An unknown device plugged into your building could bypass security controls you have spent years putting in place. For landlords, managing agents and property teams, that makes physical access to technology every bit as important as protecting passwords, networks and online services.
Retail destinations, multi-tenant offices and science parks are particularly exposed. Contractors, suppliers, occupiers and visitors regularly move through these properties, while communications equipment, building systems, CCTV and other technology may be managed by different organisations. That can leave an important question unanswered: who knows exactly what is connected, why it is there and who authorised it?
In this article, we explain what hardware-enabled cyber-attacks are, why commercial properties are particularly vulnerable, where weaknesses can emerge in a building’s security, and the practical steps landlords and managing agents can take to reduce these risks and strengthen their buildings’ resilience.
What is a hardware-enabled cyber-attack?
A hardware-enabled cyber-attack starts with physical equipment or someone gaining physical access to a building and its systems.
Someone could connect an unauthorised device to a network, plug a malicious USB device into a computer, install an unauthorised wireless access point or leave remote-access equipment behind after a maintenance visit. Supplier equipment can also remain connected when the work that required it has finished.
These devices do not necessarily look suspicious.
The key question is not “Does this device look dangerous?” but “What is it, why is it connected, who owns it and who authorised it?”
Why commercial property is particularly vulnerable
Modern commercial properties depend on technology, but responsibility for that technology is often spread across several organisations.
In a multi-tenant office, areas and systems such as communications rooms, building management systems, access control, CCTV and facilities services may be shared. This can create gaps in visibility and accountability, as organisations may understand their own equipment but have less oversight of devices installed by landlords, facilities providers or other contractors.
Retail destinations add large numbers of retailers, contractors and members of the public. Science parks introduce laboratories, specialist equipment, research environments and regular supplier maintenance.
For property owners and managing agents, the issue therefore extends beyond the IT department. It is about protecting the building, its occupiers and the services they rely on.
This is a real-world risk
Hardware-enabled attacks are not simply theoretical.
In May 2026, America’s Federal Bureau of Investigation (FBI) issued a special notice warning that cybercriminals are increasingly combining digital attacks with physical intrusion, including impersonating IT staff to gain direct access to workplace systems.
In June 2026, the BBC and other media outlets reported that a hidden camera had been discovered in a Westminster government building. The building is the base for the Home Office, responsible for policing in England and Wales and national security. Tory shadow Cabinet Office minister Alex Burghart said: “This is a serious incident that demands an urgent investigation.” A Labour Government spokesperson declined to comment.
Back in 2013, criminals targeted a Barclays branch in Swiss Cottage, London, by posing as engineers and installed remote-access equipment with a mobile connection. Around £1.25 million was stolen from the bank’s customers by fraudulent money transfers.
Between 2011 and 2013, a Dutch drug cartel used cyber-physical infiltration, such as installing keyloggers, to target the Port of Antwerp, enabling smugglers to locate and collect illegal drug shipments before they could be intercepted by the authorities or collected by legitimate operators.
These real-world examples of hardware-enabled attacks might be from different organisations and circumstances, but the incidents reveal a common weakness: once somebody can gain physical access to trusted equipment or locations, digital security controls are not necessarily enough.
Where do the gaps appear?
Research finds four recurring problems that can lead to hardware-enabled attacks:
- Contractors and engineers are not always independently verified. A uniform, ID card or convincing explanation should never be enough on its own.
- Equipment can be connected without sufficient oversight. That makes an unauthorised device harder to identify.
- Access to sensitive areas is not always adequately supervised. Communications rooms, plant rooms, cabinets and other critical areas deserve particular attention.
- Physical and cyber security are treated separately. Facilities, security, IT and suppliers may all hold part of the picture without anyone having a complete view.
For landlords and managing agents, that last point matters. A gap between responsibilities can quickly become a gap in security.