Hotels, student residences and build-to-rent blocks used to have a handful of networked systems. Today they have door locks, Wi-Fi access points, thermostats, lighting, CCTV, lifts, parking barriers, printers, laundry machines, voice assistants and, yes, water coolers. Each one is a small computer, bought by a different team, installed by a different contractor and serviced (or not) under a different contract.
Individually, most of these systems are reasonably secure on the day they're installed. Collectively, they rarely add up to a security strategy.
The risk lives between the systems
Attackers have noticed. The 2025 Verizon Data Breach Investigations Report found that the share of breaches involving a third party doubled to 30%, and that exploitation of vulnerabilities as a way in rose by 34%, with a heavy focus on perimeter devices. Forescout's 2025 review of the riskiest connected devices lists building management systems among the riskiest device types and, for the first time, physical access control systems too (Forescout via SecurityWeek, 2025). I work in access control, and I think that finding is right. Virtually any system that runs a building are now part of its attack surface if potential vulnerabilities aren’t adequately addressed.
The best-known example is more than a decade old and still instructive. In the 2013 Target breach, a US Senate committee report concluded that attackers most likely got their first foothold using credentials stolen from the retailer's heating and air-conditioning contractor. The HVAC system wasn't the target. It was the doorway.
In security we talk about the blast radius: if one device is compromised, what else can it reach? A front-desk printer that can see the guest network, the booking system and the building controls has a very large one. The same printer on its own segment has a small one. The device is identical. The difference is a decision someone made, or didn't make, about how a building’s connectivity infrastructure fits together.
Nobody owns the whole building
Properties often come across challenges when trying take a comprehensive approach due to the multiple stakeholders, departments, and teams involved in operating a building. The ownership chain is long. A building is owned by one party, operated by another, sometimes flagged by a brand, run day to day by a general manager or property manager, and supported by a managed service provider and a list of contractors. Add in residents or guests who bring their own smart speakers, games consoles and cameras and connect them to the building's network.
Central brands and large operators usually have strong IT policies. The question is how those policies land at property level, where budgets are tight and maintenance contracts are often chosen on cost. Every link in the chain needs a named owner, and the links most likely to break are the ones nobody thought were theirs.
Treat security as an ongoing cycle, not a finish line
Many properties treat security as an event: the installer connects the device, the paperwork is signed, everyone moves on. A penetration test works the same way. It tells you how secure you were on the day it finished. Two days later a new vulnerability can be published in a component you rely on, and the result no longer describes reality.
Security is a lifecycle, not a point in time. That means watching for new vulnerabilities, matching them against what's actually installed, and getting patches deployed. It also means planning for the day a product reaches end of life, and writing its replacement into the business plan before it becomes a liability. We regularly see properties running firmware two or three versions behind what's available, or still using older key card technology long after stronger encrypted options exist, because "it's only a room key for a couple of nights." Often the upgrade is a software update, not a refit.
Regulation is moving in the same direction. Under the EU Cyber Resilience Act, manufacturers of "products with digital elements" must handle vulnerabilities across the product's lifecycle, with a support period that should run at least five years in most cases. That raises the bar for suppliers. It doesn't remove the building operator's job of making sure updates actually get installed.
What a coordinated strategy looks like in practice
None of this needs a large program to get started. These are the steps I'd suggest to any hotel, student residence or rental operator:
- Know what you have. Keep one log of every connected asset in the building: locks, access points, cameras, printers, building controls, the water cooler. You can't defend something you don't know exists.
- Give every asset an owner. For each item, write down who patches it and who decides when it's replaced. If the answer is "the contractor," check the contract says so.
- Decide what each device can talk to. Separate guest or resident, staff, building and payment networks. Your back-office printer probably needs the staff network. It doesn't need the guest or resident network. Check public spaces too. an Ethernet port left live after a conference in the ballroom or a common room creates an open door.
- Make maintenance a habit. It can be as simple as a recurring half-hour in the calendar, a "Maintenance Friday," to check firmware on locks, access points, printers and cameras, confirm with your service provider that you're current, and flag anything that's reached end of life.
- Ask suppliers for evidence, not assurances. Ask how long they support a product, how they handle vulnerabilities and whether an independent auditor has verified their controls (ISO/IEC 27001 is a common benchmark). The UK government's latest Cyber Security Breaches Survey found that only 15% of businesses formally review the cyber risks posed by their immediate suppliers, and 6% their wider supply chain.
- Keep less data. A property needs to know that a specific room was occupied. Three months later it rarely needs to know who stayed there. Once legal retention periods for things like ID documents expire, delete the data properly. Data you don't hold can't be stolen.
- Rehearse possible situations. What happens if the front desk system goes down at peak check-in, or a key encoder stops working? Run the scenario, write the playbook and test it. The real measure of an organization is how it responds when something goes wrong.
People are part of the system
Front-of-house teams change often, work under pressure and are trained, rightly, to be helpful. That's exactly what social engineering exploits. The old signs of phishing, poor spelling and implausible prizes, are disappearing. Today's attempts are often too polished and patient, built up over several friendly emails before the request arrives. A guest at the desk with a USB stick and a presentation "in five minutes" is a service moment and a security decision at the same time. Short, regular awareness training belongs at every level, not just at head office.
A shared responsibility
No building, and no supplier, can be made impossible to breach. What we can do is make sure every connected system has an owner, a maintenance routine and a clear boundary, and that we're ready when something does go wrong.
As more of our buildings become connected, security stops being a feature of individual products and becomes a property of the whole building. A chain is only as strong as its weakest link, and in a connected building, the weakest link is usually the one nobody was asked to look after.
