’s network? For most IT and facilities teams, the honest answer is no.

Operational technology (OT) assets—HVAC controllers, lighting systems, access control devices, fire panels—are often installed by third parties and left unmanaged after deployment. Over time, that creates a security and operational blind spot.

What we typically find in pilot assessments:

• Dozens of devices not in any documented inventory
• Legacy systems still in operation but unsupported
• OT devices with open network ports or default credentials
• Zero central visibility into firmware versions or vulnerabilities

Starting with a single building lets you:

• Build a complete OT asset inventory
• Classify risk levels
• Create a structured process to replicate across other sites

2. Eliminating Uncontrolled Vendor Access

Another popular starting point is cleaning up vendor access. In most smart buildings, third-party vendors control many systems remotely—but few organizations have complete visibility or control over how and when they connect.

Without clear governance, this leads to:

• Shared passwords across multiple contractors
• Virtual private network (VPN) access that’s never turned off
• Zero session logging or change tracking
• No formal onboarding or offboarding of vendor users

By piloting a vendor access control strategy in one building, you can:

• Implement role-based credentials
• Enable secure access with expiration timelines
• Monitor and log sessions for accountability
• Train internal teams and vendors on new policies

That means fewer surprises, fewer cybersecurity gaps, and a much stronger audit position.

3. Reducing HVAC Energy Waste

Energy efficiency is often the most visible—and financially impactful—quick win. Even in high-performing buildings, HVAC systems are often:

• Running longer than needed
• Not optimized for occupancy patterns
• Operating in override mode without alerts
• Using outdated or inefficient control sequences

Through IntelliNet and targeted assessments, we’ve helped CRE clients cut energy costs in pilot buildings, often with no hardware upgrades, just smarter runtime logic and controls oversight. IntelliNet visualizes overrides, sequences, and control anomalies in real time—giving you a clear path to optimization.

What makes HVAC an ideal starting point?

• It affects cost, comfort, and carbon footprint.
• Fixes often don’t require hardware changes.
• The results are measurable in energy spend and system uptime.

Turning One Building into a Roadmap

Once you’ve tackled a pilot site, the next question is: How do we scale this success? That’s where a roadmap becomes essential. Build scalability into the first pilot by establishing success metrics that define what must be true to proceed with other buildings. Piloting one building aids in proving concepts, but to accelerate value for your portfolio, document your intentions upfront. This approach simplifies moving forward and unlocking scaled value.

At Intelligent Buildings, we help our clients develop scalable digital strategies by capturing learnings from pilots and translating them into enterprise playbooks. This often includes:

• Standardized OT assessment templates
• Portfolio-wide OT risk scoring
• Vendor access policy rollouts
• Energy optimization frameworks
• Governance structures across IT, facilities, and operations

By starting with one building, you don’t just prove the concept—you build the foundation for sustainable transformation.

Intelligent Buildings is a sophisticated, outcome-driven partner that helps well-aligned organizations turn pilot initiatives into guidance and managed services that scale and enable portfolio success. Our role in pilot engagements is to enhance clarity, structure, and cross-functional alignment—ensuring that even a single-building test delivers measurable results that can validate a strong existing vision or help shape a more compelling one. Whether you’re refining strategy or building momentum, IB brings deep experience and practical execution to help pilot programs scale with confidence and credibility.

Final Thought: Progress Starts with a First Step

The path to smarter, safer, and more efficient buildings doesn’t require a massive launch or a complete platform overhaul. It just requires a clear focus, a small win, and a plan to grow. Success in commercial real estate today benefits from intentionality.

Start with one building. One issue. One opportunity.

The results may exceed expectations—and build the business case you’ve been waiting for.

Okay… Your control system was installed a couple of years ago and you were handed riser diagrams, As-Builts, mechanical drawings, etc. and you were good to go.  Right?

Maybe…

Up until recently the standard implementation for a controls network was created by the integrator and given either a 192.168.X.X or 10.0.X.X IP schema.  In some cases the only way to access the system was from a PC on the same network.  In other cases the control network did not touch the corporate network, but it was accessible remotely.  This was done by purchasing a router/VPN from a big box electronic store and your ISP (internet service provider) supplied you with a public IP to access your front-end from anywhere in the world.

But is that still the way it is setup?

If it is, it is the right way?  Or it may have been set up correctly, but because of zero change management and oversight, your control network and corporate network have converged or holes have been punched in your security.

The following examples are possible representations of what a control network may look like or maybe what is has become after a few years of “a change here” and “a change there”.  It is important that you know your control system network configuration and keep your documentation up-to-date.

Example 1 – The control network was originally air gapped (physically separated from the corporate network) and the only access was via a public IP to front end.  The public IP put the control system in jeopardy by itself.  At some point in time a second network card was added to the front-end and connected directly to the corporate network.  By doing this there is now a hole punched into the corporate network and it can be used as a pivot point to access company systems.

‍Example 2 – The control network and corporate network are air gapped.  There is no physical connection between the two. However, the control system is exposed to the world with a public IP.  The leaves the control system vulnerable to have infected payloads ready and waiting for anyone who accesses the system.

Example 3 – Everything in this example is behind the corporate firewall and is seemingly safe.  It has been my experience in some cases that the control system front-end is highly accessible and is used to check email, social media, etc.  This practice can either cause the front-end crash or a means for a threat actor to inject malware for data mining, command & control, etc.

For more examples and diagrams, click here.

‍If you haven’t reviewed your control system network architecture in a while, I suggest you do.  If you don’t have change management in place, you need to.  If you have any segment of your control network exposed to the world, work with IT and get it behind a high quality firewall.

The BlackHats are looking and probing and they have plenty of tools available to them to find you.  Let’s not make it too easy for them.

By Fred Gordy 

Building automation systems have historically been installed with convenience in mind. Isn’t that why facility managers started using a browser instead of having to install a specific application on all the PCs that needed to access the BAS? Lower cost, greater portability, and ease of access.

Web access remotely was the next logical step for both the facility manager and the supporting vendors. Facility managers could check their systems through a web browser, and vendor cost could be reduced because they could access the system remotely through a browser and pre-diagnose or fix the issue before rolling trucks.

In the early days, IT really didn’t have or want to have anything to do with these systems, so BAS vendors took on the responsibility of running cable, installing unmanaged switches, and setting up remote access. Remote access was often accomplished either by using a public IP (a public IP is a globally unique address that can be accessed over the Internet) or forwarding a public IP to a private IP through a standard, internet service provider (ISP) router.

Public IPs were used in personal computers that ran the web service/application that enabled facility managers to view and interact with the BAS remotely. The vendor could also view, control, and reprogram the application through the public IP. Because the vendor could also program remotely, public IPs were extended to devices to facilitate programming. As a result the system was totally exposed.

At the time, being exposed was okay to both the end user and the vendor because no one was actively seeking out these systems. That’s all changed. Devices are now in the hacker’s crosshairs.

Why has this changed? The simple answer is that devices offer the path of least resistance. Hackers may or may not be looking to compromise or destroy equipment. They may be looking for another way into the company network, and they know that control networks have little or no security and that these networks are not typically monitored for threats or intrusions.

How do hackers find your BAS? 

Up until 2009, search engines were not specifically looking for Internet-connected devices. In 2009, Shodan was launched. It was the first search engine dedicated to searching for Internet-connected devices, also known as the IoT (Internet of Things). The intent was to catalog the number of devices (not websites) active on the Internet. Users could search free of charge for specific devices from specific manufacturers.

A byproduct of indexing Internet-connected devices was that now the bad guys could use this tool to find devices and probe for vulnerabilities.

In 2015, Censys was created at the University of Michigan and made available to the public for free. Censys, like Shodan, crawls the Web in search of Internet-connected devices. And like Shodan, both security researchers and hackers can use it.

Censys and Shodan both index and add tags to the devices. Why tags? It makes searching easier. You don’t have to know a query language, just know the tags. If you wanted to find all the building control system devices in the world that Censys has indexed, you would enter “building control” in the search box and in less than a second you would have a list. You could do the same for any of the tags shown. The large list of tags makes searching for devices easy to do and easy to refine.

Censys provides a lot of useful information for both good guys and bad guys, including the system version, the host ID/license, the host name, and the name of the building where the device resides. It also lists the geographic location of the device, manufacturer, OS version, ISP, etc.

After a device has been found, several software applications make compromising a device relatively easy. For example, if a hacker can find a BBMD (BACnet broadcast management device), they can have full command and control without having to crack the username and password. And the tool to do this is free. Anyone can download it from SourceForge.net.

What could happen?

When the first concerns about cyber security for control systems were raised, some in the field would ask, “So what if someone turns off the lights?” Today, there is widespread understanding that hackers can cause life safety issues, financial loss, and brand damage to companies.

Let’s unpack of few of these incidents. Most of them could have been prevented.

When the subject of cyber security for control systems comes up, the obvious thing that people think of first is loss or damage to equipment. If a generator were to be attacked and destroyed there is a cost of replacing the generator. (Here’s a Department of Homeland video of a staged generator attack.) But who would think that a printer connected to a parking system could cost a company six figures? One organization had an exposed printer and someone printed, “There is a bomb in building.” Nothing was damaged, right? Wrong. The high-rise building had to be evacuated, causing work to stop, yet salaries were still being paid. Emergency personnel were dispatched. And brand damage was inevitable and as of yet not quantified.

Another common situation involves the loss of front-end access. In one case, the front-end application was crippled, causing business cessation for 48 hours. Ransomware can also block front-end access. In 2017, there were numerous ransomware attacks on control systems. These caused stoppages in some cases and investigation in others, but for both the financial impact has not been fully realized due to ongoing review. In all the cases just noted, these attacks could have easily been prevented.