A report from Claroty discusses the state of building management system (BMS) exposures. After assessing almost half a million BMS in more than 500 cyber-physical systems (CPS), the report found that 75% of organizations have BMS with known exploited vulnerabilities (KEVs).

Furthermore, 51% of organizations affected by KEVs are insecurely connected to the internet and are impacted by KEVs link to ransomware. Within those companies, 2% of devices have the same level of risk. This means that devices vital to business operations are functioning at risk exposure of the highest level. 

Considering the reliance of BMS systems in retail, hospitality, commercial real estate, and data center facilities, these organizations may be at greater risk of disrupted operations to systems such as lighting, energy, elevators, security, and more.