How Vulnerable Is Your Portfolio to Cyberthreats?

This article first appeared in the CPE Sneak Peek Newsletter. Subscribe now for early access to exclusive content, in-depth analysis and key trends!

A property manager’s login can open more than a tenant portal. Depending on its permissions and the systems connected to it, that account may also provide access to payment information, maintenance records and operations across multiple buildings. For owners assembling increasingly connected portfolios, the security question is how far that access extends and what happens if the account credentials fall into the wrong hands.

Recent commercial real estate cyber incidents illustrate the business stakes. In May 2026, Cushman & Wakefield confirmed a limited data-security incident involving voice phishing. Brandywine Realty Trust disclosed in May 2024 that attackers had encrypted part of its corporate IT systems and stolen files, disrupting applications supporting operations and financial reporting. (The office REIT said its property operations continued in all material respects.) A September 2023 attack on real estate and hospitality asset manager Ashford Inc. compromised sensitive hotel guests’ sensitive information, according to the SEC, which brought charges over the company’s disclosures in 2025.

Since commercial real estate firms collect a lot of sensitive data and often handle large sums of money, they are increasingly attractive targets for online criminals. And with portfolios growing ever-more connected, cybersecurity vigilance is an operational must.

The challenge isn’t the technology. It’s getting property owners to treat identity security as required infrastructure, not as an IT problem.

—Rob Hughes, Chief Information Security Officer, RSA

The stakes are exceptionally high because the implications can extend to an operator’s capital relationships. A breach can also affect an operator’s ability to earn or retain investor trust, said Genine Fallon, managing director of capital formation and investor relations at Praxis Rock Advisors.

“Cybersecurity has quietly become a due-diligence item—not just an IT one,” Fallon said. “LPs and institutional capital sources are increasingly asking sponsors what controls exist around property management platforms and tenant-payment data before they’ll commit or recommit capital.”

Where exposure spreads

The challenges CRE firms must navigate to defeat cyberattacks aren’t confined to just one platform. Instead, it is the increasing interconnectedness of the ecosystem that poses the greatest risk, according to Mark Leverette, a partner & real estate leader at BPM. “Every integration creates another pathway into the environment,” he said.

A modern portfolio is likely to include property management systems, accounting platforms, tenant portals, building automation systems, access controls, leasing platforms, payment processors, energy management tools and general harnesses for AI applications. Reviewing platforms individually can miss the risks created by the way they exchange information and grant access.

Keeping third-party software up to date is another challenge. Zeb Anderson, director of AI at technology and operations consulting firm TriVista, noted that outdated compliance and accounting tools can leave openings for attackers.

At the property level, older building-automation and access-control systems can lack protections expected of modern business software, according to Omair Manzoor, founder & CEO of cybersecurity testing firm ioSENTRIX.

Questions for Your Proptech Suppliers

Use these questions to assess access controls, recovery capabilities and incident response:
Is multifactor authentication required, particularly for administrators, and what passwordless or passkey options are available?
How do you verify requests to create or recover an account, and how quickly is access revoked when someone leaves?
Can permissions be restricted by property and job function?
What prevents a compromised account or integration from exposing other properties or systems?
How do you secure service accounts, API keys and other credentials used to connect platforms?
How do you identify unauthorized AI use and keep approved agents within their assigned permissions?
If your service goes down, which functions remain available and what must property staff do?
How frequently are backups made, how are they protected and when was the recovery process last tested?
When will you notify us of an incident, and what information and support will you provide?

“Building management systems and digital access controls are ‘the soft underbelly,’” he said.
In penetration tests, his firm has found that a compromised internet-connected HVAC controller can provide a way into a broader property management network. That outcome depends on how systems are configured and separated. The U.S. Cybersecurity and Infrastructure Security Agency warns that improperly secured or integrated connections between operational technology and business applications can create routes between networks.

Exposure also depends on who has permission to use those systems. The credentials that can access rent payment systems, lease agreements, building schematics, surveillance footage and physical buildings are a common point of entry for attackers. Rob Hughes, chief information security officer at identity-security provider RSA, said a compromised manager account may give an attacker access to multiple applications or properties, depending on its permissions.

But an attacker does not always need to defeat the software directly. Hughes identified help desks as another point of vulnerability. Someone impersonating an employee may persuade a staffer to reset credentials and grant access.

How far an attacker can reach depends on the controls in place. A shared platform does not automatically make every property vulnerable to the same intrusion. But broad administrative permissions and insufficient separation between systems can allow a breach to spread well beyond its initial entry point.

AI-enabled threats

AI adds pressure to those controls by making impersonation easier to produce and personalize. The FBI has warned that criminals use generative AI to increase the scale and credibility of fraud, including through convincing written messages and cloned voices.

Attackers can gather information from a target’s public writing and social media, then use it to craft tailored messages and fraudulent websites. Automation also makes repeated approaches easier, allowing criminals to pursue the same person over time.

Payment-redirection fraud dressed up as a trusted vendor or executive is the attack I’d worry most about now.

—Anders Askasen, Senior Vice President of Marketing, Radiant Logic

These tactics are particularly concerning in an industry that routinely moves large sums through rent payments, deposits, capital expenditures and closings, said Anders Askasen, senior vice president of marketing at Radiant Logic and an expert in cybersecurity and digital identity. Artificial intelligence has eliminated the tip-offs to fraud that staff members were trained to detect. A cloned voice purporting to be an asset manager or CFO could make a fraudulent request sound credible and convince an employee accustomed to receiving that executive’s instructions to approve a wire transfer in a 30-second call.

“Payment-redirection fraud dressed up as a trusted vendor or executive is the attack I’d worry most about now,” he said.

The FBI recommends independently verifying suspicious requests through a known contact number. For property teams handling payments, that makes verification procedures as essential as training employees to recognize fraudulent messages.

Plan for disruption

Verification procedures help prevent fraud, but owners and managers also need to prepare for system outages. Vendor selection is an opportunity to establish both security and recovery expectations before a platform becomes embedded in daily operations. According to Anderson, firms should ask for evidence of providers’ security practices.

That review should involve the people who depend on the technology. Property managers, accounting teams and building engineers can help identify which functions are essential, how an outage would affect them and where a workable backup process is needed. The consequences of losing a tenant-communications tool differ from those of losing access to payment records or building controls.

Centralization makes that assessment particularly important. A shared platform can simplify management across dozens of properties while depending on a single provider. Decision-makers need to weigh those efficiencies alongside their ability to contain a disruption and keep essential functions running.

The practical test is whether property teams and technology providers have a coordinated response when a trusted system becomes unavailable. A vendor’s recovery process is only part of that equation. Owners also need to understand what their staff can do while service is being restored.

Hughes suggests that every property owner should ask: “If your largest tenant can’t access the building tomorrow because of a cyber incident, what’s your plan?”

Read the November 2026 issue of CPE.