This episode examines how a user checking personal email on an application host in a commercial building could compromise the building’s HVAC, central plant equipment and controllers. It discusses how downstream devices are at risk and how attackers with knowledge of building control systems may exploit interoperability. The talk walks through the events in order and the remediation steps, and what actions may have inflamed attackers rather than stopped them.