Smart Building Systems Integration Challenges
Legacy building systems lack universal standards, inflating integration costs by 25 to 40 percent.
Walk into any large commercial building and you'll find multiple systems running in parallel. HVAC. Lighting. Access control. Elevators. Fire safety. Energy metering. Each one typically came from a different vendor. Each one typically speaks a different protocol. And for most of their operational lives, that was fine. Nobody expected them to talk to each other.
BACnet, the dominant building automation protocol, commands more than 60 percent of the sector. It was introduced in 1995 and became an ISO standard in 2003. That's not a knock on BACnet. It was well-designed for what buildings needed at the time. But it predates modern IP-based IoT architecture, and what we're now asking it to do is a very different job than what it was built for.
That gap shows up the moment you try to connect legacy systems like BACnet, Modbus, or KNX to modern standards like MQTT or REST APIs. Protocol gateways exist for exactly this reason, but they're not a clean fix:
- Translation adds latency
- It adds failure points
- It adds complexity that someone has to maintain indefinitely
According to Intel Market Research, the lack of universal standards increases implementation time and costs by an average of 25 to 40 percent per project. That cost shows up before anyone has started worrying about security or ROI.
What peer-reviewed IoT literature consistently identifies as the single biggest obstacle to stable integration isn't security. It isn't scalability. It's device heterogeneity. Wired sensors, wireless sensors, edge devices, cloud endpoints. All needing to coexist in the same architecture. Every new system you add to a building requires its own bespoke integration effort rather than a simple plug-in connection. That's not a bug in one vendor's product. It's a structural feature of how the market developed, and the market developed this way because nobody, at any point in the last 30 years, had a strong financial reason to build toward a shared standard they didn't control.
Why Retrofitting Old Buildings Compounds Every Protocol Problem
Roughly 75 percent of U.S. commercial buildings were constructed before 2000. So the majority of the market isn't working with buildings designed for digital systems. It's working with analog controls, legacy operational technology, and infrastructure that was never meant to be on a network.
Picture a mid-sized office complex built in 1987. New facilities management firm takes over, wants to modernize. First discovery: the HVAC system runs on a proprietary analog controller with no IP interface, no usable documentation, and the one technician who understood it retired years ago and took the institutional knowledge with him. The workaround is retrofitting specialized hardware so those OT devices can operate over a LAN, typically without the network segmentation those connections require. It works, technically. But it adds cost, adds a new class of integration dependencies, and produces a system that wasn't designed as a coherent whole, because it isn't one.
There's also an organizational friction layer that doesn't get enough attention. OT-IT convergence isn't just a technical problem. Facilities teams and IT departments have genuinely different operating philosophies:
- Different maintenance windows
- Different patching schedules
- Different risk tolerances
Getting the systems to talk to each other often requires getting the people who manage them to agree on how they're managed. That's its own separate project, and it's one that never appears on the original scope of work.
Scale makes everything worse. A large commercial building can carry thousands of digital endpoints. Onboarding and configuring each one is labor-intensive. The problem isn't one bad connection. It's hundreds or thousands of them, each needing individual attention.
Regulatory pressure is real and accelerating. The UK has committed £630 million to public building retrofits, and nearly 80 percent of commercial properties there face being unlettable without upgrades. Deadlines are moving faster than the integration complexity is being resolved.
In 2024, retrofit projects drove 62.5 percent of smart building deployments. Not new construction. Retrofit. Which means retrofit constraints don't shape just one slice of the problem. They shape the whole downstream picture. Security posture, maintenance burden, and cost calculations all start from whatever was already in the building when the project began.
The Security Exposure That Grows With Every New Connection
IoT cyberattacks surged 124 percent in 2024. More than 1.2 billion connected IoT devices are now installed in commercial properties worldwide. About 44 percent of them lack strong security protections. That's nearly half the installed base.
The attack surface expansion problem is structural. When HVAC controllers, access systems, elevators, and fire panels share networks with tenant data and payment systems, a compromised HVAC controller becomes a potential lateral movement path to everything else. CBRE Group analysis has pointed to exactly this kind of lateral movement risk. The systems were integrated. The security assumptions weren't updated to match.
Real incidents make this concrete. In 2021, attackers took over a commercial real estate firm's cloud-based building management system, seized HVAC controls, and demanded Bitcoin to restore operations. In 2016, a DDoS attack disabled heating controls in two Finnish apartment buildings for at least two days, in winter. These aren't edge cases. They're the predictable outcome when you network systems that were never designed to be networked.
The core vulnerability is specific. Legacy OT protocols like BACnet and Modbus were not built with encryption or authentication. Retrofitting connectivity onto them doesn't add those features automatically. It only does if you explicitly engineer them in, which adds cost and complexity to an already complex project.
And the most common entry points aren't sophisticated zero-day exploits. They're default passwords. Poor credential hygiene. Basic configuration failures at scale. That's almost more frustrating than a clever attack, because those are solvable problems that keep showing up anyway. The industry's biggest security threat, in a lot of cases, is the word "admin" typed into a password field.
Security review overhead compounds all of this. Every new API connection, every new vendor integration, triggers an assessment cycle. The more fragmented the vendor landscape, the more reviews are required. The reviews slow deployment. Slow deployment delays value realization. Then someone adds another system, and the cycle starts again.
Where Open Standards Are Making Progress and Where They Fall Short
There is genuine forward momentum, and it's worth naming directly.
Semantic data models, specifically Brick Schema, Project Haystack, and RealEstateCore, are converging under ASHRAE 223P. The goal is a common vocabulary for building data. That matters because systems sharing a common vocabulary can share meaning, not just signals. It's a prerequisite for real interoperability, and the convergence is real.
Matter, the interoperability standard that originated as Project Connected Home over IP in December 2019 through a collaboration involving Amazon, Apple, Google, and the Connectivity Standards Alliance, released version 1.4.1 in May 2025 and version 1.4.2 in August 2025. Manufacturer commitments are growing, including from professional suppliers like Busch-Jaeger (ABB). Active development is a meaningful signal.
Matter's limitation is reach. Its footprint in large commercial building management environments is still limited. It addresses a different layer of the stack than enterprise building automation. It's solving a real problem, just not always the specific problem a large commercial retrofit project is actually facing.
On the security side, ETSI EN 303 645 provides a baseline for consumer IoT devices, and the U.S. Energy Modernization Cybersecurity Implementation Plan endorses standardized encryption for Building Energy Management Systems. Regulatory frameworks are starting to close the gap between what's deployed and what's secure.
Standards reduce future fragmentation. They don't solve the installed base. The roughly 75 percent of pre-2000 commercial buildings still running legacy OT won't be transformed by new standards alone, because they were never designed to run those standards in the first place. New standards matter enormously for everything built going forward. They matter considerably less for everything already standing.
Open standards also address vendor lock-in. Without common standards, an enterprise becomes dependent on one manufacturer's ecosystem. That recreates the silo problem at a different layer of the stack, under a different brand name.
Why ROI Is Hard to Calculate and Harder to Defend Internally
A typical smart building implementation costs somewhere in the range of a few to several dollars per square foot. That's a wide range, and the width of that range is itself the story. Implementation complexity varies enormously by building age, existing infrastructure, and vendor mix. So does the cost.
A 2024 Facilio survey of 180 smart building industry leaders found that high implementation costs, lack of interoperability, and difficulty assessing ROI were the top three barriers. A meaningful share of that group couldn't choose among available point solutions partly because the ROI case for each was genuinely hard to compare.
The savings are real. Proactive energy management in mid-sized buildings, including digital twin modeling for HVAC optimization, typically delivers savings in the 10 to 25 percent range for HVAC and lighting. That's not a trivial number. But those savings are distributed across systems and realized over years, which makes presenting a clean payback period to a finance team difficult. Finance teams like clean payback periods.
Point solutions compound this. Each vendor pitches its own ROI. But the integration work required to connect those solutions into a unified building management system isn't priced into that pitch. The cost of the connective tissue is invisible until the project is already underway. By then, the budget conversation has already happened and been signed off on.
There's also an organizational layer that's easy to miss. Facilities teams, IT, finance, and senior leadership all have different definitions of what a smart building project is supposed to deliver. Integration sits uncomfortably between all of them. Nobody fully owns it, so nobody fully funds it. And when something goes wrong or costs more than expected, there's a lively discussion about whose budget it comes out of.
ROI complexity here isn't purely a financial problem. It's an integration governance problem. Without a shared framework for measuring outcomes across the organization, every new system addition requires a fresh justification cycle. The math gets re-litigated every time something new gets added.
How Teams Are Reducing Integration Overhead in Practice
The mitigations are as specific as the problems, which is actually good news.
Pre-built connectors and managed integration layers are the most direct answer to per-vendor engineering overhead. The alternative is custom point-to-point integrations, which create a maintenance burden that grows nonlinearly as building complexity increases. One custom connection is manageable. Fifty is a part-time job. A hundred is a crisis in slow motion.
Unified authentication and access management across building systems, a core principle of zero-trust architecture, addresses one of the most consistent security review bottlenecks. When credentials and tokens are consolidated, the surface area that security teams have to evaluate for each new connection shrinks. Fewer review cycles. Faster deployment.
Edge-layer standardization is the pragmatic middle path for retrofit contexts. Multi-protocol edge devices that translate between OT protocols (BACnet, Modbus) and IP-based APIs let legacy systems participate in modern integration architectures without full replacement. Given that retrofit projects drove 62.5 percent of deployments in 2024, this approach matters considerably more than full-replacement strategies in most real-world situations.
Network segmentation between OT and IT systems is the most consistently cited security mitigation across the industry. It doesn't prevent compromise. But it limits lateral movement when an endpoint is compromised, which is the more realistic threat model to plan around.
Governance structure is where teams most often stumble, and it's not a technology problem. Integration succeeds when facilities, IT, and software procurement are treated as a single function rather than three sequential handoffs. The technical architecture and the organizational architecture have to be designed together. When they're not, technical decisions made in one silo create problems the other silos have to clean up, usually with money they didn't budget and time they don't have.
Protocol incompatibility, legacy infrastructure, security exposure, and ROI opacity don't exist in isolation. They compound each other, each one making the others harder to address. But each layer has a corresponding mitigation, and the teams making the most progress are the ones who've stopped treating these as separate problems and started treating them as one interconnected one.
