MetroNational’s cybersecurity transformation offers a valuable lesson in getting smart building fundamentals right.
In episode 41 of the podcast, Tearle Whitson (VP of Operational Technology at MetroNational) and Rob Murchison (CEO of Intelligent Buildings, LLC) share the lessons from securing a 10 million square foot mixed-use portfolio in West Houston.
Like many successful real estate organizations, MetroNational discovered that its operational technology (OT) systems had become a significant vulnerability. While their IT infrastructure was increasingly secure, the building management systems, lighting controls, security cameras, access control, and fire systems were operating in silos, unpatched, and sometimes unsecured.
The Classic OT Cybersecurity Problem
Whitson, who joined MetroNational just over three months before the podcast, after two decades managing smart buildings at Microsoft headquarters, described what he called “a tale as old as time” in the OT world.
The problem isn’t malicious intent, it’s how buildings get built. General contractors and subcontractors focus on delivering functional systems at competitive costs. Value engineering often pushes security considerations down the priority list. Systems get installed with vendor remote access for support, but without proper security frameworks or IT team awareness.
“If you didn’t know about it, maybe it wasn’t a big threat 15 or 20 years ago,” Whitson explained. “But with publicly available scanning tools now, if you’re publicly exposed, you are at risk.”
Engineering and operations teams operate with the best intentions but often lack the domain knowledge where IT and OT intersect. They solve problems by creating remote access points or opening domains for convenience, without understanding the cybersecurity implications.
Change Management: The Real Challenge
Whitson’s most emphatic message was about change management. “We have the best technology in the world. We have amazing partners and providers. If I don’t win the hearts and minds of the team and the boots on the ground, the whole thing will get thrown out.”
He credits learning the ADKAR model (Awareness, Desire, Knowledge, Ability, Reinforcement) at Microsoft with transforming how his teams approached smart building deployments. The acronym represents a proven change management framework:
- Awareness of why change is needed
- Desire to participate and support the change
- Knowledge of how to change
- Ability to implement new skills and behaviors
- Reinforcement to sustain the change
For MetroNational’s site teams, this meant reassurance that securing systems wouldn’t diminish their capabilities or autonomy. Whitson positioned himself as their champion, someone internal who understood their needs and would fight for them while implementing necessary cybersecurity measures.
The Foundation for Innovation
This unglamorous groundwork is essential for MetroNational’s vision of using autonomous optimization, AI, machine learning, and fault detection to improve energy efficiency and tenant experience. But Whitson refuses to put “lipstick on the pig”, pursuing flashy technology without secure foundations.
“When you have those exposures, you’re always one eye on the leaky dam and not always able to get to some of those other problems,” he explained.
Murchison reinforced the ROI equation. While avoiding a single million-dollar security incident could justify the entire investment, the bigger return comes from unlocking hidden inefficiencies once systems are properly connected and secured.
Key Takeaways for Commercial Real Estate
MetroNational’s cybersecurity journey offers several critical lessons:
Cybersecurity is foundational, not optional. As Murchison stated, it’s “table stakes” for modern commercial real estate operations.
Budgeting is fragmented. Technology protection often isn’t in asset managers’ or construction budgets, creating gaps that must be addressed at the strategic level.
Discovery comes first. Before securing systems, organizations must understand what digital infrastructure exists across their portfolio, which often reveals opportunities beyond security.
Change management matters more than technology. Without winning over site teams and operations staff, even the best technical solutions fail.
Build security before deploying advanced features. The foundation enables everything else, from energy management to AI-driven optimization.
MetroNational’s story shows that cybersecurity journeys in commercial real estate aren’t quick wins, they’re fundamental transformations that require executive support, technical expertise, effective partnerships, and exceptional change management. But organizations that get this right position themselves not just for security, but for the innovation and efficiency gains that follow.
