Planning how to maintain operations in the face of a natural disaster is a smart step for facilities managers who are concerned that hurricanes, floods, wildfire, tornadoes and other weather events are getting stronger and more frequent. But as the economic, social, and geopolitical trends of 2026 come into focus, facilities managers might broaden their resiliency thinking to include other risks as well, building operations specialists say. 

“Whether the risk is weather related, energy or IT related, or even a bad actor, you’re going to have to think through the same processes,” Laurie Gilmer, president and COO of Facility Engineering Associates, said in an interview. “With any of these risks, you can have loss of power, loss of infrastructure.” 

Going into 2026, the best practice for facilities managers is to incorporate other types of risk into disaster preparedness as the U.S. sees heightened incidents of civil unrest and workplace violence along with rising energy insecurity. Even tariffs and rising prices for valuable metals, like copper, are adding to the insecurity mix by making building mechanical systems targets of thieves.

“The security [risk] situation has been increasing in the last 8-10 years — [especially] since COVID,” Michael Evanoff, chief security officer of cloud-based security company Verkada, told Facilities Dive. “Civility, rhetoric, radicalization of social media — it’s just a volatile landscape. Also add in mental health issues. It’s all coming together.”

Ensuring operational resilience now requires broader thinking. “It’s [protecting against] any kind of disruption,” Gilmer said.

“The only way you're going to survive [this environment] is if you've got a level of resiliency — resiliency in terms of how you build and operate your portfolios and facilities, but also in your teams,” Paul Morgan, global chief operating officer of real estate at JLL, said in an interview. 

These and other experts outlined the variety of risks they’re preparing for in 2026.

Weather risks

Insurance risk management company Sedgwick says it’s likely the U.S. will see at least one major hurricane this year, even though most of the hurricanes in the Atlantic last year never made landfall. “History reminds us that hurricane lulls never last long,” Andy McCallum, the company’s vice president of specialty operations, says in a post on the company’s blog.

In California, the state’s forestry and fire protection agency is predicting a bad fire season in the southern part of the state. “Above-normal large fire potential is forecast through December due to the combination of well-above-normal temperatures, well-below-normal precipitation, and normal-to-above-normal Santa Ana wind activity,” the agency says. 

Regardless of whether 2026 winds up being a big year for storms, funding cuts to the National Weather Service mean facilities managers could have less time to prepare for any weather emergencies that arrive. 

“Understaffing of NWS offices and degradation of infrastructure like weather radars [raise] questions about the adequacy of warnings,” Marshall Shepherd, a professor of meteorology at the University of Georgia and a former president of the American Meteorological Society, says in a Forbes commentary.

Resiliency in the context of extreme weather means relocating critical infrastructure to damage-resistant buildings, having backup power ready to go, communicating a plan for evacuating occupants and enabling employees to keep working remotely, among other things, Gilmer said. 

“It’s future-proofing,” she said. “Where is your mechanical equipment? Where is your electrical equipment? Is your critical infrastructure on the ground floor? What does that mean? Do we relocate [that equipment]?”

Energy reliability risks

Facilities managers can expect higher energy prices and potentially more or longer power interruptions this year as grids across the country deal with the strain of data center and other growth in demand as well as more extreme weather. 

“We forecast electricity consumption will grow by 1% in 2026 and 3% in 2027, marking the first four years of consecutive growth since 2005–07,” the U.S. Energy Information Administration says in a January press release. “The driving factor behind this surge is increasing demand from large computing centers.”

In its January 2026 update, the agency says the retail electricity price for all sectors at the end of 2025 was 13.63¢ per kWh, a 5.2% increase over the same time in 2024. 

More blackouts are expected to come with higher prices, according to reports. “AI data centers on the East Coast are gobbling up so much juice that nonprofit grid operator PJM may be forced to enact rolling blackouts on its customers during both heat waves and exceptionally cold weather just to protect the grid’s integrity,” a January Futurism report says. 

Allan Schurr, chief commercial officer at Enchanted Rock, which provides resiliency as a service, said his company is starting to see interest from operators of commercial buildings other than the kind of facilities it typically sees, like hospitals and manufacturing plants. 

“We have grocery stores [coming to us],” he said in an interview. “They want to be there for their customers when there’s an emergency.”

After the fire-related power disruptions California has faced in recent years, schools and municipal governments throughout the state are starting to install microgrids. The Ojai Unified School District, for example, deployed a solar and battery-powered microgrid at one of its high schools last year. “The microgrid will store up enough power to operate the school's gymnasium and kitchen during a blackout,” according to a story in the Ventura County Star. 

A typical resiliency plan, with renewable power as a focus, even for a smaller facility, is to have a battery storage system supplemented with solar, D.R. Richardson, CEO and co-founder of Elephant Energy, said in an interview. “You can start with … a little bit of rooftop solar and a little bit of battery,” he said. “That’s going to let you disconnect from the grid in periods of instability and uncertainty, so that’s the fastest way to get resiliency.” 

Physical security risks

In a sign of the times perhaps, three Florida school districts last year worked with a security company to put drones in their schools to act as first responders in the event of an incident.  

The drones first interact with an intruder via two-way communications and can fire pepper spray pellets and take other measures to keep the intruder off guard until law enforcement arrives, according to the company.

While that might not be the right security move for everyone, building operators should consider doing more than just relying on conventional security cameras in 2026, security specialists say. 

Facility managers will be hamstrung if they’re relying on analog cameras because those require someone to monitor video feeds if they want to stay on top of what’s happening, Verkada’s Evanoff said.

Smart cameras do the monitoring for the facility and send alerts when someone is seen loitering or trying to access the premises if they’re not supposed to. 

“If your building had a problem in the past with an individual, [you have] his picture on your list,” Evanoff said. “If that person tries to come on the property, the system alerts you on your phone.”

Companies selling smart security cameras are starting to offer systems that include other features, like two-way voice communications, incident disruptors like sirens, flashing red lights and the ability to fire pepper spray pellets or release smoke. 

“Ninety-nine percent of the time [this resolves the issue],” David Selinger, founder and CEO of security company Deep Sentinel, told Facilities Dive.  

Other measures organizations are adding to increase facility security include bullet-resistant glass, a second set of doors so intruders who breach the premises can’t access certain areas, weapons detectors and elevator shut-off buttons that approved staff can trigger. More organizations are also giving facilities and frontline staff panic buttons.

Cybersecurity risks

Building operators will increasingly have to consider not just physical security but cybersecurity because hackers are starting to see the vulnerabilities of HVAC, lighting and other building management systems as an easy-access door to an organization’s broader IT network, cybersecurity specialists say. 

These building systems were never designed to be secure, Troy Cruzen, virtual chief information security officer at Fortified Health Security, said in an interview last year on network risks posed by building systems. “They were just designed to provide HVAC [or other] capabilities,” he said. “That’s just the reality of hackers. They can leverage those vulnerabilities and make it a bigger deal than they were designed to be.”

Most building management systems today are cloud-based and link into an organization's network so the systems can send out real-time alerts and transmit data, enabling building operators to optimize the systems they oversee and generate reports. 

That’s been a boon to optimization efforts, but it’s creating a security headache for IT staff, according to a report by cyber-physical systems protection company Claroty. Some “75% of organizations are managing building management system devices with known exploited vulnerabilities," the report says. “Many of these systems do not support cybersecurity features, and direct connectivity to the enterprise network or public internet introduces new risks to the business.”

It’s typically not the role of facilities managers to lead network security, but the best practice today is for them to make sure their organization’s IT team knows what building systems are in place, what they do and how they connect to the network. 

“No one knows that facility better than the facility manager and their team,” Sean Tufts, field chief technology officer at Claroty, said in an interview. “So, they are the business. We cannot do anything without them.”

Cruzen says the most straightforward way for facilities managers to secure building systems is to work with IT colleagues to put them on a separate virtual local area network, or VLAN. If they do that, the system will still have connections to the main network, so it can send alerts and operate other functions that require connectivity, but access points are minimized. That means if hackers get access to the HVAC management system, they’re largely cut off from the main network.

“Isolating it takes it away from the front door and puts it more in the attic,” Cruzen said. “You have to come through the attic to get into the house.”

Facilities managers will have to work with IT to inventory all the building systems, identify how and where they’re connected, and figure out where the access points to the network should be, how many of them there should be and how that access should be created.

“There are predictions out there of these systems becoming more of a leveraged target,” Cruzen said. “As they become more of a focal point, you open a can of worms…. There are going to be some organizations that unfortunately get burned by this.”