Ghosts are easy to spot. Cybersecurity threats? Not so much.

Every October, people tell stories about haunted houses, things that haunt you in the night, and unexplained sightings. In cybersecurity, we have our own horror stories. The difference is that ours are real.

Over the years, the 5Q team has conducted countless cybersecurity assessments, infrastructure reviews, and security investigations across commercial real estate, multifamily housing, and other industries. While most assessments uncover common issues, occasionally we stumble across something that makes even seasoned professionals stop and say, "That's not good."

In honor of Cybersecurity Awareness Month, here are a few true stories from the field.

The Rat in the Network

From: Shane Hook, Managing Director, Engineering Services

Every cybersecurity assessment starts with the same question:

What's connected to the network?

Most of the time, the answer is predictable. Workstations. Servers. Printers. Building systems. Security cameras.

But during one assessment, Shane's team discovered something unexpected.

There was a RAT on the network.

Not the furry kind.

A Remote Access Trojan (RAT) is malware designed to give an attacker remote control over a system without the owner's knowledge. Once installed, it can provide access to files, credentials, cameras, microphones, and other sensitive resources.

The discovery came during routine assessment activities. What initially appeared to be normal network traffic led investigators down a path of suspicious connections and unauthorized communications. The deeper they dug, the clearer it became that an unauthorized remote access tool was present in the environment.

For the client, it was a chilling realization. Everything appeared normal on the surface, yet an attacker potentially had a foothold inside the network.

The lesson? Just because you don't see a threat doesn't mean it isn't there. Many organizations assume they would notice if something malicious was operating within their environment. Unfortunately, today's threats are designed specifically to avoid detection.

Sometimes, the scariest thing on a network is what appearsto be nothing at all.

‍

‍

The Sticky Note That Protected a Million-Dollar System

From: Jeff Ewing, VP of Cybersecurity Operations

People often imagine cybersecurity failures involving sophisticated hackers and advanced malware.

Sometimes, the culprit is a sticky note.

During an assessment of a large office campus, our team discovered the password for the Building Management System (BMS) computer displayed in plain sight inside an engineering office. The office door was unlocked and open throughout the assessment.

Anyone walking through the building could have stepped inside, viewed the credentials, and gained access to systems responsible for controlling building operations.

The organization had invested heavily in network equipment, cybersecurity tools, and infrastructure. Yet the protection of critical operational systems ultimately depended on a password visible to anyone who happened to walk by.

It's a finding that reinforces a difficult truth: human behavior often matters more than technology.

As Jeff likes to say:

"We've found million-dollar building systems ‘protected’ by a Post-It note."

The Payment Device That Didn't Belong

Technology environments rarely stay exactly as they were designed.

Over time, well-intentioned shortcuts, temporary solutions, and forgotten projects leave their mark.

During one campus assessment, our engineers found a Square credit card payment device connected directly to the Building Management System network.

It wasn't malicious. It wasn't even intentional.

Someone had likely plugged it in years earlier to solve a business need without considering the cybersecurity implications. The result was a payment-processing device sharing network space with systems responsiblefor operating the building.

The discovery created potential compliance concerns and expanded the attack surface of the environment.

No network diagram showed it. No documentation mentioned it.

It simply existed.

"We found a payment-processing device sitting on the same network as the systems controlling the building."

The Conference Room That Could Reach Building Operations

Many organizations believe their networks are properly segmented.

Sometimes they're right.

Sometimes they're only segmented on paper.

While assessing a large office campus, engineers discovered they could move laterally between network segments and gain access to the Building Management System network from the conference room audio/visual network.

In practical terms, someone compromising conference room technology could potentially use it as a pathway into operational building systems.

Diagrams indicated the systems were separated. Testing proved otherwise.

Cybersecurity assessments often uncover the difference between what an environment was designed to do and what it actually does today.

"The building looked segmented until we tested it. Then we discovered conference-room technology could talk to building-control systems."

The Security Devices That Weren't Secure

There's an assumption that devices installed for security purposes must themselves be secure.

Unfortunately, that isn't always the case.

During a high-rise assessment, 5Q discovered multiple security cameras still using manufacturer default usernames and passwords. The cameras provided access to both live and recorded video footage and had never been properly secured after installation.

The irony wasn't lost on anyone.

The very devices intended to improve security had become one of the greatest risks within the environment.

As more connected devices are deployed throughout realestate portfolios, these oversights become increasingly common.

"The devices intended to provide security werethemselves one of the biggest security risks."

The Wireless Access Point Hidden Under the Reception Desk

Not every cybersecurity risk lives in a server room.

Some are hiding in plain sight.

During an assessment of a commercial property, our team discovered a wireless access point sitting under the reception desk. It had been connected directly to the security camera network.

Nobody was entirely sure when it had been installed.

Nobody could confidently explain why it was there.

Most likely, it had been added years earlier as a convenience and then forgotten about.

Anyone obtaining the wireless credentials could potentially gain access to the camera environment.

It was a textbook example of shadow IT, where technologies are introduced outside of normal IT oversight and quietly become part of the environment.

"We found an unauthorized wireless bridge into the security camera network hidden under a receptionist's desk."

The Conference Room Phone That Became an Attack Path

When most people think of cybersecurity risks, they don't think about desk phones.

Perhaps they should.

During a high-rise assessment, engineers discovered a flat network architecture that allowed building systems to be reached through the LAN ports on Cisco desk phones.

In one scenario, a conference room phone could potentially serve as an entry point into the broader operational environment.

The phones weren't vulnerable.

The network design was.

It's another example of how operational convenience can create exposure that nobody anticipated.

"In one building, a phone on a conference-room table was effectively a network jack into building operations."

‍

The Elevator Modem Broadcasting Its Own Invitation

At a multifamily community, our team discovered a Verizon modem supporting elevator emergency phones.

The modem was performing its intended function.

It was also broadcasting a Wi-Fi network.

And it was still using the default credentials printed on the device.

The equipment had been installed for a legitimate purpose, but nobody had revisited its configuration afterward. Like many technologies installed by third-party vendors, it existed outside normal IT governance.

What started as a support device had quietly become a potential wireless entry point into the property.

"An elevator support system had become a public wireless entry point into the property."

The Camera Watching the Wrong Building

One of the most alarming discoveries we've encountered involved three external security cameras at a large office building in the Washington, D.C. area.

The building engineering team considered the cameras were "broken."

They hadn't appeared on monitoring screens for years. The support contract had expired, and building staff assumed they were no longer operational.

During a due diligence assessment, our team scanned the network and investigated the devices.

The cameras weren't broken.

They were working perfectly.

The video traffic was being redirected outside the United States and overseas. All three cameras were pointed toward entrances of a nearby federal building.

For years, nobody had questioned why the cameras stopped appearing in local monitoring software. No one imagined that the devices could still be functioning.

Yet they were.

And they were capturing exactly what someone wanted to see.

"Security cameras were pointed at a nearby federal building recording everyone who was coming and going. Then sending that data outside of the U.S."

Critical Infrastructure Hanging by Zip Ties

Not every risk begins with a cyber attack.

Sometimes it starts with a shortcut.

During a multifamily assessment, 5Q discovered Cisco Meraki switches physically suspended and supported by zip ties rather than properly mounted in a network rack.

The issue wasn't sophisticated.

It wasn't even technical.

But it highlighted a broader challenge that appears across many environments: small operational shortcuts often lead to larger reliability and security concerns over time.

If organizations cut corners on physical infrastructure, what other controls might be overlooked?

"We've seen critical network infrastructure literally hanging by zip ties."

‍

The Remediation Plan That Was Technically Completed

One of the most memorable stories didn't involve discovering a vulnerability.

It involved fixing one.

A large owner and operator of Class AA office properties had completed cybersecurity assessments across multiple buildings. Following the assessments, the organization elected to implement remediation activities using internal IT resources.

Two years later, 5Q returned to perform follow-up assessments.

While inspecting the environment, the team noticed several brand-new UPS units sitting neatly beside equipment racks.

Each UPS was plugged into the wall.

Nothing was plugged into the UPS.

After reviewing the original remediation report, the mystery was solved. One recommendation had been to install UPS devices to improve resiliency.

The equipment had been purchased and installed.

The final step simply never happened.

The story serves as an important reminder that remediation plans only create value when recommendations are fully understood and correctly executed.

"The remediation plan said 'Install a UPS,' and technically, that is what they did."

The Real Horror Is What You Don't Know

If these stories sound surprisingly ordinary, that's exactly the point.

Most cybersecurity incidents don't start with nation-state attackers or scenes from a Hollywood movie. They start with forgotten devices, default passwords, flat networks, shadow IT, missed configurations, and assumptions that nobody thought to challenge.

The most memorable cybersecurity stories rarely involve sophisticated hackers typing furiously in a dark room.

Instead, they involve overlooked vulnerabilities, weak controls, and risks that quietly exist for months or years before anyone notices.

That's why assessments matter.

A cybersecurity assessment isn't just about generating a report or checking compliance boxes. It's about uncovering risks before they become headlines, identifying blind spots before attackers find them, and providing organizations with a clear understanding of their security posture.

Because while Halloween only comes once a year, cyber threats never take a night off.