You Can’t Protect What You Can’t See: Using Analytics for OT Cybersecurity

There was a time when cybersecurity in commercial buildings fell almost exclusively under the purview of the IT department. Not anymore. Today's building automation systems (BAS) are made up of interconnected operational technology (OT): HVAC equipment, lighting, access control, energy management, meters, sensors, controllers, devices, network equipment, servers, and cloud platforms, all working together to keep buildings performing.

While every connection makes the building smarter, they also make building operations more vulnerable to cyberthreats. That means each point must be monitored, maintained, and secured. It's no easy task.

The problem is prevalent. A recent study showed that 75% of organizations with building management systems (BMS) were impacted by known exploited vulnerabilities.¹ After analyzing over 125,000 OT assets, Claroty found that 13% were insecurely connected to the internet, and 36% of those contained at least one confirmed vulnerability that had been exploited.²

Cybersecurity Is Now a Facilities Issue

A controller running on outdated firmware, a supervisor with an unneeded open port, a device that has dropped offline, an unfamiliar system connecting to the building network: at first, these may just seem like routine technical issues. On closer inspection, these problems could indicate a weakness in the configuration, a failed piece of equipment, unauthorized access, or an early warning of a cybersecurity event.

Increasingly, the burden of securing these interconnected building systems and OT falls on the facilities department. This makes sense. After all, facilities managers are responsible for systems that directly affect the safety, comfort, productivity, and operations of commercial buildings. With connected BAS, facilities are now also responsible for protecting these systems from malicious attacks, intrusions, and activities.

Building Analytics: A Powerful Cybersecurity Tool

The reality is you can't protect what you can't see. In a recent survey of incident response cases involving exploited OT, 88% of organizations struggled with detection, 94% struggled with containment, 82% struggled with responding, and 82% lacked clear criteria for triggering a cybersecurity investigation.³ These challenges can be directly linked to a lack of visibility, incomplete asset inventories, and insufficient context.

That's where building analytics come in. More than identifying an inefficient chiller or wasted energy from simultaneous heating and cooling, building analytics offer a powerful tool for increased cybersecurity and infrastructure resilience. Analytics for connected systems help facilities address the growing issue of known exploited vulnerabilities by reporting the firmware of downstream devices and feeding it into auditing reports for compliance and update purposes.

Analytics give you the visibility you need to understand and verify the health of the network, systems, supervisors, devices, and controllers that are critical to building operations and vulnerable to cyberthreats. This visibility allows you to see unusual activity, performance anomalies, weak points, or potential red flags that can help you find and correct vulnerabilities before they're exploited and operations are disrupted.

With access to analytics, disconnected operational data turns into a clear picture of baseline operations, showing you what has changed and what needs your attention.

How Healthy Is Your Building Network?

Chances are, your facilities team already routinely monitors temperatures, pressures, runtimes, alarms, energy use, and equipment performance of your building systems. This same approach to tracking the health of your building's infrastructure can be applied to cybersecurity.

With the ability to compare current status to the baseline, you can identify any deviations from normal operations that may indicate a potential risk. For instance, an air-handling unit that suddenly starts communicating more frequently than normal may be the result of a network issue, or it may be a sign of an attempted unauthorized access. Similarly, a device or network segment experiencing increased latency can be an indicator of more than just slow communication.

Analytics can help you flag the questionable behavior or activity for further investigation before the threat spreads. By revealing what happened, when it started, which systems were affected, and what action to take, analytics help you respond faster to staunch the problem before it gets out of hand.

Building analytics can be a powerful tool in your cybersecurity arsenal in a number of ways.

Early Identification

Many cyber risks start as visibility or maintenance gaps that can be easily addressed if identified early. Analytics help reveal vulnerabilities by continuously evaluating asset status, communication patterns, configuration changes, and system performance.

Accurate Device Inventory

Analytics can help you identify devices that suddenly show up on the network, devices that have changed addresses, or equipment communicating in ways they aren't meant to. This may be an indication that new devices have been introduced to the building network and should be investigated.

Outdated Software and Firmware

You can use analytics to help identify controllers and supervisors running older firmware, systems that are approaching end of life and support, devices that are missing security updates, equipment with configuration weaknesses, and assets that should probably be isolated, upgraded, replaced, or closely monitored.

Configuration Drift

Systems that gradually move away from their approved or intended state may represent a risk. Analytics let you compare current conditions against norms and flag any deviations that may open your systems to vulnerabilities.

Questionable Behavior

Analytics can also be used to detect behavior that doesn't fit established patterns, such as repeated unsuccessful login attempts; logins at unusual times from unfamiliar locations; sudden changes in user permissions, schedules, setpoints, alarms, or control logic; unusual communication between devices; an uptick in controller or supervisor traffic; large data transfers; and other red flags that should be looked into.

Compensating for Legacy Systems

Analytics can be especially useful as a cybersecurity tool in buildings that rely on legacy controls and systems. Designed before today's connected and threat-exposed environment, these older systems can't be easily patched, upgraded, authenticated, or taken offline for security work. Legacy systems come with added vulnerabilities, such as weak or shared credentials, limited audit trails, outdated communication protocols, devices that don't support encryption and multifactor authentication, undocumented network connections, and unsecured leftover remote access privileges.

Analytics help by providing compensating visibility; in other words, showing you an inventory of your legacy assets, identifying which of these assets are most exposed to threats, and alerting you to any suspicious or out-of-the-norm activities. This visibility allows you to prioritize risk, speed up investigation and response, and contain problems without compromising uptime, as well as develop a plan to upgrade your most at-risk devices and systems.

It's important to understand that analytics aren't a substitute for modernizing older systems, equipment, and devices. But they do provide a practical way to manage risk as you transition to more modern BAS.

Enhanced Facilities/IT Collaboration

Even as facilities departments increasingly assume the burden of cybersecurity for OT, they still need to work with their IT counterparts. Facilities understand the systems and equipment. IT understands the enterprise network and security policies. Analytics can help bridge the two departments.

With access to shared dashboards, alerts, asset inventories, and reporting, facilities and IT teams can work from the same information. This facilitates a coordinated response to any potential threat, as well as coordinated prevention and recovery plans.

Together, facilities and IT teams can determine how best to segment OT systems and business IT; which remote-access policies to enact for vendors and service providers; user account management and multifactor authentication strategies; backup and recovery planning; patch and firmware management; incident response procedures; and more.

The goal isn't to force facilities staff to become cybersecurity specialists, but to ensure they have the information they need to recognize risks and work with IT to protect critical business operations.

Getting Started with Analytics for Cybersecurity

Many facilities departments already use building analytics to monitor the health of their building networks and systems. So how do you go about leveraging analytics as a cybersecurity tool as well? Here's a practical guide to getting started.

1. Inventory your connected assets. Identify every networked system, controller, supervisor, gateway, server, workstation, and remote-access point associated with your building controls environment.

2. Assess device and system health. Track online status, communications, alarms, firmware/software versions, backup status, and other indicators of operational reliability.

3. Document a baseline. Establish expected communication patterns, operating schedules, user access patterns, and configuration settings so you can easily detect variances.

4. Prioritize vulnerabilities. Focus on any unsupported systems, unapproved access points, weak credentials, outdated firmware, and systems critical to operations.

5. Set up alerts. Make sure you configure alerts for high-priority events such as failed logins, unauthorized configuration changes, sudden device connections, and unusual communication activity.

6. Plan for escalation. When you do notice an issue that needs to be investigated, define an escalation process for who to notify, what information to collect and share, and how facilities, IT, and outside service providers will coordinate efforts.

7. Continually review. As building systems change, so do cybersecurity requirements. Regularly review your device inventories, access privileges, network diagrams, and response plans to make sure they're up to date. Automate the process of refreshing your inventory and updating your baseline so you're not relying on less reliable manual methods.

Finding the Right Cybersecurity Partner

Configuring building analytics for cybersecurity efforts can be a complex undertaking, one that requires accurate asset inventories, secure connections across disparate systems, clean and properly contextualized data, and alert protocols that can tell a real security concern from a normal operational variation. That's a big ask for facilities departments that have a wide scope of responsibilities and limited resources to tackle them.

Bringing in an outside partner can help you manage the complexity of translating building data into usable cybersecurity insight. Make sure that partner brings the right mix of expertise in building controls and analytics, and understands how to identify, prioritize, reduce, and respond to risks in today's connected commercial buildings.

Strengthening cybersecurity doesn't happen overnight, with a single process or one-time assessment. Rather, it's an ongoing endeavor that involves understanding your building's assets, continually monitoring conditions, finding and shoring up weaknesses, and being ready to respond. It takes time, but it's a critical part of your building and operational resiliency.

If you're looking for guidance in managing your cybersecurity responsibilities, reach out to Albireo Energy today.

Authored with contributions from Rudy Bohince, Director of Managed Services Center, and Michael Melillo, Solutions Architect

Sources
1. "75% of Organizations' Building Systems Affected by Exploited Vulnerabilities." Security Magazine. July 16, 2025.
2. "What to Look for in a Cyber-Physical Systems Security Provider." Claroty. November 14, 2025.
3. "OT Cybersecurity Lessons Learned from the Frontlines." Dragos. May 7, 2026.