AI could help attackers make sense of vulnerable building systems

Cyberattacks on building systems can spill into the physical world, and a security researcher told The Register that AI is helping attackers understand obscure systems. That adds a worrying new layer to risks involving internet-connected equipment such as heating, access controls and refrigeration.

Watch Desk analysis

What happened

The Register describes ransomware and other attacks affecting building-management and operational technology systems. These systems can control or monitor things including heating, lighting, door locks and fire alarms. The article also recounts earlier incidents involving disrupted refrigeration, building access and casino operations.

Michael Freeman, ServiceNow’s senior director of threat research, told the publication that attackers are using AI to learn about building automation systems and unfamiliar protocols. He said this could make it easier to understand controls in systems that attackers might previously have avoided. That is his account of a developing threat, not proof that AI was used in every incident discussed.

Why it matters

The risk is not limited to stolen files. If attackers gain access to building systems, disruption can affect physical operations, from staff access to temperature controls. These systems can also be harder to patch or monitor because they need to stay running.

For defenders, the practical problem is visibility: organisations may not know what is connected, exposed or overdue for updates. Adding AI to an attacker’s toolkit could lower the expertise needed to explore poorly documented systems, though the article does not establish how often that is happening.

Our read

The useful takeaway is not that AI has suddenly made every building hackable. It is that obscure equipment and weak monitoring are less comforting when an attacker may have help understanding them. Organisations should know what their operational technology connects to, limit unnecessary internet exposure and plan how to patch systems without causing unsafe outages. The unglamorous inventory spreadsheet is having another moment.

What to watch

• Whether security researchers publish further evidence of AI being used to analyse operational technology.
• Whether organisations improve monitoring and patching for building-management systems.
• Whether manufacturers reduce the need to expose physical equipment directly to the internet.

Discussion spark: Should organisations be required to keep building-management systems off the public internet by default, even if that makes remote monitoring and maintenance harder?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.