When the HVAC is the attack surface.

In June, researchers disclosed flaws in the HVAC and UPS gear that keeps data centers alive, the kind that let someone cut cooling or power from a distance. Over the same weeks another round of advisories landed for the operational-technology systems running buildings, plants and utilities. The mechanical room counts as attack surface now.

It reads as one more month of bad news. There is a bigger signal in it: a category line shifting under everyone's feet.

The line between physical and cyber is gone.

Physical and cyber security got split for convenience, into separate teams and budgets and vendors. An attack that runs through the HVAC into the servers ignores the split. The facilities lead and the CISO end up staring at one risk that neither of them clearly owns.

If you defend the estate.

Find the seam before an attacker does. Ask who owns the path from the thermostat to the server, and make sure one story and one budget cover both ends of it. Push vendors to speak to the whole surface rather than their half of it.

If you sell into it.

The seam is where buyers feel exposed and do not know who to call. Give the CISO and the ops lead one story they can both repeat, use June's disclosures as proof it is real, and be the provider who can talk about the plant and the packet without faking either.

An attack that runs from the thermostat to the server does not care which team owns the budget.

Convergence rewards fluency in both worlds, which is hard to fake and hard to copy. Buyers who insist on it and vendors who have it end up in the same, smaller room.