Host Dr. Matt Tucker speaks with Stacey Shepard, Advisory Board Member at Building Cyber Security, about the rising threat of cyber attacks on smart workplace infrastructure. They break down the critical differences between IT and Operational Technology (OT), highlight real-world vulnerabilities in building automation, and outline actionable steps facility managers can take to build cyber resilience.
As smart buildings become more connected, they also become more exposed to cyber threats. In this episode, host Dr. Matt Tucker, IFMA's Director of Knowledge and Insights, sits down with Stacey Shepard, Advisory Board Member at Building Cyber Security, to discuss how facility managers can bridge the gap between Information Technology (IT) and Operational Technology (OT) to protect their organizations.
Together, they unpack:
Whether managing a single facility or a global portfolio, this episode provides essential strategies for treating cybersecurity as a core component of emergency preparedness and all-hazard resilience.
Resources Mentioned:
Stacey Shepard: [00:00:00] If your data is lost you lose your data. Yeah. And there's a financial cost to that. But if your OT is hacked, this is about the safety of people. And so when something happens, if you don't have that plan, what are you supposed to do?
Host: Welcome to Connected FM, a podcast connecting you to the latest insights, tools, and resources to help you succeed in facility management. This podcast is brought to you by IFMA, the leading professional association for facility managers. If you are ready to grow your network and advance in your career, go to ifma.org to get started.
In today's episode, host Dr. Matt Tucker, IFMA's Director of Knowledge and Insights, is joined by Stacie Sheppard, an advisory board member for the nonprofit Building Cybersecurity, to explore the critical intersection of cybersecurity and facility management. Together, they discuss [00:01:00] why smart building technology increases OT vulnerability, how cyber threats impact business continuity, and what practical steps FMs can take to protect their physical systems and people.
Now, let's get into it
Dr. Matt Tucker: Welcome, everybody, to the Connected FM podcast. I am delighted to welcome Stacy Shepard for this wonderful podcast looking at securing the smart workplace, cybersecurity, and facility management. Hot topic. There's been things happening literally this week, which we may get into a little bit and it seems to be every week at the moment, right?
Yeah. So, um, Stacy, would you like to just briefly introduce yourself?
Stacey Shepard: Thank you. Thanks for the opportunity to be here. I'm Stacy Shepard. I've got my own consulting practice, but I'm here in my role as an advisory board member for a nonprofit called Building Cybersecurity. So name was artfully crafted.
[00:02:00] It's both a noun and a verb. So it's about building and enhancing cyber safety within the facilities arena, and it is about building cyber safety in terms of actual infrastructure. So, our purpose and goal is really about raising awareness and improving edu-education and providing a roadmap and framework for facility managers to be able to understand the vulnerabilities inherent as we are becoming a, a more smart building environment.
Mm-hmm. There's a smart building revolution that's underway. We've talked about it, the incorporation and optimization of AI and what that means. so the ability then is if you're gonna be connected, you need to be protected.
Dr. Matt Tucker: We've had lots of talks around this topic about the increase in digitalization, AI, et cetera. Perhaps not touched on cybersecurity that much, which [00:03:00] is great to have you to, to discuss this a little bit more. Why has cybersecurity become so important, specifically as an important issue for FM?
Stacey Shepard: Sure. Well, the connectivity enables so many beneficial and tangible benefits. So in terms of decreasing cost improving visibility enhancing asset performance enabling you to track metrics for sustainability, all of those things. So it, it's overall it's creating a more beneficial occupant experience, so all positives.
But there's also a digital challenge. And so many people are familiar with the IT, so the information technology, which is the data piece. There's also an operational technology, which includes your building management systems, your access control systems, your fire control systems, and cyber physical safety access like the Internet of Things, where your sensors are interconnected.
Mm. And by doing so, that then creates [00:04:00] some inherent vulnerabilities. Mm. I think often facility managers think that they need to be experts. You do not. But there needs to be an awareness so that you can have the right conversations, and you know how to approach that. I think right now there's kind of a so-what factor, and people aren't aware that, I mean, global cybercrime has increased 350% over the past decade.
Oof. Right now it's costing 10 and a half trillion, that's with a T, trillion dollars annually. So when you look at things like you know, direct financial loss, anywhere from upwards of $250 billion a year. Reputational damage, where customer loyalty then becomes changed, is upwards of 150 billion.
But I think- Wow ... even more important, and this is how I try and tie this with facility management, it's really about your business downtime and operational [00:05:00] continuity. And that, in terms of productivity, is now costing organizations between 500 billion and a trillion dollars a year in terms of those types of metrics.
So it's now becoming kind of eye-watering- Mm ... in terms of financial impact and trying to educate the C-suite on why they need to care and why changes need to be enacted.
Dr. Matt Tucker: I've known you now for a good few years, and I, I'm still staggered now when you, you bring out facts like this and you bring out numbers like this, and it always amazes me.
And I feel if I'm, I'm feeling that, organizations must be a bit like, "Oh, I didn't realize. I didn't realize that was such a huge impact to these staggering figures that we're talking about." I, not sure if you'll remember this one, but I'm guessing you will because you know most of these case studies.
But you mentioned... When you first explained to me the difference between IT and OT, you [00:06:00] told me about an example, I think it was MGM Grand- Mm-hmm ... and how they accessed, the hack.
Stacey Shepard: Yeah.
Dr. Matt Tucker: Are you able to sort of explain that a bit to make this a, th- this feel- Yeah, sure ... a
Stacey Shepard: bit
Dr. Matt Tucker: more
Stacey Shepard: real?
And, and, and unfortunately there's a lot of examples on a daily basis. So that one actually happened a couple years ago. The casinos in Las Vegas were hacked, MGM and Caesars. It was $30 million, and Caesars decided, they negotiated because it, it's now really a thing that's called ransomware as a service where people show up every day and try and, and probe and test into the vulnerabilities.
They negotiated that. They paid, I think... I can't remember what the final amount was. But MGM
Dr. Matt Tucker: said- But
Stacey Shepard: they did pay out. Caesars did. Yeah. Caesars did. But MGM said, "No, we're not going to negotiate with you." And so access control, all the cards to get into hotel rooms. The cards were also used for the slot machines.
They were hemorrhaging [00:07:00] over $2 million a day. And trying to recoup. And so when you're trying to dig out of the situation, the challenge of that to even understand how deeply has it permeated into your systems is, like, step one. Mm. And so when we talk about these things, I think we're gonna get into a little bit about really looking at this as all hazard resilience.
Because facility managers, you're trained to think about emergency preparedness. You're think- you're trained to think about weather hazards, fires, God forbid, an active shooter, but do you have a plan for a cyber attack? And the answer is many organizations do not. Mm-hmm. And so that's one of the things that we're pushing to say is treat this truly as one of the impacts to your business continuity.
Dr. Matt Tucker: Yeah.
Stacey Shepard: But there's so many... There was another... I'm not trying to pick on the casinos. There was another one- ... where and they'll remain nameless, but it was a massive [00:08:00] aquarium of tropical fish. And there was a managed services provider that was taking care of the aquarium and testing it for salinity and temperature.
And because that was on Bluetooth, bad actors were able to hack in to that aquarium, to the, the fish tank, and to then get into their building automation systems, and because there was not a cyber enclave to get into their IT systems for personal data. So it's- Yeah ... it's pretty incredible. I've heard situations on toasters.
You know, toasters that have your logo on it. And when you plugged it into your, your kitchen, your kitchenette in your office they were then able to sync in with your building- Wow ... automation system. So, bad actors are getting more creative. Mm. Unfortunately, there's stories upon stories. Jaguar many people might have seen, there was 5,000 locations that were targeted hit their supply [00:09:00] chain.
Their impact is £2 billion and counting. But you know, it, it's, it's across the board. It's retail, it's manufacturing. Every vertical is now considered to be a potential target.
Dr. Matt Tucker: I wanna pick up on just a couple of things there. The first one's just clarification for myself. So these examples that you're giving about, say, you know, picking up Bluetooth from a heating and ventilation system or card access control, these are examples of OT, operational technology, right?
Operational
Stacey Shepard: technology, right.
Dr. Matt Tucker: Now, how, in your experience- How is the connection or the, you know, the integration of that operational technology with the guys managing the information technology? Are they sufficiently talking to each other? 'Cause I guess they're gonna need to, right?
Stacey Shepard: They're absolutely going to need to, and the challenge is they do not, or do not sufficiently have [00:10:00] ongoing, regular, robust communication.
I can't tell you how many facility managers that I've talked to that said, "Oh, I don't need to worry about cybersecurity because my CIO is taking care of it." Is she or he actually taking care of that? Do you know that for a fact? Have you had a conversation with those individuals? And so what we try and promote is establishing that connective tissue between the IT and OT.
And, and at, at a C-suite level, it's thinking about it even also as, as you're thinking about recruitment. I call them the purple unicorns, the ones that understand the IT and the OT- Yeah ... and can translate between that. But also upskilling, reskilling- Mm ... and, and looking at creating a culture of cyber safety.
Because, you know, if your data is, is lost you lose your data. Yeah. And there's a financial cost to that. [00:11:00] But if your OT is hacked, this is about the safety of people. And so when something happens, if you don't have that plan, what are you supposed to do?
Dr. Matt Tucker: Yeah.
Stacey Shepard: Right? Do you know how deeply it's affecting your systems?
Do you know, should you evacuate the building? Has it impacted your, your elevators? You talked about imaging or Bluetooth. Imaging equipment in hospitals, there unfortunately and tragically, there was a death last year of somebody who was under an operation, and bad actors took the hospital down.
If, if you can't evacuate people through elevators, are there alternatives? Do you know who you should notify? Do you know who is making decisions? Do you have to tell your tenants or your stakeholders? Or if you're a publicly traded company do you have to make a, an announcement? Yeah. So I'll give you, I'll give you one more example that just [00:12:00] happened.
Codewall an AI company posted a blog two days ago that they had infiltrated McKinsey, who was using an AI chatbot called Lily. They had launched this in 2023. And their autonomous bot was able to target Lily and get in, and with over 75% usage of McKinsey for their analysts and researchers.
They were using over 500,000 prompts a month to be able to gather all of their research and cross over all that to aggregate reports for their clients. And I'm gonna look, I, 'cause I wrote this down. It was a little jaw-dropping. 46 and a half million chats were accessed. 728,000 files And 57,000 user accounts.[00:13:00]
And what CodeWall posted was, "Look, in an AI era, the threat landscape is shifting dramatically. AI agents are autonomously selecting and attacking targets, and this will be- become the new normal."
Host: Are you looking to stay ahead in facility management? Join us at IFMA's World Workplace Conference and Expo, 18th through 20th of November 2026 in Anaheim, California. Here you can connect with facility management professionals from around the world, explore the latest workplace technology and solutions, and gain practical insights you can apply right away.
From expert-led education sessions to powerful networking opportunities, World Workplace is where the future of FM comes together. Register today at worldworkplace.ifma.org.
Dr. Matt Tucker: Wow.
Stacey Shepard: So if that doesn't make you feel a little trepidation-
I don't know what will.
Dr. Matt Tucker: [00:14:00] Yeah.
Stacey Shepard: So the key is, though, the AI genie is out of the bottle. That's not, that's not gonna change. Yeah. But the question is, how do you deal with it? Mm-hmm. How do you look at it in a true all-hazard approach to think about prevention, to think about mitigation, to think about response, and think about recovery so that you can continue your business operations?
Dr. Matt Tucker: Mm-hmm. It, it made me think as you were talking before about that idea of how the FM communicates this information with, say, a CIO or just generally the IT- Right ... specialists within their organization, and we recently published a, a report within IFMA called The Rise of the FM Analyst. Mm-hmm. And a couple of those key traits that we would expect, you know, contemporary FMs to have was, we called it cross-functional thinking and collaboration even.
Yeah. Now, they sound like quite abstract terms, but this is a great tangible example of that, of you have to be able to understand these different roles of [00:15:00] the other business stakeholders that you're dealing with. If you don't, you can't work in your silo anymore. You can't just say, "This is our FM team.
This is how we do it. We're fine." You're gonna get caught out by, by what happens here. I just wanted to follow on with something you mentioned about the supply chain.
Stacey Shepard: Mm.
Dr. Matt Tucker: So just to make the FM's life that little bit harder- ... they've gotta get their own shop in order, but then they're looking at their whole supply chain, their vendors, the subcontractors.
How do we control that, Stacey? What's happening there?
Stacey Shepard: Again, I think it's really about taking a proactive approach. There was a report that just recently came out about access control cameras and Hikvision. It was listed as 9.8 out of 10 on the vulnerability scale. And so the question is, how are your access control cameras connected into the rest of your systems and network?
An attacker could potentially get in through those vulnerabilities and tie [00:16:00] into ways that you would not even necessarily anticipate. On an alternate approach, many building owners use managed services providers, and many of you may be representing those organizations here. And it is so much more efficient to be able to access remotely and to be able to check on on a, a something that, that an alarm goes off or an issue happens.
Yesterday we had the keynote speaker was saying the chatbot will recognize that an alarm came off, and it'll turn off the valve, and it'll call the plumber, and it'll do all these things. But to what end if you can't... I mean, when everything works, technology is great.
Dr. Matt Tucker: Yeah.
Stacey Shepard: Right? And so a lot of people are not even aware who is touching your network.
So one of the things that we actively promote is do an asset inventory. We had within the building cybersecurity, one of our, [00:17:00] our members had gone in to do an assessment for an asset inventory for a client. And their IT said, "We know everything that's touching our system." And they went in, and they identified one it was 120,000 devices, 120,000 devices that were touching their network on the OT side, and they had no idea.
Dr. Matt Tucker: Wow.
Stacey Shepard: So if you think about things where a managed services provider is coming in, they have remote access, you change out that provider, do they still have access? Do you know if their devices are still connected? And so being able to do a check for just awareness on what's connected, what limitations can you, can you place on those vendors or even internally on them being able to access different parts of your organization.
So again, it's being deliberate and consistent in your approach and [00:18:00] creating a culture of cyber safety so there's awareness and an appreciation for the why and the so what.
Dr. Matt Tucker: Mm-hmm. Around five years ago, IFMA launched a new initiative called the Executive Summit. And we have a series of these summits that have taken place o- over the past five years.
And they're now happening globally. So we try and run these summits in all of the main global regions. The idea of these summits is to bring senior C-suite leaders together and talk about a hot topic. One of those, I can't remember how many years ago, a couple of, two, three years ago, was on cybersecurity, for example.
So the reason I'm mentioning that is whilst we have you here with the audience and the listeners here, if we look at FM leadership, the C-suite leaders, the decision-makers- Mm-hmm ... what role do they play in, in protecting buildings and, and cyber threats? D- I, I guess you talk to these kinds of people on, on a, on a daily [00:19:00] basis.
How important it is for the, for, for a top-down approach
Stacey Shepard: I think it needs to be top-down and it needs to be bottom-up.
Dr. Matt Tucker: Mm-hmm.
Stacey Shepard: So, you know, you meet, you meet in the middle. I mentioned about a culture and, and a governance strategy. What are roles and responsibilities in this arena to promote that connective tissue between the IT and OT to take that position of an all-hazard resilience of having a plan?
And then also people talk about insurance. So in the FM realm, we don't really think about cyber insurance 'cause that's more on the IT side, but we do have property and casualty insurance. So what I also encourage people to do is go back and read your contracts.
Dr. Matt Tucker: Mm.
Stacey Shepard: So think about you have home insurance or auto insurance.
Do you know what the exclusions and inclusions are? Many times there's gaps when it comes to cybersecurity. So in looking at how you're [00:20:00] protected is looking at your managed service provider agreements. You know, if, if something happens... I'll flip back 10 years ago and Target Corporation it was a managed service provider that was running their HVAC systems, had a USB stick that had malware on it.
It was not intentional, but when they plugged it in, at the time, everything was connected, went straight from their building automation systems into their mainframe, and that bad actor was able to hack all into credit card information, personal information, things like that. So it's looking at the policies, looking at regular backups, looking at system awareness, the asset control.
I, I think many times FMs think, "Well, that's not my job," or, "I'm not the expert." It's trying to make sure that it's not so scary, but that you need to be [00:21:00] aware. Mm-hmm. You need to be aware of the vulnerabilities. You need to be aware of the risks. And And there's no perfection, right? Because I always say it's not a matter of if, but when you're gonna get hacked.
Mm-hmm. So the question is how do you respond and how do you recover from that?
Dr. Matt Tucker: Yeah.
Stacey Shepard: And the C-suite needs to be able to recruit and, and up-skill and provide the governance, provide the oversight, provide the, the resources that you all need because the consequences are too great at this point. Yeah.
Dr. Matt Tucker: And also just who
Do you know who you need to talk to in your organization to make sure that they're also aware of the, the impact that FM can have on all of this? Absolutely. 'Cause they might not know, right?
Stacey Shepard: It, it's, it's really enabling cross-functional conversations that don't always happen, and so how do you promote that?
And how do you incentivize behavior from the C-suite down is recognizing people that are leaning in and being proactive. Yeah. [00:22:00] Being innovative
Dr. Matt Tucker: So we're getting to the end now. So I'm just gonna ask you one final question. If you had to think about practical first steps- Yeah ... for, for, for a facility team, Where would you start?
Where would you advise them to start? Maybe a couple of key tips or steps that you could give to them.
Stacey Shepard: Definitely. So first of all, I'd recommend going to www.buildingcybersecurity.org, not com, because it's a non-profit.
Dr. Matt Tucker: Which is an
Stacey Shepard: excellent resource, I have to say. So, buildingcybersecurity.org. And within that, there is a 16-step checklist that goes through a lot of the things that I just talked...
It's free. Again, this is a non-profit. But to go through and to start to create that connective tissue between your IT and OT organizations. And, and your, your company, your organization may already be leaning in, but it's a good validation to say, "How are we doing on that journey?" Because the threat is always evolving.
I would [00:23:00] also recommend going to IFMA's professional development. Together, BCS and IFMA created what I call kind of the Cyber 101 course, and it gets you familiar with terms and concepts and, and issues and things like that. So you start to gain more familiarity in the knowledge library.
We've got webinars and we've got other resources and presentations and things like that, that, that BCS has done in partnership with IFMA. So start to help your own educational path. I mentioned an inventory of your OT assets, so you know what you have. Mm-hmm. Mapping the connectivity of your devices, so looking at your contracts, both insurance and managed services providers.
Defining those roles and responsibilities, who does what, when. And engaging your IT partners.
Dr. Matt Tucker: Yeah.
Stacey Shepard: So I think those are a handful of things that you are enabled to do immediately. [00:24:00] And to create teams within... And with... If you're leading teams, to be able to get ideas and feedback from them, and to be able to create the conversation so it's an ongoing dialogue.
Dr. Matt Tucker: Fantastic. And you'll be able to check out those links in the description for this podcast. And I would just like to finish by saying thank you. I have many conversations with you about these topics, but I always learn something new. So I hope the listeners of this podcast have, too.
Thank you, Stacy, very much.
Stacey Shepard: Thank you for the opportunity.
Host: Thanks for tuning into the Connected FM podcast. If you enjoyed today's episode, please take a moment to rate and review the show because it really helps us reach more listeners just like you. And don't forget to hit the subscribe button so you never miss an episode. See you next time.