The Badge Reader Doesn't Know It's a Server: Converged Infrastructure and the Representations You Signed

Somewhere in your data center—or more likely in a locked closet nobody has opened since the last facilities reorganization—sits a controller that manages your building's access control system. It runs an operating system. It has an IP address. It may still be running firmware that shipped during the previous presidential administration.

And according to the application your company signed last renewal cycle, your organization maintains "comprehensive asset inventory and vulnerability management across all networked systems."

Those two facts have not yet met each other. When an adjuster arrives after an incident, introducing them becomes someone's very expensive problem.

The Building Joined the Network Without Filling Out Paperwork

Over the past decade, physical security and building management systems quietly completed their own digital transformation. Badge readers became IP endpoints. Elevator controllers began transmitting telemetry to manufacturer clouds for predictive maintenance. HVAC systems exposed BACnet protocols that were designed in an era when "network segmentation" meant separate wiring.

The result is a class of assets that falls between organizational stools. IT doesn't own them. Facilities doesn't understand them. Security teams discover them the way archaeologists discover things—accidentally, and usually while looking for something else.

The threat intelligence community has documented the consequences repeatedly. In the now-famous 2013 Target breach, attackers didn't storm the front doors; they entered through a third-party HVAC contractor's remote access credentials. The refrigeration vendor was the vector. The point-of-sale systems were the prize. Everything in between—the trust relationship, the flat network, the unmonitored pathway—was converged infrastructure nobody had mapped.

More recent incidents have followed the same pattern with different plumbing. Water utilities have seen attackers manipulate chemical dosing through remotely exposed human-machine interfaces. Hotels have watched ransomware lock elevator and key-card systems alongside booking databases. In each case, the physical layer wasn't a separate risk domain. It was the front door.

What the Application Actually Says

Cyber insurance applications have grown considerably more detailed since the ransomware crisis drove carriers to underwrite with real scrutiny. Today's questionnaires routinely ask about multi-factor authentication, endpoint detection, backup practices, and—critically—whether the applicant maintains an accurate inventory of networked assets.

That last question is where converged building systems create exposure. The legal issue is one of representations: the application becomes part of the insurance contract, and material misrepresentations can give a carrier grounds to rescind coverage or deny a claim. Courts have split on how aggressively they enforce this, but no CISO wants their organization to be the test case.

Consider the gap between typical practice and typical representations:

• Representations often assert vulnerability scanning "across the environment." Scanners rarely reach badge controllers, fire panel modems, or elevator telemetry gateways—devices that frequently can't tolerate active scanning without malfunctioning.
• Representations may claim MFA protects remote access. Building management systems often have vendor-maintained remote support channels that predate the security team's tenure.
• Representations may describe segmentation between IT and operational technology. Many buildings run a single flat network where the conference room Wi-Fi and the door controllers share address space.

None of this is necessarily dishonest. It is, however, a discrepancy waiting for a forensic accountant with a discovery budget.

Three Questions to Ask Before Renewal

The window to fix a representation problem is before you sign, not after you file a claim. A disciplined pre-renewal review should answer three questions.

First: does our asset inventory include the building? Pull the physical access control system, fire alarm communicators, HVAC controllers, elevator telemetry links, and any vendor-managed support connections into the same inventory your security team actually uses. If facilities procurement bought these systems, trace the contracts—many include remote management clauses the security team has never seen.

Second: what would a scan of these devices reveal? Passive discovery tools can fingerprint building systems without disrupting them. The results are frequently humbling: default credentials, management interfaces exposed to general networks, firmware a decade past end-of-support. Better to learn this from your own scan than from an adjuster's expert witness.

Third: does our application language match reality—or aspiration? Have counsel review the questionnaire responses against documented, verifiable practice. Where reality falls short, either remediate before signing or disclose. Carriers are generally more willing to price a known gap than to discover an undisclosed one mid-claim.

Convergence Is a Governance Problem Wearing a Technical Costume

The deeper issue isn't firmware or segmentation—it's ownership. A badge reader that no team claims is a device that no team patches, monitors, or includes in an insurance representation. Assigning explicit ownership of converged systems, with a defined review cadence shared between security, facilities, and legal, closes the gap that both attackers and adjusters exploit.

The building has been on the network for years. The only question is whether it's on your inventory before it appears in someone else's incident report.