How Tosi’s Sakari Suhonen is Rewriting the Rules of Building Automation Security

This news is about large commercial and multi-site properties, not typical single-family homes. Sakari Suhonen, CEO of Tosi US, a building automation security company, is raising concerns about how remote access to building control systems (the equipment that runs heating, cooling, and other automated systems) is managed across large real estate portfolios. He says many building operators still rely on old, shared logins that multiple contractors use to remotely access HVAC and other systems, often on networks that aren't well separated from other building systems. According to research from his company, about one in five real estate organizations can't fully track what's connected to their networks, which makes it hard to know who has access to critical equipment.

The concern is that outdated access, like logins that never get shut off after a contractor's job ends or an employee leaves, can leave systems exposed, and the risk grows as companies manage many buildings at once. Suhonen argues for practices like giving each person their own login, setting access to expire automatically, and keeping records of who connected to what and when.

For most homeowners, this doesn't directly apply, since it concerns large commercial building networks and property management companies overseeing many sites. But if you live in a large multifamily building or condo with a centrally managed automation system, this points to a security issue building owners and managers may need to address behind the scenes.