BACnet/IP exposure in building automation: what it means and how to check

What BACnet/IP is, and why it’s worth checking for

BACnet (Building Automation and Control Networks) is the dominant interoperability standard for commercial building systems — it’s how an HVAC unit from one manufacturer, a lighting controller from another, and a central building-management workstation from a third can all read and write the same shared data points. BACnet/IP is the variant that runs the protocol over standard IP networks using UDP, typically on port 47808, rather than the dedicated serial or ARCNET wiring the original 1995 standard assumed. CISA’s Internet Exposure Reduction Guidance lists “47808/TCP – BACnet: Building automation and control networks” explicitly among the ports organizations should check when looking for unintended internet exposure of operational technology.

The core problem: no built-in authentication

BACnet/IP was designed on the assumption that a building automation network would be physically isolated — connected only to the building’s own equipment, with no path to any outside network. Under that assumption, authenticating every command made little practical sense, so the protocol simply doesn’t include it: any device that can send a BACnet/IP packet to a controller can issue commands to it, and the controller has no built-in way to verify the sender is authorized. That design choice was reasonable for a standalone 1990s building network; it’s a significant liability once the same network is bridged, even informally, to a corporate IT network or the internet.

The industry’s answer to this gap is BACnet Secure Connect (BACnet/SC), added to the standard as an addendum that carries BACnet traffic over a TLS-encrypted, certificate-authenticated connection instead of the original unauthenticated broadcast transport. It’s a genuine fix where deployed — but it sits alongside the original BACnet/IP in the standard rather than replacing it, and most installed building systems, often running on controllers expected to last a decade or more, still speak the original, unauthenticated protocol.

How exposure actually happens

Building operators rarely intend to put automation controls on the public internet. Exposure tends to come from a few recurring patterns:

• Convergence with the general IT network. Many newer buildings deliberately connect BACnet segments to the corporate network for centralized monitoring and remote facilities management — a reasonable design that depends entirely on correct network segmentation to stay safe.
• Remote-access tools configured too broadly. A remote support or monitoring tool set up for a vendor’s convenience can end up forwarding more of the network than intended, especially when the rule was added once and never revisited.
• Multi-tenant or multi-site buildings with flat networking. A single misconfigured router or VPN in one part of a larger network can expose building controls that were assumed to be isolated behind it.

How to check your own exposure

1. Identify your public IP using AdminKit’s what is my IP tool as the starting point for any exposure test.
2. Test whether port 47808 responds from outside your network with AdminKit’s port check tool, run only against systems you own or are authorized to test.
3. If it responds, trace why — check firewall rules, router port-forwarding configuration, and any remote-access or monitoring tool connected to the building network, rather than assuming the exposure is deliberate.
4. Segment building automation networks from general IT and the internet using VLANs or a dedicated firewall, and treat any remaining remote-access need as something to route through a managed, authenticated gateway rather than a direct port forward.

Keep in mind that a reachability test from outside only means as much as your network’s own addressing allows — if the gateway’s public IP is dynamic or shared via Carrier-Grade NAT, see our CGNAT guide for why that can affect whether a given result still applies the next time you check.

Where AdminKit fits for ongoing OT access

Checking for exposure once tells you today’s state; building automation networks change as equipment is added, replaced, or reconfigured by different vendors over the building’s lifetime. AdminKit’s planned OT Remote Access product is built around giving facilities and integrators authenticated, audited remote access to OT networks like BACnet/IP without exposing the underlying protocol directly to the internet — see our factories and facilities page for the broader picture of what’s free to check today versus what’s planned.