Cybersecurity is becoming a core risk issue for real estate organizations

In the real estate industry, cybersecurity affects financial performance, operational continuity and leadership accountability. The industry is confronting a threat environment that is broad, fast-moving and harder to predict than in the past. Many leaders recognize the risks but are still working through how to respond in a practical and sustainable way.

A growing awareness

Matt Riccio, national real estate consulting leader for RSM US LLP, says that though executives are conscious of the pace of change and their options in the market, “there is a lot of uncertainty around where to start.” He explains, “Organizations do not always know which tools to invest in, the cost or time associated with implementation, or the overall first step to take. The focus needs to be on building a framework that makes sense for their organization.”

That framework typically begins with an assessment of current capabilities, followed by targeted investments tied to business priorities. Riccio says strong leadership and effective change management are often crucial for cybersecurity initiatives to get up to speed quickly. 

The challenge of technology

The industry is embracing advanced technologies, with demand for data reaching unprecedented levels. Accessing multiple systems, exchanging information securely and analyzing data are now essential priorities. Sharat Kumar, a principal for RSM, says artificial intelligence is rapidly becoming part of daily operations across the real estate industry, with capabilities ranging from back-office automation to predictive analytics.

“Many organizations are concerned about training large language models with their data and exposing it to the internet,” Kumar says. “That’s a good sign because at least they’re aware of the risk. But they aren’t certain what data security measures to take or how to restrict users from accessing unapproved AI platforms.”

This gap in awareness is driving demand for structured governance controls. Rather than focusing solely on tools, leading organizations are stepping back to define policies around acceptable use, data access and oversight.

Threat actors are also embracing AI to launch sophisticated attacks to exploit gaps in internal controls. Deepfake audio and video have introduced a new level of risk, particularly for organizations that rely on real-time financial and operational information.

“We have encountered situations in which individuals receive voicemails or messages that closely mimic the voices of the CEO or chief financial officer, requesting urgent wire transfers or similar actions," Kumar says. “Those fakes force companies to rethink their procedures and verification processes.”

From prevention to cyber resilience

An important shift in the real estate industry is the move from a narrow focus on prevention to a broader concept of cyber resilience. While strong defenses remain essential, leaders are increasingly planning for how they will respond if an incident occurs.

In real estate, cyber resilience is about running financial transactions and maintaining property operations and tenant services even when technology is disrupted. Because firms rely on property management systems, online payments, smart building technology and third-party partners, the ability to recover quickly from outages or cyber incidents protects cash flow, tenant experience and asset value while reducing the risk that a single incident stalls leasing, rent collection or building operations.

Strong governance and recovery planning are critical. Forward-thinking leaders look beyond today’s environment and assess how their technology and data landscape will evolve over the coming years so they can respond effectively to disruption and recover with confidence.

Emerging risks

Operational technology is becoming a growing area of concern in the industry. Smart building systems that track energy usage, access controls and maintenance data are delivering valuable insight, but they also represent new targets.

“Smart buildings are a huge opportunity, but also a huge target,” Kumar says. “Network design and security around those systems are going to be critical.”

As threats become more automated and adaptive, imagination and vigilance will matter as much as technical controls. Leaders who stay informed, learn from peers and engage trusted advisors will be better positioned to navigate what comes next.