By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

For decades, building automation enjoyed a form of accidental security.

Not because it was designed to resist cyber attacks.

But because very few attackers understood how it actually worked.

Compromising a Building Management System required specialist knowledge. An attacker needed to understand industrial communication protocols, proprietary controllers, vendor-specific engineering tools and decades-old automation concepts that rarely appeared in mainstream cybersecurity training.

That natural barrier is disappearing.

Artificial intelligence is fundamentally changing the economics of attacking operational technology. Large language models do not replace expertise entirely—but they dramatically reduce the amount of expertise required to begin.

For CISOs responsible for modern enterprises, this is more than another AI story.

It is the beginning of a new threat landscape for every connected building.

Security Through Obscurity Is Finally Over

Many building automation environments still rely on protocols that were never designed with cybersecurity in mind.

BACnet.

KNX.

Modbus.

DALI.

LonWorks.

OPC.

Historically, these technologies remained relatively isolated from mainstream attackers because learning them required years of practical experience.

Finding protocol documentation was difficult.

Understanding packet structures was harder.

Developing exploits demanded highly specialized engineering knowledge.

Consequently, attacks against building automation were relatively rare compared with attacks against Windows, Active Directory or cloud platforms.

Artificial intelligence changes this equation.

Knowledge that once existed only inside specialist engineering teams is becoming easier to discover, interpret and apply.

The technical barrier protecting many building systems is steadily eroding.

AI Becomes a Force Multiplier

Large language models should not be viewed as autonomous hackers.

Their real value for attackers lies elsewhere.

They dramatically accelerate technical understanding.

Tasks that previously required hours or days of manual research can now be completed within minutes.

For example, AI can assist in:

• interpreting proprietary protocol documentation
• explaining unfamiliar packet structures
• comparing firmware versions
• identifying default configurations
• analyzing controller manuals
• summarizing vulnerability disclosures
• correlating information across multiple manufacturers
• generating proof-of-concept scripts
• creating scanning logic
• documenting attack paths

None of these capabilities is revolutionary on its own.

Together, however, they fundamentally change attacker productivity.

The limiting factor is no longer information.

It is intent.

Reconnaissance Is Becoming Automated

Every successful attack begins with reconnaissance.

Building automation has traditionally made reconnaissance expensive.

Controllers often expose unusual interfaces.

Documentation is fragmented.

Naming conventions differ across vendors.

AI removes much of this friction.

Instead of manually reading hundreds of pages of engineering manuals, attackers can rapidly identify:

• communication protocols
• controller families
• firmware generations
• engineering software
• management interfaces
• authentication mechanisms
• likely network architectures

This dramatically shortens the preparation phase of an attack.

And preparation has always been where defenders had their greatest advantage.

Unknown Devices Become Understandable

One of the greatest historical challenges in attacking operational technology was device identification.

An unfamiliar controller required extensive manual analysis.

Today an attacker can combine:

• photographs
• firmware extracts
• protocol captures
• configuration files
• public documentation
• vendor catalogues

to build an increasingly accurate understanding of a previously unknown device.

What once required specialist reverse engineering increasingly becomes structured information analysis.

That distinction matters.

Because structured information analysis is exactly where modern AI excels.

Firmware Is No Longer a Barrier

Building controllers often remain in operation for fifteen or twenty years.

Many continue running firmware that has received minimal security attention.

Historically, firmware analysis demanded highly specialized reverse engineering skills.

AI increasingly assists researchers in understanding binary structures, identifying functions, interpreting configuration logic and accelerating vulnerability research.

It does not magically discover vulnerabilities.

It significantly reduces the effort required to investigate them.

That alone changes the economics of offensive research.

Documentation Has Become an Attack Surface

Organizations frequently publish extensive technical documentation online.

Installation manuals.

Engineering guides.

Configuration examples.

Maintenance procedures.

Reference architectures.

Each document appears harmless in isolation.

Together they form an extraordinarily detailed blueprint of building infrastructure.

AI can aggregate thousands of pages from multiple vendors into a coherent technical picture.

Instead of searching for information, attackers increasingly ask questions.

The documentation becomes searchable intelligence.

The Skills Gap Is Shrinking

Perhaps the most significant consequence is neither faster attacks nor better exploits.

It is democratization.

Building automation expertise has always been scarce.

Artificial intelligence lowers the entry threshold for attackers without equivalent building engineering experience.

This does not mean inexperienced attackers suddenly become industrial control specialists.

It means that motivated attackers become productive much faster.

History has shown that whenever the cost of acquiring expertise falls, the number of capable adversaries increases.

Cybersecurity should expect the same pattern here.

Why CISOs Should Care

Many organizations still separate building automation from enterprise cybersecurity.

Facility Management owns the systems.

IT secures the network.

Security manages cyber risk.

Each assumes someone else understands the complete picture.

Unfortunately, attackers do not recognize these organizational boundaries.

They simply follow available attack paths.

As building systems become increasingly connected to cloud platforms, enterprise identities, energy management systems and remote maintenance providers, compromises within building automation can no longer be viewed as isolated technical incidents.

They become enterprise risks.

Preparing for the AI Era

The appropriate response is not to fear artificial intelligence.

It is to assume that adversaries will use it.

CISOs should therefore begin asking new questions.

Do we know every building automation system connected to our enterprise?

Do we understand which protocols are exposed?

Can we inventory controller firmware?

Who maintains remote engineering access?

Which suppliers can reach operational systems?

Are engineering workstations monitored?

Would we detect reconnaissance activity against our Building Management Systems?

These questions are becoming more important than debating whether attackers will eventually adopt AI.

They already have.

The Strategic Shift

For years, cybersecurity focused primarily on protecting digital information.

Artificial intelligence is expanding that challenge into the physical world.

Buildings are no longer protected by technical complexity alone.

Knowledge itself has become widely accessible.

The organizations that recognize this shift early will adapt their governance, asset visibility and cyber-physical security programs accordingly.

Those that continue relying on obscurity may discover that their smartest buildings have quietly become their easiest targets.

Coming Next

Part 2 – Digital Twins: The Blueprint Every Attacker Wants

Why BIM models, digital twins and engineering documentation may become the most valuable reconnaissance assets inside modern enterprises—and why many organizations are protecting them far less than they protect their source code.

Publication Note & Disclaimer
This article provides security and governance analysis, not legal advice. Regulatory obligations must be assessed against the facts, jurisdictions, data types, and roles of the organizations involved.

This article reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.