FM is on the front line of cyber security. It needs more from IT than a ticket number

The owner of Phase Eight and Hobbs is the latest retailer hit, H&M is looking into a hacking claim, and today MI5 warned that AI is accelerating the threat. Facilities teams now look after more connected technology than ever. Too often, they are doing it without the backing they need.

On Sunday, TFG London, which owns Phase Eight, Hobbs and Whistles, found what it called a “cybersecurity incident” affecting its IT systems. Stores stayed open, but parts of its websites went down and online orders were delayed. On Monday, The Times reported that H&M was investigating an attack claimed by the hacking group ShinyHunters. A week earlier, ASOS confirmed that an “unauthorised party” had accessed customers’ personal data.

This afternoon, MI5’s Director General, Sir Ken McCallum, said in his annual threat speech that “AI is already supercharging the cybersecurity contest between attackers and defenders”, and announced a new AI Threat Assessment Centre. He is not the only one worried. Anthropic, one of the companies building the technology, says its latest model has found “tens of thousands of vulnerabilities” in widely used software, and that “only a small fraction have been fixed.” Elon Musk puts the chance of an AI-driven catastrophe at up to 20%. The National Cyber Security Centre has told organisations to prepare for a “patch wave” of urgent security updates as AI drags old flaws into the light.

Buildings are not exempt. In a survey of facilities management professionals published by RICS, 27% said a building they worked in had suffered a cyber attack in the previous year, up from 16% the year before. RICS’s head of property practice, Paul Bagust, warned that businesses risk “sleepwalking into cyberattacks.”

The people being asked to stop that happening are, more and more, in FM.

“Raise a ticket”

Picture a familiar morning. The catering contractor is installing new tills and needs them on the network. The access control firm has an engineer on site to upgrade the door system, and he needs remote access to finish the job. The FM manager has known about both for weeks. The supplier is waiting in reception. FM calls IT and is told to raise a ticket.

The ticket joins a queue. The engineer waits, then leaves. The supplier charges for the wasted visit, the business wants to know why the doors still aren’t working, and FM takes the blame for a delay it didn’t cause.

Ryan, founder of managed IT provider Initiate IT, has seen it happen. “I’ve seen it first hand when outside parties like caterers or access control firms need access to systems. FM asks IT for help and gets told to raise a ticket, then waits. Depending on the IT team’s mindset, they can make that process far more frustrating than it needs to be. FM isn’t trying to cut corners. They’re trying to get a supplier on site and working, and they need IT alongside them, not behind a queue.”

That frustration isn’t just an inconvenience. It’s a security risk. When the official route is slow, people find another one. The engineer joins the guest Wi-Fi. A login gets shared so the job can be finished. Remote access set up in a hurry is never switched off. David Robinson, head of cyber security at Restore Information Management, warned in August that supplier remote access to building systems often “stays open long after a project ends”, and that “many building systems still rely on default credentials straight out of the box.” An IT department that keeps FM at arm’s length doesn’t make the building more secure. It pushes the risk into places nobody is watching.

What good FM teams are doing

Facilities teams aren’t waiting to be rescued. The teams handling this best are treating connected building systems as something they own, not something they hand over.

They start by finding out what they’ve got. RICS recommends that every organisation keeps an inventory of the technology in its buildings, with a named owner for each system recorded in a risk register. For many FM teams, that’s the first time the BMS, access control, CCTV, metering, lifts and vending have appeared on one list, along with who supports each one and how they connect in.

They bring IT in early. When a tender includes equipment that connects to a network, IT sees the specification before it goes out, and the contract states how the kit connects, who has remote access, who applies security updates and how quickly, and what happens when the manufacturer stops supporting it. Suppliers who will connect equipment or access it remotely are asked to hold Cyber Essentials, or Cyber Essentials Plus for higher-risk systems.

They agree the access process before anyone arrives. Instead of a ticket on the day, there’s a standing arrangement with IT: a named contact, an agreed lead time, and remote access that is time-limited and switched off when the job is done.

And they invest in training. AI has made payment fraud much more convincing. In 2024, an Arup employee transferred around $25 million after a video call with what looked like senior colleagues, all of them deepfakes. FM teams process a steady flow of contractor invoices and bank detail changes, so knowing how to verify a request, and having a process that holds up when everyone is busy, is now part of the job.

What FM needs from IT

None of that works if IT treats FM as just another user logging a fault. FM is responsible for a growing share of the organisation’s connected technology, and it needs a partner, not a help desk.

That means a named IT contact who understands the building, not whoever picks up the ticket. It means IT at the table when FM plans projects and writes tenders, not hearing about them on installation day. It means treating supplier access as planned work, and walking the plant rooms with FM rather than waiting to be told what’s in them. And it means training running both ways: FM learning the basics of cyber security, and IT learning how buildings actually run and the pressures FM works under.

Analysts at Verdantix made the point a few years ago: facilities managers “should not develop a siloed cyber programme on their own”. The reverse is just as true. IT can’t secure systems it doesn’t know about, in buildings it doesn’t walk round, installed by suppliers it has never met.

Who owns the risk?

Writing in The Independent last month, McCallum noted that much of the UK’s infrastructure is now in private hands. “We cannot wait for the next shock to discover who owns the vulnerability,” he wrote.

Inside most organisations, the honest answer is that FM and IT own it together, whether or not either side has admitted it yet. Attackers are using every tool they can find, and AI is giving them more. The organisations that come through this best will be the ones where FM and IT stopped passing tickets and started working as one team.

A ticket number is not a security strategy.