Let's demystify a question that rarely comes up in an investment committee meeting: if one of the software companies operating inside your buildings stopped accepting new integrations, changed its terms, or ended up in bankruptcy court next quarter, what would you still control?
For most portfolios, the honest answer is that someone would have to go find out. Several pieces of industry news from the past two weeks make that answer harder to defend, and taken together they point toward something asset managers should start treating as a written requirement across every property.
Four Signals Worth Reading Together
Thesis Driven reported that a major multifamily software platform is cutting off an AI leasing vendor's integration access. As described, the suspension applies to future integrations and new activations; it does not describe a shutdown of deployments that are already running. Even so, any owner who planned to roll that tool out to more properties now has a technology roadmap that depends on a decision made between two companies, and the owner is neither of them.
A few days later, Smart Building Insight covered Impact Infrastructure (Autocase/CarbonSight) in bankruptcy court, along with other developments among enterprise data and analytics vendors serving buildings. A bankruptcy filing on its own does not tell us what will happen to customer data or service. That uncertainty is exactly what matters to an owner, because the ability to keep using its own operating history becomes a question answered by a legal process and a set of vendor contracts.
On the architecture side, a Realcomm Live case study recorded at IBcon 2026 walked through a campus-wide modernization spanning BMS, IoT, energy management, sustainability, and fire/life safety, with a focus on aligning legacy systems with enterprise goals. Outside real estate, AWS is promoting re:Invent sessions on how financial institutions govern AI agents with safety controls, observability, and emergency shutdown in regulated environments.
Each item is ordinary news on its own. Read together, they describe one requirement: the systems inside a building have to keep working, stay secure, and remain usable by the owner regardless of what happens to any single vendor relationship. That is an operating standard, and most portfolios have never written one down.
Where the Dependency Actually Lives
Vendor risk usually gets discussed as a contract problem. In practice, it shows up in a handful of specific places, and each one is something you can inspect at a property this month.
The first is the interface. When a leasing tool, energy platform, or access control system exchanges data with your property management system, it does so through an integration that someone else may own and can switch off. If that interface is undocumented, nobody on your side knows what breaks when it goes away, or how long it would take to rebuild.
The second is credentials. Administrative logins to controllers, cloud portals, and network equipment are often held by the installer or the platform vendor. If that vendor becomes unresponsive, the owner may be unable to change a schedule, rotate a password, or grant access to a replacement contractor.
The third is operating history. Meter intervals, equipment trends, work-order records, and occupancy data accumulate inside vendor platforms year after year. If the export path is unclear, the history that would support a capital plan, a tax appeal, or a refinancing package sits in a system the owner cannot reach on its own terms.
The fourth is connectivity. Building systems frequently run on networks each vendor installed for its own purposes. Without segmentation, a compromise on one system can reach others. Without owner control of the network, replacing a vendor can mean rewiring a building.
AI adds a fifth: permissions. An agent that can read building data and act on it needs boundaries the owner defines, a record of what it did, and a reliable way to stop it. The financial-services framing in the AWS sessions is useful because regulated industries have already had to write those controls down. This does not establish that a breach has occurred in commercial real estate. It shows where governance expectations for automated systems are heading.
How This Reaches NOI and Asset Value
Asset managers rarely see these exposures as a line item, which is a large part of why they persist. The cost arrives indirectly, through a chain of effects that is worth tracing step by step.
When an integration is cut or a vendor fails, the first effect is operational: a workflow stops, staff revert to manual workarounds, or a replacement project starts under time pressure. The business effect is OpEx variance and a capital request nobody budgeted for. The economic consequence follows from the math every asset manager already runs. Recurring cost reduces NOI, and NOI divided by the cap rate is value, so an avoidable recurring cost becomes a capitalized loss at refinancing or exit.
Diligence is the second path. A buyer or lender who asks for several years of operating data and receives a promise to check with the vendor will price that uncertainty into the deal. In a lending environment focused on expense trajectory and DSCR resilience, documented, owner-accessible operating history is part of the credit story.
Fragmentation also shows up physically. In one PPP Review of a 400,000 SF office property, we found roughly $300K of redundant fiber infrastructure: parallel backbones nobody could explain, each under a different vendor's control. Nobody set out to waste that money. It accumulated because each vendor built its own path into the building and nobody owned the standard that would have prevented it.
Six Requirements for a Portfolio Operating Standard
The practical response is to turn continuity into requirements that appear in procurement documents, contracts, and acceptance criteria at every property. Here is the set I would start with.
Documented interfaces. Every integration between systems is listed, with what data moves, in which direction, and who can turn it off. If a vendor relationship ends, you know in advance which workflows are affected.
Owner-controlled credentials. Administrative access to every controller, portal, and network device is held by the owner or the owner's designated operator, and vendors receive scoped access that can be revoked.
Exportable operating history. Contracts specify the format, frequency, and completeness of data exports, and someone actually performs an export to confirm it works. History you cannot export is history you are renting.
Segmented connectivity. Building systems run on a single, secure, segmented foundation the owner controls, so each system is isolated from the others and a vendor change does not require new cabling.
Bounded permissions. Any automated tool or AI agent operates under permissions the owner defines, with logging of what it read and changed and a tested way to shut it off.
Tested recovery procedures. For each critical system, there is a written plan for what happens if the vendor disappears, and that plan has been rehearsed at least once. A recovery procedure that has never been run is a hope written in a binder.
None of these requirements depends on choosing a particular platform. They apply equally to the leasing tool you bought last year and the energy analytics product you will evaluate next year, which is what makes them a standard.
Mapping the Standard Through the PPP 5C™ Plan
The Peak Property Performance® framework organizes this work into five steps, and each requirement lands in a specific place.
Clarify is the PPP Review: define success metrics, map ownership, identify leakage, and document what is trustworthy and portable. This is where interfaces, credentials, and export paths get inventoried, property by property.
Connect establishes secure, owner-controlled connectivity that repeats property to property. BoT® (Building of Things®) is our approach to consolidating building connectivity onto a single, secure, segmented foundation, which addresses the segmentation and rewiring problems directly.
Collect captures and normalizes data into a consistent model you can reuse. This is where exportable operating history stops being a contract clause and becomes something you hold.
Coordinate governs identity, access, privacy, lineage, retention, and rules of use. Owner-controlled credentials and bounded permissions live here, inside Property Brain™, the vendor- and LLM-agnostic Property Intelligence Layer.
Control lets any decision engine, vendor platform, internal analytics tool, or LLM act under owner permissions. When the standard is consistent across buildings, Property Brain™ becomes Portfolio Brain™, and a vendor change at one property is a configuration task instead of a rebuild.
The first three steps form Layer 1, managed data & digital infrastructure. The last two form Layer 2, the owner-controlled intelligence layer. Recovery procedures span both, because continuity depends on the foundation and the governance working together.
If you don't own your data & digital infrastructure, your vendors do.
Where to Start
Start with one property. Run a PPP Review to inventory every interface, credential, export path, and network segment, and identify which systems would be hardest to recover if a vendor stopped responding tomorrow.
From there, establish Property Brain™ at that property and prove portability by connecting at least one decision engine under owner permissions. Then turn what you learned into the written standard: the six requirements, expressed as contract language and acceptance criteria. Apply it at the next acquisition, the next vendor renewal, and the next refinancing package, and the portfolio starts accumulating capability instead of dependencies.
Own your data & digital infrastructure. Build for the long game.
