A security warning can name a software component that no one in the management team recognises, even though it runs inside equipment the business depends on. If the company cannot identify the actual device and its version, it cannot tell whether an update exists or who must act.
That is the practical challenge for Norwegian businesses with connected building controls, industrial equipment or other long-lived devices. Ask the equipment supplier for a product-specific answer, not just confirmation that the underlying software has been fixed somewhere in the supply chain.
What the research found
On 12 November 2026, security company Forescout described its research into networking software used in connected equipment. Its researchers built a specialised system combining AI models, conventional analysis tools and human supervision. Across ten software stacks, they report finding 99 vulnerabilities, including 66 they considered new. They reported 54 of the new findings to maintainers or vendors because they believed those still affected current versions.
A network stack is software that helps a device communicate over a network. A single stack can be incorporated into equipment sold under many different product names. A flaw in a component does not establish that every product using it is exploitable: the version, enabled functions, configuration and network access matter.
Forescout reports roughly ten hours of independent AI analysis and about 80 hours of dynamic validation. Its comparison with earlier manual work is not a controlled comparison of identical tasks. The reported cost excludes the work of creating the analysis system and infrastructure. The tool also rediscovered only 33 of 82 previously known findings in the comparison set. The result shows a useful research capability, not that AI detects every flaw or that these findings have been exploited in Norwegian businesses.
A real example: the answer differs by model
Siemens' advisory SSA-333035, published on 13 October 2026, lists vulnerabilities in specific APOGEE, TALON and Desigo building-control products. Siemens says the listed issues could allow an attacker to disrupt an affected device's availability. The October product advisory and November research report are different events; the advisory was not issued in November.
As checked on 14 November, Siemens lists updates for certain APOGEE PXC Compact and Modular variants. For some other listed models, including specified Desigo PXC/PXM versions, it says no fix is currently planned and recommends mitigations. The exact product, version and vulnerability determine the response. This is not a claim that every Siemens controller is affected or that any particular Norwegian installation has been attacked.
For the affected Desigo vulnerability CVE-2026-89208, Siemens recommends network segmentation and properly configured gateways or firewalls. For four other listed vulnerabilities it recommends disabling FTP and web services, noting they are disabled by default on the named product families. Those are product-specific recommendations, not a universal instruction to switch off all building connections.
Ask the supplier for an answer you can use
Imagine a Norwegian property company with a building automation system maintained by an external contractor. The company knows the name of the building system but not the models inside each control cabinet. This is a hypothetical example.
The property manager and contractor should agree on an inventory of the devices needed to operate the building, their exact product and software versions, locations, network connections and support status. NSM's guidance on mapping devices and software recommends maintaining such an overview, including firmware and unsupported equipment.
Then ask the contractor and manufacturer:
- Does this specific model and version appear in the advisory? If the component is embedded under another product name, can the manufacturer confirm its status?
- Is a device-level update available, tested and supported? A fix in a software library is not proof that an installed controller has received it.
- If no fix is planned or the answer is unknown, which reachable services and network paths need to be restricted? Who will test that alarms, maintenance access and safe operation still work?
- Who owns the temporary protection, how is its effectiveness verified, and when will replacement or another permanent solution be decided?
Record unanswered questions as open items. A lack of evidence that a device is affected is not the same as evidence that it is unaffected. Prioritise by exposure and the consequences of failure rather than trying to inspect every connected device at once.
Plan for equipment that cannot simply be patched
An isolated or replaced controller may be the right decision, but changing connections without the building operator can also interrupt alarms or access needed to maintain the system. Test the proposed change with the people responsible for safe operation and agree on a fallback. A genuinely disconnected system still needs controls for physical access, service laptops and removable media.
Remote maintenance can reduce travel time and speed up repairs. Removing an unnecessary direct internet path while retaining a controlled service route may be an appropriate compromise for some installations. For others, permanent disconnection or replacement may be more suitable. Choose based on the actual installation, and confirm that the intended protection works.
Management owns the inventory, supplier follow-up and decision on unresolved exposure. The board should ask whether critical unsupported equipment has an accountable owner, a funded plan and a review date. It does not need to choose firewall rules.
The decision is concrete: identify one important controller, obtain its exact support and vulnerability status, and decide what to do if the answer is still unknown. Connect this work to the guide to refrigeration continuity and security update priorities.
Sources checked on 14 November 2026. The property company and management process are hypothetical or the author's recommendations. The illustration is AI-generated.