The fallout from a cyber breach often includes deflected blame and self-recrimination that gives perpetrators better cover to keep refining their tactics. Reluctance to reveal victimization may be rooted in more than just concern about employees’ and clients’ privacy or inspiring copycats, even in an industry where it’s a common, collegial practice to share lessons learned.
“There’s a weird stigma around vulnerability to cyber fraud that does not exist in other crimes. If you get hacked, it becomes a moment of shame,” observes Benjamin Shinewald, president and chief executive officer of the Building Owners and Managers Association (BOMA) of Canada. “As a society, we need to say: there are bad people trying to do these things and we can’t always be perfect against these threats. Maybe being a bit more open in the conversation is part of the solution.”
That suggestion was raised in a forum that was well placed to act, as Shinewald steered reflection on the year’s most topical commercial real estate issues at BOMA Canada’s annual national conference. Security in digital and physical spaces continues to rank prominently on the operational agendas of many delegates who gathered for the 2026 event in Ottawa earlier this fall.
On the cyber security front, a panel of senior executives tasked with weighing in on industry concerns reported their firms are strengthening their defences against a nimble enemy, and agreed more industry collaboration could help reinforce their individual positioning.
Property management’s reliance on an expansive network of third-party service providers has always necessitated vigilance of outsider access to buildings and the vast store of valuables within them. However, digitalized business norms now create vulnerabilities to inadvertent negligence or deliberate malfeasance that’s less readily detectable than physical property crimes.
“We can do a lot ourselves to protect ourselves, but we also have to consider the vendors tapping into our systems and how sophisticated their cyber programs are,” said Sarah Clarke, senior vice president, operational excellence, with QuadReal Property Group. “We do privacy impact assessments and score our vendors before we start allowing them into our system. That isn’t an exercise that was common in the past.”
She commended industry efforts to share information and called for more of it. Given the large complement of vendors and service providers at any one property and the likelihood that many of them also have business dealings with other property management companies, one weak link could have a cascade of repercussions across that landscape of intertwined relationships. Improved industrywide resilience would have broad benefits.
“For sure, the industry is making progress, but everybody is at a different place along the way,” maintained John-Bosco Agbasi, managing director with Fengate Real Estate. “Some of the larger firms are further along, and a lot of that is because they’re taking learnings from other parts of their business and applying that to their real estate business.”
On the flipside, Hugh Gorman, chief executive officer of Colonnade BridgePort, warned that cyber criminals are likely to become more commonplace, in both their numbers and pursuits, as it becomes easier to engage in the activity. A Class B office building, for example, may not have a particularly lucrative profile now, but it could attract more nefarious attention if other factors change and it’s perceived to be an easy mark.
“I think we’ve been lucky because we’re typically not high-value targets, but it’s coming,” Gorman said. “Their capabilities, like everybody else’s with AI, are improving. We’ve been given the gift of time, but I think we’re going to have to catch up quickly here.”
Notably, Shinewald presented a deep fake video of himself as an example of what AI can generate quickly, simply and inexpensively. In this case, a BOMA Canada staff member produced the deep fake in two hours, at the cost of $100, using images of Shinewald that had been combed from the internet. Although closer examination reveals some telling signs of fakery, the likeness could get by more casually focused viewers.
“The ability to create perfectly accurate deep fakes really is extremely close to being in our grasps,” Shinewald reiterated.
Yet, while posing that threat, AI enables improved vigilance and response times through relatively simple add-ons to conventional security monitoring systems. Panellists agreed it is bolstering security coverage in their buildings at a time when labour shortages and societal upheaval are creating other pressures, but they don’t expect it could do that job alone.
“Security is a huge part of our frontline operations. It’s probably one of our biggest line items when it comes to expense,” Clarke acknowledged. “AI allows us to be more predictive and more sophisticated in how we operate our building, but it doesn’t take away from that physical presence of the guards.”
“We absolutely still need physical security,” Agbasi concurred. “It just needs to work in concert with other layers of security.”
