This article is part two of a three-part series exploring how AI and smart building technologies are reshaping cybersecurity risk, governance, and competitive advantage in real estate.
A smart building breach doesn’t have to start with a dramatic attack on core systems to cause serious damage. For real estate leaders, risks often begin quietly through vendor connections, building control systems, or overlooked devices. By the time it disrupts operations, exposes sensitive data, or erodes tenant trust, the issue is no longer abstract. It’s a business problem.
How Minor Issues Escalate Into Major Incidents
In 2013, attackers compromised an HVAC contractor associated with Target Corporation and used stolen credentials to access the retailer’s payment systems. The breach exposed more than 40 million customer payment cards and cost the company more than $162 million in direct expenses, in addition to a multistate settlement.
More recently, Omni Hotels & Resorts faced a 2024 cyberattack that disrupted reservations, point-of-sale systems, payment processing, and digital room key access across multiple properties. The incident demonstrated that cyber risk in hospitality and real estate extends beyond data exposure to include interruptions to building operations, guest access, and revenue systems.
These examples illustrate how building-related cyber risks can quickly escalate from technical issues to operational challenges. For real estate owners and operators, third-party connections, integrated systems, and neglected devices can create enterprise-level exposures that impact customer access, onsite services, revenue, and operational confidence.
IT and OT Integration Raises the Stakes
The convergence of information technology (IT) and operational technology (OT) transforms isolated vulnerabilities into enterprise-level risks. Building systems that once operated independently now connect to enterprise networks, cloud platforms, vendor tools, and analytics environments. These connections enable smarter operations but also allow compromises in one area to affect tenant systems, financial platforms, or sensitive data.
Operational issues may initially appear as routine maintenance problems. For example, a non-responsive door, a thermostat that resets unexpectedly, or an offline elevator may be reported to facilities teams rather than security teams. This can delay detection and increase business impact.
Data Risk and AI Transparency Challenges
Smart buildings generate detailed data on occupancy, movement, access patterns, energy use, and tenant behavior. Artificial intelligence (AI) relies on continuous data streams, resulting in constant transmission, processing, and storage of sensitive information. Mishandling this data can lead to privacy, regulatory, and reputational risks.
AI introduces unique governance challenges. Many systems use proprietary models from third-party vendors, offering limited transparency into decision-making and data protection. Manipulated inputs can cause automated systems to mismanage climate control, disable safety features, or make flawed operational decisions. In smart buildings, cyber and physical risks are increasingly interconnected.
Why Cyber Risk Directly Impacts the Bottom Line
- Direct financial loss: Incident response, legal fees, regulatory fines, remediation, and ransomware recovery create significant unplanned expenses.
- Revenue disruption: Failures in access controls, climate systems, elevators, or payment platforms can prevent tenants and guests from operating normally.
- Tenant trust and retention: Publicized incidents can damage confidence and influence leasing decisions.
- Insurance exposure: Cyber insurance is increasingly difficult and costly to obtain without clear governance and controls.
- Valuation and transaction impact: Investors, lenders, and acquirers are placing greater scrutiny on technology risk during due diligence.
- Regulatory and legal exposure: Properties collecting occupancy, access, and behavioral data face growing privacy and compliance obligations.
Cybersecurity is no longer just an IT expense for real estate organizations. It directly affects asset value, operating performance, tenant confidence, and competitive positioning. As organizations invest in AI-enabled optimization, they should also make appropriate investments in cybersecurity governance.
Turn Smart Building Risk Into Strategic Advantage
AI can improve efficiency, tenant experience, and asset performance, but it also broadens the cyber risk landscape. As building systems, vendor platforms, and AI-enabled tools become more connected, real estate leaders need clear insight into how technology risk can impact operations, valuation, compliance, and tenant trust.
Connect with a member of our team to discuss how your organization can assess smart building cyber risk, strengthen governance, and align cybersecurity investments with long-term real estate strategy.
© Copyright CBIZ, Inc. All rights reserved. Use of the material contained herein without the express written consent of the firms is prohibited by law. This publication is distributed with the understanding that CBIZ is not rendering legal, accounting or other professional advice. The reader is advised to contact a tax professional prior to taking any action based upon this information. CBIZ assumes no liability whatsoever in connection with the use of this information and assumes no obligation to inform the reader of any changes in tax laws or other factors that could affect the information contained herein. Material contained in this publication is informational and promotional in nature and not intended to be specific financial, tax or consulting advice. Readers are advised to seek professional consultation regarding circumstances affecting their organization.
“CBIZ” is the brand name under which CBIZ CPAs P.C. and CBIZ, Inc. and its subsidiaries, including CBIZ Advisors, LLC, provide professional services. CBIZ CPAs P.C. and CBIZ, Inc. (and its subsidiaries) practice as an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable law, regulations, and professional standards. CBIZ CPAs P.C. is a licensed independent CPA firm that provides attest services to its clients. CBIZ, Inc. and its subsidiary entities provide tax, advisory, and consulting services to their clients. CBIZ, Inc. and its subsidiary entities are not licensed CPA firms and, therefore, cannot provide attest services.
“Grant Thornton” refers to the brand name under which the Grant Thornton member firms provide services to their clients and/or refers to one or more member firms, as the context requires.
Grant Thornton International Limited (GTIL) and the member firms, including Grant Thornton LLP and Grant Thornton Advisors LLC, which operate as the US member firm, are not a worldwide partnership. GTIL and each member firm are separate legal entities. Services are delivered by the member firms, GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions.
