Ask a data-center team for its asset inventory and you will usually get something good: switches, routers, firewalls, servers, hypervisors, storage, the management network, the out-of-band network. It is thorough about everything that moves packets.
Then ask which systems, if compromised, could stop the floor. The list changes shape. Chillers. Computer-room air handlers. The building-management system that sequences them. Switchgear and automatic transfer switches. UPS controllers. Fuel management for the generators. Leak detection. Fire suppression. Badge controllers and door hardware. Cameras and the video management server. Rack-level power distribution with network interfaces. Environmental sensors. Almost none of it appeared in the first list, and most of it is on the network.
Why the inventory stops where it does
The boundary is organizational, not technical. Facilities buys and maintains mechanical and electrical plant. IT buys and maintains compute and network. Each inventories what it owns. The building-management system sits in the seam: purchased by facilities, installed by a controls vendor, connected by IT, and inventoried by nobody as a security-relevant asset.
That would matter less if these systems were still isolated, and thirty years ago many were. Today they are IP-connected by default because remote monitoring is how modern facilities are run. The chiller reports to a supervisor. The supervisor reports to a dashboard. The dashboard is reachable from a workstation, sometimes from the internet, usually by a vendor.
The three paths that actually get used
Vendor remote access. Controls vendors, mechanical contractors, and equipment manufacturers need to reach their systems for diagnostics and firmware. That access is often granted once, during commissioning, and then persists: a jump box, a vendor VPN account, a cellular gateway bolted onto a controller, or a remote-support tool installed on the operator workstation. It is rarely enrolled in the privileged-access program, rarely reviewed when contracts end, and frequently shared among that vendor’s technicians. It is also, from an attacker’s point of view, a credential that leads directly to physical process control.
The operator workstation. The machine that runs the building-management client is usually a general-purpose computer, often on the corporate domain, often with email and a browser, often running an old OS because the controls software requires it. It has the credentials for the controls network. Compromising it does not require touching a single industrial protocol.
Flat networks in the plant space. Controls networks are frequently built by whoever installed the equipment, to a standard that predates the current security team. Mechanical spaces, electrical rooms, and riser closets tend to hold live switch ports that are physically accessible to anyone with facility access: contractors, cleaners, vendors, delivery staff. A network drop in an unmonitored mechanical room is a quiet place to start.
What compromise looks like
An attacker who reaches building controls does not need to be sophisticated to be expensive. Setpoints can be changed. Cooling can be suspended or forced into a mode the room cannot sustain. Alarms can be suppressed so that operators learn about a thermal event from hardware failures rather than from monitoring. Access control can be manipulated to open doors or, just as usefully, to remove the audit trail showing that a door opened.
Note what none of that requires: encrypting a single file, exfiltrating a single record, or triggering anything an endpoint agent would recognize. The event registers as a facilities incident, and the investigation often stays there.
What operators can do about it
The first step is an inventory that crosses the seam. One list of every system that can affect availability, security, or safety of the floor, regardless of which department bought it. This exercise alone routinely surfaces controllers nobody could name an owner for.
The second is treating remote access as the control it is. Every vendor path enumerated, brokered through a monitored jump point rather than a standing tunnel, credentialed individually rather than shared, and reviewed on the same schedule as any administrative access.
The third is segmentation that reflects consequence rather than department. Building controls, access control, and video belong in their own zones with explicit, inspected paths to the enterprise, and no path at all to the internet that is not deliberate. Where operator workstations must exist, they should be treated as tier-one infrastructure: hardened, monitored, and not also used for email.
The fourth is monitoring these systems at all. Most controls estates generate logs that nobody collects. Getting facility and access telemetry into the same place as network telemetry is what allows anyone to notice that a door opened, a setpoint changed, and a vendor account authenticated within the same minute.
The question worth asking
Uptime commitments are underwritten by an assumption: that the systems keeping the room cold, powered, and closed are as defensible as the systems carrying the traffic. In most facilities that assumption has never been tested, because the two halves have never appeared on the same page.
The useful exercise is not another network penetration test. It is asking who could reach the chiller, the switchgear, and the badge controller, by what path, and who would know.