Critical infrastructure organizations rely on interconnected systems that go beyond data transfer or production control. These systems include physical access control, CCTV, HVAC, and building management, all of which impact safety, uptime, and daily operations. This interdependence makes the convergence of cyber and physical security not just beneficial but essential. Cybersecurity teams must understand the scope of connected systems, access permissions, and potential operational disruptions before incidents occur.
A real-world example illustrates this point. In a data center, the HVAC system connected to the OT network for management and energy optimization was compromised. Cybersecurity analysts detected unauthorized communication from the HVAC controller, revealing malware installed on the management server. The physical security team reviewed badge logs and CCTV footage, identifying an external vendor who had accessed the HVAC control room and connected a maintenance laptop. Together, the teams traced the malware's origin to the vendor's device, demonstrating the value of combining cyber and physical evidence for faster and more confident incident response.
The Honeywell Technologies 2026 OT Cybersecurity Benchmark Report highlights a significant gap: 43% of respondents do not include physical security systems in their OT security programs, and 44% exclude facility infrastructure. This oversight leaves critical systems vulnerable, as they increasingly support uptime, safety, and incident response. Security teams need to understand the operational impact of affected systems, whether it's a business workstation or an HVAC controller, to make informed response decisions.
Effective cyber-physical security convergence requires clear ownership and coordination among cybersecurity, physical security, and facilities teams. Predefined roles and decision paths are crucial to avoid operational disruptions during incidents. Physical security data, such as badge records and CCTV footage, can provide context to technical alerts, helping teams understand the sequence of events and the role of recent site activity. Tabletop exercises are recommended to expose gaps in response plans and ensure all teams understand their roles before an incident occurs.