Many of the new security threats we face today, revolve around the apparent exposure and vulnerability of buildings and infrastructure to terrorist attacks. Yet little is known about the level of preparedness to deal with changes in terrorist strategies away from secured “hard” targets towards “soft” unsecured targets in the urban environment such as buildings, infrastructure and public spaces. This paper presents the findings of preliminary research into the risk management, crisis management and business continuity management practices of Facilities Managers responsible for a range of major public and private buildings in Sydney, Australia. The results suggest that Facilities Managers may underestimate the vulnerability of their buildings towards terrorist attack. They also point to a possible misconception about likely targets and inadequate systems for preventing and managing the occurrence and aftermath of a terrorist incident.