Security researchers scanning the internet found nearly three thousand building management interfaces answering directly to anyone who cared to knock. Not servers. Not email systems. The controls for heating, cooling, and energy management in commercial buildings sitting open on the public internet, waiting.
Both vendors whose products were found exposed issued patches. That is the good news. The less comfortable news is that the exposure had already happened, and the researchers' scan was not the only one. Automated scanners run by people with far less benign intentions sweep the internet continuously. The question is not whether those systems were seen before the patches arrived. The question is what was done with that access.
This Is Not Just a Large Business Problem
There is a temptation to read a story like this and assume it only applies to large sites - supermarket chains, hospitals, data centres. But the same technology sitting exposed in a major distribution centre is often the same technology in a medium-sized office, a dental practice's climate control system, a small hotel's access controls, a retail unit's smart security cameras.
If a device in your building connects to the internet - and increasingly most of them do - it sits in the same category. The scale of the attacker's interest differs. The type of risk does not.
Regulators Have Noticed and the Rules Are Changing
Australia's Security of Critical Infrastructure Act is one of the more developed examples of governments formally extending cyber security obligations beyond traditional IT systems to include connected operational technology - the devices that control physical environments. It is not the only one. The UK's Network and Information Systems regulations already apply to certain sectors, and the Product Security and Telecommunications Infrastructure Act places minimum security requirements on manufacturers of connected devices sold here. The direction is consistent: governments are treating connected device security as an infrastructure problem, not just an IT inconvenience.
That means the question of whether you need to care about the security of your connected devices is shifting from a judgement call to something closer to a requirement - and the pace of that shift is picking up.
What UK Small Businesses Actually Need to Do
None of this requires expensive specialist hardware or a dedicated security team. What it does require is a clear-eyed look at what is connected in your business and what state it is actually in.
Know what is on your network
Most small businesses could not list every device connecting to their network if asked. Smart TVs, IP cameras, networked printers, building access systems, energy monitors, EV chargers - all of these are potential entry points if left unmanaged. Start with an inventory. If you do not know what is there, you cannot protect it.
Check whether it is reachable from outside
The specific problem in the building management case was that the management interfaces were answering directly to the open internet. There was no requirement for that. Many connected devices are configured this way for convenience - remote access, vendor support, monitoring - without anyone having made a deliberate choice to expose them. A vulnerability scan can show you what your network looks like from the outside, including things you did not realise were visible.
Apply patches and keep applying them
The vendors in this case issued patches. That is how the story is supposed to end. But patches only work if they get applied, and connected devices outside the traditional laptop-and-server estate are the ones most likely to be running old firmware indefinitely. If your building management system, IP camera, or smart printer has not had a firmware update in two years, it probably needs one. Automated patch management covers the obvious endpoints, but connected operational devices need manual attention unless they are actively managed.
Separate connected devices from your main network
A heating controller does not need to be on the same network segment as your finance system. If a connected device is compromised, network segmentation limits how far an attacker can move from that starting point. This is a basic measure that costs very little to implement and stops a compromised smart device from becoming a foothold into the rest of your business.
The Certification Angle
UK businesses pursuing Cyber Essentials certification are already required to account for all devices that connect to their network. What is increasingly clear is that all devices means exactly that - not just laptops and phones, but the building systems, cameras, and smart equipment that have quietly joined your network over the years without the same level of scrutiny. Getting that inventory right is not just a compliance exercise. It is the practical foundation for everything else.
The Practical Takeaway
The researchers found those exposed building systems because they were looking. Attackers look too, and they do it constantly and at scale. If your connected devices are visible to the internet and running outdated firmware, the only question is timing. Building an accurate picture of what is on your network, checking what is reachable from outside, and making sure updates are applied consistently is not a large project. It is an afternoon of attention followed by a steady habit. The businesses that do this work now will not be the ones reading the next incident report wondering how they ended up in it.
If you want a clearer picture of what your network currently looks like from the outside, speak to CyberStark about where to start.