"Numbers don't lead, they follow." That line from the opening keynote at NexusCon 2026 in Detroit turned out to describe most of the conference. The owners who brought hard results this year did not start with a dashboard or an AI pilot. They started with an asset list, a naming standard, a network capture or a named owner, and the numbers followed.
NexusCon runs on peer case studies, with no sales pitches from the stage, and attendees are encouraged to disagree. Here is what stood out for us, from a smart building cybersecurity point of view.
A security leader from a real estate investment trust serving defence and government tenants put it plainly: "Isolation is not a security strategy." The session asked leaders to assume reachability, know what is reachable and what matters, and build the visibility to respond when isolation fails. A building services contractor used Sweden as the warning. In April 2026, Sweden's civil defence minister said a pro-Russian group linked to Russian intelligence services had tried a destructive cyberattack on a Swedish thermal plant in 2025, and that a built-in protection mechanism stopped it.
A global technology company's OT standard for its campuses still separates OT from business networks to contain incidents. The two positions are closer than they sound. Separation limits the blast radius. It does not replace knowing what is connected, logging who changes what, and controlling remote access.
The contractor left the room with three questions worth answering this month: who has remote access to your building systems and when it was last reviewed, whether your BAS network is segmented or flat, and whether your controllers can be found from the internet.
The most practical sessions used packet data to fix problems operators feel every day. At one corporate site, a building IoT integrator found 15% of BACnet reads lost to timeouts. One capture at the site boundary showed remote subnets broadcasting into a network they never exchanged data with. Removing those entries from the BBMD cut broadcast traffic about fourfold at the focus sites. A construction and facility services firm, working with an OT network monitoring provider, traced a controller that kept dropping offline in a 17-storey Toronto office, along with intermittent loss of chiller, boiler and meter data, to a communication cable fault. At a global bank, a single flat VLAN left BACnet chillers "invisible" to the BMS, and the team's response was to segment it.
Comfort complaints, device timeouts and blank graphics are often network problems. Segmentation that reduces cyber exposure also reduces this noise.
A single packet capture at your BAS network boundary, taken from a mirror port over a full business day, will show you which subnets broadcast into your network without ever exchanging traffic with it.
A Canadian real estate investment manager described a seven-year journey that starts with visibility and relies on standardized architecture for segmentation, remote access and integrations, because every one-off design slows recovery. A US health system runs a "Phase 0" before any BAS modernization: audit, assess, standardize, prioritize, then build the roadmap. A large US school district and its energy services partner found one air handler known by eight names across eight systems, and fixed it with one persistent ID owned by the district, not the vendor.
Pick one critical asset and count how many names it carries across your BAS, maintenance system, drawings and analytics platform. That count is the size of your next integration problem.
An academic health system's message was to build the data foundation and your own agent, because a vendor's agent sees only that vendor's data. An energy services firm found that 70% of its remote operations centre's time per work order went to assembling context. After building a tool that gathers it before the ticket opens, the presenters reported 13 to 15% fewer work orders through duplicate detection and over 20% fewer truck rolls at a large US school district with more than 240 schools. A technology company and its building performance consultant showed why the ontology comes first: in their testing without one, the AI agent invented equipment. Brick and RealEstateCore now hold the structure.
Several owners said they want to connect their own AI assistants to vendor platforms through the Model Context Protocol (MCP) rather than use each vendor's chatbot. Their design gives agents read-only MCP tools. Treat every MCP connection like remote access to your BAS: read-only by default, scoped to named systems, logged, and with a person approving any write.
A technology company's facilities team turned fault reports into a quarterly competition across about 105 technicians and 110 facilities. Completed fault work orders rose from 153 to 265, a 73% increase. A university assigned a two-person team to review analytics findings and schedule the work. A financial services firm's advice: name one person to watch the gaps between systems.
An energy company's facilities team, a tenant with no control of its buildings, monitored critical rooms with cellular sensors to avoid IT tickets and security reviews. The speed is real, and keeping sensors off the building network is sound. But each device still sends data to someone's cloud. Add it to your asset inventory, know where its data goes and who can reach the vendor portal.
The keynote's other line was "You have to believe it to see it." The owners on stage this year built foundations before anyone could show them the payback. Their numbers came afterwards.
NexusCon is a conference for connected building operations run by Nexus Labs. NexusCon 2026 was held in Detroit, Michigan, from October 5 to 7, 2026. It runs on peer case studies from building owners, with no sales pitches from the stage.
Separation limits the blast radius, but it does not replace knowing what is connected, logging who changes what, and controlling remote access. Leaders should assume reachability, know what is reachable and what matters, and build the visibility to respond when isolation fails.
Treat every MCP connection like remote access to your BAS: read-only by default, scoped to named systems, logged, and with a person approving any write.
Actimeta is an OT cybersecurity company focused on smart buildings and critical infrastructure.
