Physical Security Meets Cybersecurity: One Team for Both

Your cameras, door controllers, and building systems joined the network years ago, and most org charts still haven't caught up to the fact that physical security and cybersecurity aren't two jobs anymore. Running them as one program is the fastest security upgrade most organizations can make, and here's why.

How Physical Security Became an IT Problem

Access control systems, video surveillance, elevators, HVAC, and building automation all moved onto the IP network, one upgrade cycle at a time. Many network cameras and controllers are embedded computing devices that need patching and access controls. IoT Analytics has forecast 21.1 billion connected IoT devices by the end of 2025.

The threat data treats them that way. In Microsoft's analysis of ransomware incidents, over 90% of attacks that reached the encryption stage used unmanaged devices as the entry point or the encryption path. The cameras and controllers nobody patches are the textbook unmanaged device. And Cloudflare reported a 5.6 terabit-per-second DDoS attack in October 2024 that came from more than 13,000 IoT devices.

This isn't a new risk, either. The 2013 Target breach that exposed 40 million payment cards started with credentials stolen from an HVAC contractor with network access. Building systems have been a door into the enterprise for a long time. The difference now is that there are more of them, and the teams responsible for them rarely talk.

The Convergence Numbers

What Two Silos Cost You

When physical security reports to facilities and cybersecurity reports to IT, three failure modes repeat across mid-market organizations.

Nobody owns the patching. Camera firmware updates aren't in the SOC's remit and aren't in the security integrator's contract. So they don't happen. An unpatched camera with default credentials on a flat network is a foothold waiting for a scanner.

Nobody owns the segmentation. The camera VLAN, the door controller subnet, and the badge system's server shouldn't share a path with payroll. When neither team owns the network policy, the flat network wins because it's the path of least resistance.

Nobody connects the incidents. A door controller that starts sending traffic to an unknown address looks like a nuisance to the security tech and invisible to the SOC. Attackers exploit exactly this gap: in H1 2019, Kaspersky blocked malicious objects on 37.8% of sampled building-automation computers, using telemetry from more than 40,000 sources.

With the average breach now costing close to $5 million, and more in the U.S., the cheapest control you can add is an org chart that connects the two halves of the attack surface.

What One Team Looks Like

In a 2022 ASIS Foundation survey, 60.5% of respondents reported full or partial convergence of security functions, including business continuity. This does not mean all had merged physical security and cybersecurity.

If you're building toward that model, the working parts look like this:

One architecture. Cameras and controllers get segmented network zones, zero-trust access policy, and the same monitoring discipline as any other device touching the network.

One policy. Device hardening standards, password policy, firmware cadence, and procurement rules, so a new camera can't join the network as a liability by default.

One risk picture. Door controllers, badge systems, and cameras live in the same risk register as firewalls and endpoints. A physical event with a cyber dimension (a door forced open at 3am paired with unusual badge activity) gets one investigation, not two notes in two systems.

One response plan. When a camera is compromised, it's an IT incident that happens to involve hardware in a hallway. Both teams practice it together, before it happens.

Five Questions to Ask This Quarter

• Who patches your cameras, and can they prove the last date it happened?
• Who owns the network policy for the camera VLAN and door controllers?
• Has your SOC ever seen a log from a badge system or a camera?
• Do your security integrator and IT security vendor have each other's phone numbers?
• If a door controller was compromised tomorrow, who would investigate it, and would they know?

If these questions have no owners, your attack surface has a seam down the middle, and seams are where breaches live.

Run It as One Program

Gage staff have spent decades on both sides of this line: installing and servicing the cameras, access control, and structured cabling that make up physical security, and running the network and cyber defense they live on. That's one team, one architecture, and no seam for an attacker to live in.

Call (254) 772-3400 or email info@gagetech.com to talk about closing the gap between your two security teams.