Connected heating, water, and building devices are now part of the cybersecurity surface of a building. A password screen is not enough. The product needs update paths, secure defaults, supported software and documentation from the start.
A heating controller with Wi-Fi is not just a heating controller anymore.
A water treatment monitor with cloud connectivity is not just a monitor. A smart access panel is not just a relay board with an app. Once the product connects to a phone, gateway, cloud platform or building network, it becomes part of a cybersecurity problem.
For a long time, many connected building products treated security as something added near the end. Add a password. Disable a debug port. Put TLS in the app connection. Write something about encryption in the manual.
That approach is running out of road.
