Default Passwords and Open Ports: Auditing the Digital Back Door of the Modern Building

The most dangerous piece of equipment in many UK commercial buildings is not the gas train or the electrical intake. It is the unassuming wall-mounted controller in the plant room, connected to the corporate network, running software that was current when it was commissioned — and protected by a password that shipped with the hardware.

Building management systems have quietly become the connective tissue of commercial property. They schedule the AHUs, monitor the boilers, log the temperatures that demonstrate compliance, and increasingly feed the energy data behind EPC ratings and net zero reporting. Yet while office IT departments harden laptops and firewalls with rigour, the BMS is frequently treated as a mechanical asset with a screen attached. That assumption is now a genuine liability.

Five Vulnerabilities We Find on Nearly Every Survey

1. Factory credentials left in place. We have attended sites where the supervisory controller was still accessible with the manufacturer's default login. It is the digital equivalent of a fire door wedged open — convenient, and catastrophic in the wrong conditions.

2. Flat networks. In many buildings, the BMS sits on the same network segment as tenant Wi-Fi and office systems. A compromised laptop in the marketing department should not, in any rational architecture, be able to reach a boiler sequence. On flat networks, it can.

3. Remote access configured for convenience. A decade of remote working produced a proliferation of port-forwarded routers and cloud gateways installed by whoever needed to check a plant room at 2am. Some are secure. Many are not, and nobody maintains a register of them.

4. Orphaned integrations. Legacy outstations from previous contractors, metering systems from a defunct energy bureau, lighting controls from a fit-out three tenancies ago — each is a device with credentials that someone, somewhere, may still hold.

5. No patch regime. Unlike a server, a BMS controller cannot simply be restarted on a Sunday evening. Firmware updates require planning, access and often the original installer. Without a maintenance contract that covers cyber hygiene, patches simply never happen.

Why This Is a Compliance Issue, Not Just an IT One

The consequences of a BMS breach extend beyond the obvious — plant driven to failure, comfort conditions wrecked, energy bills spiking. For UK landlords and operators, there are regulatory dimensions that are routinely overlooked.

A manipulated BMS can corrupt the metering and monitoring data underpinning energy performance certificates and SECR reporting. Tampering with ventilation schedules in a building handling sensitive processes may create health and safety exposure. And an incident that disrupts business operations will attract questions from insurers who, increasingly, treat operational technology with the same scrutiny as IT estates. Demonstrating a maintained, access-controlled system is fast becoming part of the evidential baseline.

A Hardening Checklist for This Quarter

None of this requires a transformation programme. It requires the same discipline applied to any other critical asset.

• Inventory every connected device. Controllers, gateways, head-ends, remote access routes. If it is not on the list, it cannot be secured.
• Change every default credential. Immediately, without exception, with passwords held in a managed vault rather than a spreadsheet.
• Segment the network. The BMS should sit behind its own VLAN or firewall zone, reachable only from designated management devices.
• Audit remote access. Close every port forwarding rule you cannot justify. Consolidate the remainder through a single, logged gateway.
• Put cyber hygiene in the maintenance contract. Firmware reviews, credential changes on staff turnover, and annual access audits should sit alongside the Legionella checks and F-Gas inspections as routine statutory-adjacent tasks.

The Unseen Asset Deserves Seen Management

A building's mechanical systems are only as reliable as the controls governing them, and those controls are only as secure as the weakest login. Facilities teams would never accept an untested fire alarm or an uncertified lift; an unsecured BMS deserves the same standard of governance.

We would go further: any BMS survey, refurbishment or controls upgrade should now include a security review as standard. The buildings that will navigate the next decade cleanly are the ones whose plant rooms are as well defended digitally as they are maintained physically. The alternative — a controller still answering to "admin" — is a risk hiding in plain sight.