True, and a VPN in front of the same controllers gives contractors their remote access without a public login page. Forescout noted attackers need no malware here, since the system's own functions change temperatures, trigger defrost, and switch off alarms, and those changes can look like routine activity.