Why Cybersecurity Needs Facilities Managers

• Content
• Smart Buildings & Technology
• Why Cybersecurity Needs Facilities Managers

05 November 2026 | Updated 04 November 2026

Terry Keller, Chief Technology Officer at MRI Software, looks at why cybersecurity is increasingly becoming a challenge for facilities managers, rather than something that sits solely with IT teams.

Connected building systems are changing the role of facilities teams in cybersecurity. As Internet of Things (IoT) devices, remote maintenance tools and AI become part of everyday operations, decisions about equipment and contractor access carry security implications.

Cybersecurity still requires specialist expertise, but managing the risks depends on people who understand how the building operates. Facilities teams know which contractors should be connecting, what maintenance has been authorised and whether system data reflects conditions on site. Organisations need to make better use of that knowledge within their security approach, starting with clearer responsibilities between facilities, IT and suppliers.

The Facilities Role In Connected Building Security

As more building equipment connects to an organisation's wider systems, responsibility for its security can become unclear, particularly when purchasing, maintenance and IT operate separately. Software updates, access permissions and supplier support need agreed ownership throughout the equipment’s working life.

Facilities teams bring knowledge that helps organisations manage these risks. They understand normal building operations and can recognise unexplained changes to heating schedules, access controls or camera availability, particularly when no maintenance work has been authorised. Their supplier relationships can help them identify requests that fall outside agreed procedures, including changes to payment details or additional system access.

As generative AI makes fraudulent messages more convincing, these requests should be checked through established contacts. Organisations should give facilities staff a clear route to report concerns without expecting them to diagnose the cause, so IT and security colleagues can investigate with a fuller understanding of what has changed on site.

AI Increases The Importance Of Trusted Data

As AI becomes part of maintenance planning and fault detection, organisations need to consider how the reliability and security of building data could affect operational decisions. Incomplete records, faulty sensors or deliberate interference can affect recommendations, potentially influencing decisions about equipment and essential services.

Facilities managers already understand that a maintenance record cannot always explain how an asset is performing. That judgement becomes increasingly important when AI-generated recommendations influence decisions about equipment and essential services. For example, an AI system might identify an unusual change in equipment performance and recommend maintenance. However, understanding whether that change reflects a genuine fault, an inaccurate sensor reading or potentially suspicious activity requires knowledge of the building and its recent maintenance history.

This has implications for how organisations introduce automation. Teams need to understand which decisions require review and who investigates discrepancies, with staff encouraged to question information that does not reflect their experience of the building. The aim should be to ensure that AI supports informed decisions rather than introducing another source of risk. Where errors could affect safety or service continuity, facilities expertise remains essential to interpreting information and determining the appropriate response.

Making Collaboration An Operational Habit

Closer cooperation between facilities and IT needs to begin before equipment is purchased. Facilities teams understand operational requirements and the consequences of downtime, while IT can assess connectivity, security and support arrangements. Together, they can agree who will manage updates and supplier access throughout the equipment’s life.

A shared inventory of connected assets gives both teams a basis for that work. It should remain current as sites, equipment and contractors change, with clear ownership for maintaining the information.

Contractor access should reflect the work required, using individual accounts and permissions that are removed when no longer needed. Approved remote connections and multi-factor authentication help make those arrangements easier to control.

Building Awareness Into Everyday Work

Training should reflect the decisions facilities teams make, supported by reporting procedures and joint exercises with IT. Staff need to recognise unusual requests, understand when changes to building systems may be suspicious and know how to report concerns.

These exercises should involve the contractors responsible for supporting critical equipment, so teams can check whether contact details, escalation routes and recovery arrangements work in practice. They should leave everyone clear about who can authorise changes, how urgent concerns will be communicated and where responsibility sits during an actual incident.

As buildings become more connected, cybersecurity can no longer be treated solely as an IT concern. Facilities managers do not need to become security specialists, but their understanding of building operations, contractors and essential services needs to inform how risks are managed. Bringing that knowledge into security planning and everyday decisions will be increasingly important to protecting both buildings and the people who rely on them.

Picture: As illustration showing a woman working on a laptop while perched on property management and data analytics software windows, surrounded city buildings and offices.

Article written by Terry Keller | Published 05 November 2026

Share

---

---

Related Articles

---