Your cameras are on the network. Is your security team?

Physical security has quietly become an IT system

Walk through almost any modern office, school, warehouse or clinic and count the connected devices that exist to keep people and property safe. IP cameras. Door controllers and card readers. Intercoms. Motion and environmental sensors. Alarm panels. Visitor management kiosks. Cloud dashboards viewed on a phone.

Ten or fifteen years ago, most of that equipment sat on its own isolated network, installed and maintained by a security contractor who rarely spoke to the IT team. Today it runs on the same network as your finance system, authenticates against the same cloud platforms and is often managed from the same laptop that checks email.

Physical security has become an IT and cyber system. The trouble is that many organisations still govern it as if it were a building maintenance item.

On site assessments, it is common to find cameras and door controllers running outdated firmware, default passwords that were never changed, devices exposed to the internet for remote viewing, and access control databases full of former staff and contractors. None of these issues are exotic. They persist because physical security and cyber security are owned by different people, budgeted separately and reviewed on different timelines, if at all.

Where the convergence risk sits

When physical and digital security are managed in silos, gaps open up between them. Attackers, and sometimes just opportunists, are very good at finding gaps.

Connected devices as an entry point. An unpatched camera or door controller is a computer on your network. If it is poorly configured, it can be used to watch, to disrupt or as a foothold to move towards more valuable systems.

Identity that does not line up. Someone leaves the organisation. Their Microsoft 365 account is disabled that afternoon, but their access card still opens the building for months. Or a contractor has a card for every floor when they only need one. Physical access is identity, and it deserves the same lifecycle discipline as digital access.

Monitoring in separate rooms. The SOC sees a suspicious login from an unusual location. The physical monitoring team sees a door forced at the same site the same night. If those two events are never connected, the story is missed.

Physical routes to digital harm. A tailgater in the server room, a rogue device plugged into a meeting room port, or a stolen laptop from an unlocked office can undo years of cyber investment. Cyber controls assume the building is secure. That assumption needs testing.

Privacy and compliance exposure. Video footage and access logs are personal information. Where it is stored, who can see it, how long it is kept and which cloud platform it sits on all matter under the Privacy Act ↗ and to the people being recorded.

From protecting sites to operating resilient environments

I believe the physical security industry is at a turning point, and the conversation needs to move on from hardware.

For a long time the question was, "How many cameras do we need, and where?" That question still matters, but it is no longer the most important one. The better question is, "How do we know what is happening across our environment, and how quickly can we respond?"

Three shifts are driving this.

Security is becoming intelligent. Modern cloud-managed platforms such as Verkada, combined with video analytics, turn cameras from recording devices into sensors. They can flag a person in a restricted area after hours, a vehicle that should not be there, or a door propped open, and alert someone in real time. The value is no longer in hours of stored footage nobody watches. It is in the event that gets noticed while it can still be stopped. That brings responsibility too: analytics must be deployed with clear purpose, strong privacy controls and respect for the people in the frame.

Security is becoming a service. Organisations increasingly want outcomes, not equipment. They want to know their sites are monitored, their devices are healthy, their access lists are accurate and someone is accountable when an alarm goes off at 3am. That is an operating model, not a project that ends at commissioning.

Security is becoming converged. The organisations I see leading are the ones that stop treating physical, cyber and IT as separate kingdoms. They design identity once, so a single joiner and leaver process controls both the laptop and the front door. They put security devices on segmented, well-managed networks. They bring physical and digital events together so their teams see the whole picture.

None of this requires a big-bang transformation. It requires a shift in mindset: physical security is part of how the organisation operates, not a line item in the fit-out budget.

Six questions every leader should ask

If you are responsible for the safety of people, sites or assets, these questions are a good place to start:

1. Who owns physical security risk in our organisation, and does that person talk to the IT and cyber teams?
2. Do we have an up-to-date inventory of every camera, controller and sensor on our network, and are they patched?
3. When someone leaves, how quickly is their building access removed, and is that process linked to their digital access?
4. Are our security devices on a segmented network, or sitting alongside everything else?
5. Who is watching when an alarm or event occurs out of hours, and how quickly do they act?
6. Where is our video footage stored, who can access it, and how long do we keep it?

If any of those are hard to answer, you are not alone. They are exactly the questions that fall between teams.