Commercial property, including offices, industrial warehouses, and retail spaces, is becoming increasingly connected. Smart surveillance, digital access control, building management platforms, and AI-powered tools can improve security and operational efficiency, but they also expand the attack surface across property portfolios. Protecting physical assets now means securing the systems, identities, and data that support them. This article examines how property businesses can integrate physical security, strengthen AI governance, and reduce cyber risk.
Security Is a Business Risk Across the Property Portfolio
The business risks extend beyond privacy. A security incident can disrupt building operations, expose tenant or employee information, trigger regulatory consequences, and undermine stakeholder confidence. IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a data breach at US$4.99 million, highlighting the potential financial impact of inadequate protection.
Physical security remains fundamental to protecting commercial assets. Access barriers, surveillance, monitored alarms, and effective incident response help prevent unauthorized entry and limit operational disruption. But these measures cannot address every risk introduced by connected building systems.
Digital access platforms, surveillance networks, and building management systems can expose organizations to cyber threats when they are poorly configured, inadequately maintained, or connected to less secure networks. A compromise affecting one system may also create risks for other connected services, depending on how the environment is designed.
For property businesses, the consequences can include downtime, incident response costs, contractual disputes, regulatory exposure and reputational damage. Tenants and corporate occupiers increasingly depend on reliable building services and the responsible handling of their information. So security forms part of operational resilience and the organization’s broader risk management strategy. The priority is to manage physical and digital risks as interconnected business concerns, rather than treating cybersecurity as a separate IT responsibility.
Integrate Physical Security With Cybersecurity Controls
Connected technologies can give security and facilities teams greater visibility across buildings and enable faster responses to incidents. Every connected device comes with its own credentials, certificates, keys, or tokens. And any one of these, if left unsecured, becomes a potential entry point for misuse or compromise.
A layered security strategy can combine physical safeguards with controls that protect the underlying technology. Across a property portfolio, this means establishing consistent minimum security requirements while allowing for differences in building design, occupancy, and operational risk.
To manage these risks consistently, property operators should prioritize:
Strengthening physical controls: Maintain access barriers, surveillance, alarms, and incident response arrangements in line with each property’s risk profile.
Securing connected devices: Replace default credentials, apply firmware updates, restrict remote administration, and enable multifactor authentication where supported.
Segmenting critical networks: Separate building management and security systems from corporate, tenant and guest networks where technically appropriate, limiting opportunities for a compromise to spread.
Controlling third-party access: Restrict contractors, maintenance providers and security vendors to the systems and information required for their work. Review and revoke access when contracts or responsibilities change.
Standardizing portfolio oversight: Establish common security policies, reporting requirements, and escalation procedures so that weaknesses are identified consistently across sites.
These controls work best together when supported by central oversight and clear accountability. Without a portfolio-wide view, security gaps at individual properties can remain hidden until they affect operations or expose sensitive information. That exposure may grow as property businesses introduce AI tools that can access and act on information across multiple systems.
Limit AI Risk by Enforcing Identity and Access Controls
AI can help property businesses advance security, screen tenants, support maintenance operations, and manage leasing. However, these capabilities can also increase the risk of excessive access permissions. The critical question is not simply which AI tools an organization uses, but which data those tools can access on behalf of employees, contractors, and automated services.
Identity sprawl, the accumulation of user accounts, service identities, and access permissions that are difficult to manage, can leave organizations exposed. Employees may retain privileges after changing roles, supplier accounts may remain active after a contract ends, and automated services may have broader access than their functions require.
When AI tools connect to these environments, existing permission weaknesses can become easier to exploit or more likely to expose sensitive information. The technology does not necessarily bypass access controls. The risk arises when those controls are inadequate or are not consistently enforced.
To address this, property businesses should apply the principle of least privilege across their applications, infrastructure, and AI integrations. This means granting each user and process only the access required (minimum access rights) for its defined purpose, reviewing permissions regularly, and removing inactive accounts promptly.
AI systems must also preserve source-system authorization rules. Tenant records, surveillance footage, access logs, and commercial documents should not easily become available to users simply because an AI tool can retrieve or summarize them.
Strengthen Data Governance Across Operations
Commercial property portfolios can contain tenant records, employee information, visitor logs, surveillance footage, lease agreements, access credentials, and sensitive operational data. Without clear visibility into what information the organization holds, where it resides, and how it is used, applying consistent protection across that range of data becomes difficult.
Data discovery and classification locate sensitive information and determine the level of protection each category requires. This is particularly relevant when data is spread across multiple buildings, business units, cloud services, and external providers.
A practical governance framework should establish clear requirements for:
Data classification: Identify personal information, commercially sensitive records, and critical operational data, then assign appropriate access and protection controls.
Retention and deletion: Define how long information must be retained and ensure it is securely disposed of when it is no longer required.
AI usage: Specify which approved tools may process sensitive information, for what purposes, and under which access restrictions.
Monitoring and incident response: Maintain appropriate access logs, investigate suspicious activity, and establish procedures for containing and reporting security incidents.
These measures should align with applicable privacy laws, contractual commitments, and sector-specific obligations. Governance must also extend to suppliers and technology partners that process data on the organization’s behalf.
A property business may struggle to manage its exposure effectively if it lacks visibility into how third parties handle sensitive information. The objective is not to slow AI adoption. It is to ensure that the organization can demonstrate appropriate control over the data and access rights that make AI useful in the first place.
Build Security Into Technology Procurement
For commercial property businesses, security considerations should shape technology decisions from the outset, not be addressed only after systems have been deployed. Building management platforms, digital access control, surveillance networks, cloud services, and AI tools all introduce dependencies that can affect the security and resilience of an entire property portfolio.
Before selecting a technology or supplier, organizations should assess how it protects sensitive information, manages user and administrator access, records security events, and addresses software vulnerabilities. They should also consider whether the platform supports appropriate network segmentation, integrates with existing identity and security monitoring systems, and allows access to be restricted according to operational needs.
Procurement decisions should account for data residency, retention and deletion requirements, as well as the supplier’s approach to security updates, incident notification and ongoing support. These considerations are particularly important when a service handles tenant information, surveillance footage, building access records or other sensitive operational data.
Evaluating these requirements before deployment can help property businesses avoid unnecessary exposure, reduce inconsistencies across sites, and ensure that new technologies align with established security policies. It also provides a basis for assessing the security commitments made by technology providers and determining which controls the organization must implement and maintain itself.
Define Shared Responsibility and Accountability
Technology providers and property businesses share responsibility for security, but their roles differ. Providers may secure the platforms and infrastructure they operate, while property businesses remain responsible for system configuration, access permissions, data protection, and the use of technologies across their portfolios. These responsibilities should be clearly defined for each service.
Property businesses should establish these boundaries before adopting new platforms. They need to understand who can access sensitive data, how permissions are enforced, how vulnerabilities are addressed, what happens when an account or device is compromised, and how quickly security incidents will be communicated.
Certifications and independent assessments can provide insight into a provider’s security practices, but they do not guarantee that a specific deployment is protected against threats. Organizations must assess both the provider’s controls and their own implementation.
At the same time, accountability should extend beyond IT to facilities management, procurement, legal, and privacy teams, all of which may influence security decisions. Executive leadership should ensure that responsibilities are clearly assigned, supported by adequate resources, and regularly reviewed across properties.
Without that oversight, security measures can become inconsistent, supplier risks can go unexamined, and access permissions can accumulate unnoticed. The result is a gap between the security an organization believes it has and the controls it can actually demonstrate.
Conclusion: Treat Security as an Operational Imperative
As commercial property portfolios become more connected, protecting buildings increasingly depends on securing the systems, identities, data, and third-party services that support them. AI can improve operational efficiency, but without effective access controls and governance, it can also increase exposure to cyber risk.
Property leaders should adopt consistent security standards across their portfolios, enforce least-privilege access, strengthen data governance, and assess security throughout the technology lifecycle. Clear accountability, regular reviews, and effective supplier oversight are essential to maintaining these controls as systems and business needs evolve.
Ultimately, security is not simply a matter of preventing unauthorized physical access or responding to cyber incidents. It is about ensuring that connected building systems remain reliable, sensitive information is protected, and operational risks are managed before they disrupt the business
Property businesses that integrate physical security with cybersecurity and AI governance will be better positioned to protect their assets, maintain tenant confidence, and support long-term business resilience.
