How defense requirements are creating a security model where physical protection, identity and cybersecurity increasingly operate as one system

Lockheed Martin, RTX, Boeing, Northrop Grumman and General Dynamics sit at the center of the U.S. defense industrial base. Collectively, these “Big Five” have historically accounted for roughly 30% of Department of Defense contract obligations.

Their security challenge extends well beyond protecting factories, offices and research facilities. These companies safeguard classified programs, intellectual property, manufacturing operations, connected operational technology and people — often across organizational and physical boundaries. Employees may work inside government facilities and access government systems, while suppliers and subcontractors operate as extensions of defense programs.

Security, in other words, does not stop at the facility boundary.

For the defense industrial base, the perimeter increasingly follows the mission.

How Defense Security Requirements Shape Operations

The Defense Counterintelligence and Security Agency (DCSA) administers the National Industrial Security Program, overseeing approximately 12,500 contractor facilities cleared to access classified information.

For these contractors, rigorous security compliance is foundational to operational resilience and the ability to support the defense mission. DCSA conducts recurring security reviews examining internal processes, vulnerabilities, corrective actions and whether safeguards effectively address threats facing the facility.

Cybersecurity brings another set of requirements. DFARS, the Cybersecurity Maturity Model Certification (CMMC), NIST standards and DoD cybersecurity policies govern how contractors protect government information and systems. DISA standards and technical guidance further shape how systems operating within or connecting to DoD environments are configured and protected.

What matters operationally is how these requirements translate into everyday decisions: who and what can enter, where they can go, which systems they can use, what information they can access and whether that access should continue.

That is where physical and cybersecurity begin to converge.

Defense Contractor Security: When Employees Cross the Perimeter

Defense contractor employees regularly work inside government facilities, crossing organizational and physical boundaries while supporting the same mission.

Consider a defense contractor engineer assigned to work at a DoD facility. The employee may require a government-issued Common Access Card (CAC), appropriate security clearance and specific authorization to enter the facility and access the information and systems required for the assignment.

That creates responsibilities on both sides of the relationship.

The contractor expects its employee to understand and comply with the host organization’s security policies and procedures. At the same time, the organization controlling the facility is responsible for the security measures governing that environment.

The employee has crossed a property line, but security responsibility does not stop at the gate.

This raises a broader issue for critical infrastructure organizations: as employees, contractors and service providers routinely work across organizational boundaries, whose perimeter are they operating within, and where does responsibility for protecting them begin and end?

Physical and Cybersecurity Convergence in Defense

The most significant lesson from the defense environment may be what happens when physical security, identity and cybersecurity stop functioning as independent disciplines.

DoD’s Zero Trust strategy is built around continuously evaluating access to resources. Identity, credentials, device status, authorization, behavior and operational need can all inform whether access is granted — and whether it should continue.

DoD is also automating Identity, Credential and Access Management processes so that changes in an individual’s authorization can result in corresponding changes to system access. Its guidance for operational technology brings identity and access control, device inventories, network segmentation and protection of physical operations into the same security discussion.

Consider a simple example. An employee’s identity and credentials can help determine whether that individual should be at a particular location and whether access to associated networks, applications or systems is appropriate. When identity, physical presence, device status and authorization can inform one another, previously separate security controls begin operating as a connected process.

The security question evolves from “Can this person enter?” to “Who is this person, where are they, what are they authorized to do, what device are they using and should access continue?”

That is what physical and cybersecurity convergence look like at the operational level.

The Perimeter Follows the Mission

The defense industrial base should not necessarily be viewed as a model that every commercial organization can—or should—duplicate. Its security environment is driven by national security requirements, classified information and threats that exceed those facing many enterprises.

But it demonstrates where perimeter security can go when policy, technology and operational processes are tightly connected.

The physical perimeter remains essential. So do cameras, intrusion detection, fencing, gates and access control. But they increasingly become components of a larger security architecture encompassing people, identities, devices, information, networks, operational technology and the mission being protected.

The fence still matters. It just isn’t where the perimeter necessarily ends.

Smart perimeters and buildings still depend on a secure door opening

Security technology and artificial intelligence is becoming extraordinarily capable of detecting threats, evaluating risks, and making decisions. But none of those decisions matter if the physical opening cannot reliably execute them. AI doesn’t stop intruders. Properly secured openings do. That simple truth defines what might best be called the Hierarchy of Trust in Physical Security.

The Hierarchy of Trust

Modern physical security isn’t built upon a single technology. It is built upon layers of trust. Each layer depends entirely on the one beneath it. When one fails, every layer above it becomes significantly less valuable.

The hierarchy looks something like this: AI Detects → Access Control Decides → Electrified Door Hardware Enforces.

AI Doesn’t Replace the Fundamentals

Much of today’s marketing suggests buildings are becoming autonomous. To some extent, they are. Agentic AI will continue assuming greater responsibility for monitoring, investigating, and coordinating security events. Robotic patrols will become more common. Predictive analytics will improve. Video intelligence will become increasingly accurate.

All of these developments deserve attention. None of them eliminate the need for dependable physical security. In fact, they increase it. As buildings become more automated, confidence in physical enforcement becomes even more important. The smartest AI in the world cannot compensate for a door that fails to latch, a lock that isn’t code compliant, improperly specified hardware, or an opening that cannot reliably remain secure. The security industry doesn’t have to speculate about this principle. Recent events have already demonstrated it.

Social Engineering Still Defeats Technology

The 2025 Verizon Data Breach Investigations Report found that human factors—including credential abuse, phishing, and social engineering—remain among the most common contributors to security breaches.¹

Increasingly intelligent systems do not eliminate human vulnerability. That’s why physical security still matters. Even if attackers obtain digital credentials, properly configured access control systems, secured openings, and layered physical security continue limiting what they can actually accomplish inside a facility.

AI Can Be Fooled

Researchers and standards organizations continue evaluating vulnerabilities in facial recognition technologies through presentation attacks, including high-quality photographs, masks, deepfakes, infrared illumination, and other spoofing techniques. While today’s systems have improved substantially, no biometric technology should be considered infallible on its own.² ³

This isn’t an indictment of AI. It’s a reminder that authentication should never rely on a single layer.

Even when biometric systems make incorrect decisions, properly designed openings can require additional authentication, credential validation, anti-passback logic, or human verification before the door unlocks. The lesson is clear: AI should strengthen layered security—not replace it.

 Robots Can’t Secure a Door

Security robots have become increasingly common across corporate campuses, healthcare facilities, and commercial properties. They patrol. They collect data. They provide awareness. They deter opportunistic behavior through visibility. What they cannot do is physically secure an opening.

Like AI video analytics, autonomous patrol robots contribute valuable intelligence. But when unauthorized entry must actually be prevented, the responsibility still belongs to properly specified electrified locking hardware integrated with proven access control systems.^4,5

A Valid Metaphor

Artificial intelligence is identifying suspicious behavior before humans notice it. Agentic AI platforms promise to autonomously investigate alarms, dispatch responses, and coordinate security operations. Intelligent cameras classify threats in real time. Security robots patrol campuses without fatigue. Digital twins simulate building vulnerabilities before they happen. Access control platforms increasingly make intelligent decisions based on occupancy, identity, behavior, and risk.

It’s an exciting time for the physical security industry. But amid all the excitement surrounding AI, one uncomfortable question often goes unasked: Who—or more accurately, what—actually secures the door?

Imagine climbing into an autonomous vehicle equipped with every conceivable technology. Lidar continuously maps the environment. Cameras provide 360-degree vision. AI predicts traffic patterns and avoids hazards. Redundant processors make thousands of decisions every second.

Then the vehicle refuses to move. Not because the AI failed. Because it has no wheels.

An autonomous vehicle without wheels cannot move, regardless of how advanced its artificial intelligence may be. Likewise, an AI-powered building cannot secure itself unless the physical door opening can reliably enforce every security decision. It requires dependable mechanical systems capable of translating decisions into physical reality.

AI Knows

Artificial intelligence has fundamentally changed situational awareness. Video analytics can distinguish between people, vehicles, animals, and environmental events with remarkable accuracy. Large language models are beginning to summarize incidents for operators. Agentic AI platforms can correlate information from multiple systems and recommend—or even initiate—responses. Cameras no longer simply record events; increasingly, they interpret them.

Research firm MarketsandMarkets projects that the global AI in physical security market will continue experiencing strong double-digit annual growth throughout the remainder of the decade as organizations seek greater operational efficiency and faster threat detection.⁶

These technologies are valuable. They reduce nuisance alarms. They improve operator efficiency. They shorten response times. But AI performs one function exceptionally well:

It knows. Knowing, however, is not the same as securing. An intelligent camera can recognize an unauthorized individual approaching a secured entrance. It still cannot physically prevent entry.

Access Control Decides

Once AI identifies a potential threat, access control systems determine what should happen next. Should the credential be accepted? Should the opening remain locked? Should additional authentication be required? Should security personnel receive an alert?

Modern access control software makes increasingly sophisticated decisions by incorporating schedules, occupancy levels, identity verification, mobile credentials, visitor management systems, and even AI-generated risk assessments.

These systems are becoming extraordinarily intelligent. But decision-making is still only part of the equation. Every access control decision ultimately asks one final question: Can the opening actually enforce this command?

Without dependable electrified hardware operating exactly as intended, even the smartest access control platform becomes little more than a recommendation engine.

Every intelligent access decision ultimately depends on reliable hardware to enforce it.

Not Just Intelligence, Proven Principles

Artificial intelligence will unquestionably reshape physical security.  Buildings will become smarter. Operators will become more efficient. Threat detection will become faster. Security decisions will become increasingly autonomous. None of these developments reduce the importance of the physical opening. If anything, they elevate it.

As industry professionals, we’ve long believed that innovation should strengthen—not replace—the proven engineering principles that make buildings safe and secure. Artificial intelligence can enhance awareness, accelerate response, and improve operational efficiency. But every intelligent decision must ultimately be translated into reliable, code-compliant action at the opening.

That responsibility still belongs to properly engineered electrified hardware designed to perform every time, under every condition. Because after every credential is presented…After every AI model evaluates risk…After every access control platform makes its decision…One question still determines whether the building is truly secure:

Will the door actually stay locked? If the answer is no, every layer above it is simply software making promises. Just as an autonomous vehicle cannot move without wheels, the autonomous building still needs a lock.

By Kerby Lecka, Marketing Director at SDC–Security Door Controls and Member of the DHI Media + Editorial Board. Email: kerby@sdcsecurity.com.

 

Photos and illustrations courtesy of SDC

Footnotes

1. Verizon. 2025 Data Breach Investigations Report (DBIR). Identifies credential abuse, phishing, and social engineering as persistent contributors to organizational security breaches.
2. National Institute of Standards and Technology (NIST). Face Recognition Vendor Test (FRVT): Presentation Attack Detection (PAD). Ongoing evaluations of commercial facial recognition systems against presentation and spoofing attacks.
3. ISO/IEC 30107-3: Information Technology—Biometric Presentation Attack Detection—Testing and Reporting. International standard for evaluating biometric system resilience to spoofing attacks.
4. Cybersecurity and Infrastructure Security Agency (CISA). Physical Security Performance Goals. Recommends layered security architectures in which detection technologies are paired with effective physical barriers and access control measures.
5. NFPA 101®, Life Safety Code®, and the International Building Code® (IBC). Establish nationally recognized requirements governing electrically controlled egress, fire-rated openings, accessibility, and life safety, underscoring the need for code-compliant electrified locking hardware as the enforcement layer of modern access control systems.
6. MarketsandMarkets. AI in Physical Security Market – Global Forecast to 2030. Market analysis projecting sustained growth in AI-driven physical security technologies.

Edge intelligence, cloud, hybrid architectures and service assurance are changing the video lifecycle

Security video has two fundamental jobs.

See it live. See it later.

The first is operational. Something is happening now. A person crosses a perimeter, a vehicle enters a restricted area or another defined event occurs. Analytics can identify and classify the activity, generate an alert and present live video to an operator who can verify the event and determine what happens next.

The second job begins with a different question:

Can I get the video I need when I need it?

Increasingly, “See It Later” doesn’t mean returning to the recorder where the video was originally captured. Video can be retained across edge, local and cloud storage, protected against loss, searched remotely and made available to authorized users wherever they are.

The traditional calculations still matter: number of cameras, resolution, frame rate, bitrate and required retention period. But the measure of video storage is no longer simply whether the video was recorded. It is whether the right video is still there, protected and accessible when it matters. That raises a broader set of questions:

• What video must be retained? For how long?
• Where should it reside?
• Who should be able to access and share it?
• How will it be protected against loss or alteration?
• And can the organization verify that the required video was actually recorded and retained?

Those questions closely align with current industry guidance. The Security Industry Association’s 2025 Data Privacy Code of Practice for Video Surveillance calls for limiting storage to what is reasonably necessary or legally required, controlling who can access retained images, protecting stored and transmitted video and maintaining the integrity of video and associated metadata. ONVIF Profile G provides an interoperability standard for recording, storage, search and retrieval at the device and network level.

The result is a new way to think about the video lifecycle.

See It Live

The operational path doesn’t have to pass through recording first.

Today’s cameras and sensors can analyze information as it is captured. Motion detection, object classification, license plate recognition, thermal analytics and AI can identify activity that meets predefined criteria and triggers an event.

For an active perimeter application, the operational path can look like this:

Recording and storage happen simultaneously in the background.

This distinction matters. A security operations center does not need another screen continuously displaying an empty fence line. It needs to know when something relevant is happening and have the right video presented quickly enough to make a decision.

SIA’s 2025 privacy guidance also recognizes the operational role of AI-powered video systems in identifying people, vehicles, objects and events and generating alarms for rapid response.

The value of the live stream is operational immediacy. But while the operator is responding, another process is underway. The video is becoming a record.

See It Later

Recorded video has a different mission.

For recorded video, the challenge shifts from capture to retention, protection and retrieval. The recorded video path becomes:

Video can be recorded continuously or in response to motion, analytics or another event. Pre-event buffers can preserve what happened immediately before an alert. Routine video can remain at the edge until it is overwritten. Important events can be moved to centralized or protected storage. Evidence can be preserved according to specific retention policies.

Increasingly, stored video can also be searched rather than simply watched. Video analytics and associated metadata can help investigators find people, vehicles, license plates, objects and events without manually reviewing hours of footage.

Accessibility also matters. The person who needs the video may be somewhere other than the location where it was originally recorded.

The modern storage objective becomes deceptively simple:

Keep the right video. Protect it. Find it quickly.

Where Does It Live?

There is no longer one answer.

Video can reside at the camera edge, on an NVR, on local or enterprise storage systems, in the cloud or across several locations simultaneously.

These aren’t simply competing technologies. Each option serves different storage requirements.

Axis Communications, for example, describes surveillance storage in terms of primary, redundant, backup and failover storage. Primary storage supports everyday recording and access. Redundant storage duplicates data to maintain availability. Backup storage protects recordings and supports recovery, archiving and compliance. Failover storage maintains recording when primary infrastructure becomes unavailable.

That is a useful framework because it shifts the conversation from where storage is located to what the storage is expected to accomplish.

At the Edge

Edge storage places recording on or near the camera.

It can reduce bandwidth requirements, provide local resiliency and allow recording at locations where continuous network connectivity cannot be guaranteed.

It can also serve as primary or failover storage, maintaining recordings if a network connection or upstream recording system becomes unavailable. ONVIF Profile G similarly supports IP cameras that record either across the network or directly on the device itself.

That makes edge storage particularly relevant to remote perimeter locations, temporary sites and communications-constrained environments.

On-Premises

The NVR, recording server and enterprise storage array aren’t disappearing.

For organizations with high camera counts, continuous recording requirements, ample local bandwidth or a need for direct infrastructure control, on-premises storage can still provide high performance and immediate access.

The change is that on-premises no longer necessarily means on-premises only.

Local storage can now be one layer of a broader architecture.

In the Cloud

Cloud storage addresses another set of requirements: scalability, centralized access, geographically distributed sites, off-site protection and retention without continually expanding physical storage at every location.

It also expands accessibility. Authorized personnel can retrieve or share video without necessarily being connected to the physical location where the recording originated.

Cloud doesn’t eliminate video-storage design decisions. It changes them. Moving high-resolution video off-site can make bandwidth an important consideration, while remote accessibility increases the importance of cybersecurity, permissions and controls governing who can view, share or delete recordings.

Data residency and chain of custody also become important design and procurement questions. Security RFPs commonly ask where cloud infrastructure is physically located and whether video or associated data will ever be stored or processed outside the United States. That is a data-residency question. For evidentiary video, organizations may also require an auditable record of who accessed, transferred or altered a file to demonstrate its integrity and chain of custody.

Cost and accessibility are equally important. Cloud storage shifts more of the storage expense toward a recurring service model, and not every recording needs the same level of immediate access. Frequently accessed video may warrant higher-performance storage, while older footage retained for compliance or evidentiary purposes can potentially move to lower-cost archival tiers.

The design question therefore becomes not simply whether to use cloud storage, but which video belongs there, where the cloud is located, for how long the video should remain there and at what level of accessibility.

Hybrid: Different Video, Different Places

Hybrid storage represents a significant shift because it removes the assumption that an organization has to make one storage decision for everything.

Video can remain local for performance and immediate access while another copy is protected elsewhere. Recent footage can reside in higher-performance storage while older recordings move into lower-cost archives. Remote sites can record at the edge while centralized personnel access video through cloud services.

Some platforms now allow organizations to initially record video on-premises and then automatically move archives into different cloud-storage tiers as the recordings age. Frequently accessed video can remain in higher-performance storage, while older footage retained for longer periods can move into lower-cost tiers. That is a major departure from simply sizing one storage array for a set number of cameras and retention days.

Storage can now follow the value and required accessibility of the video over time.

How Compliance Shapes Video Storage

Retention isn’t always a security department preference.

Legal requirements, evidence policies, organizational policies, contracts and regulatory or compliance obligations can determine how video must be handled.

Privacy can create a competing requirement.

SIA’s current video-surveillance guidance recommends retaining footage only as long as reasonably necessary or required by law, restricting access to retained images and protecting stored data against unauthorized modification or disclosure.

Modern storage infrastructure may have to accomplish two seemingly opposite objectives:

Make sure required video remains available—and make sure video that should no longer be retained doesn’t remain indefinitely.

GDPR provides a prominent example. Because identifiable surveillance video can constitute personal data, its storage-limitation requirements generally call for retaining that video no longer than necessary for the purpose for which it was collected, subject to applicable legal and evidentiary requirements.

The compliance question is:

Are we applying the correct retention, access and protection policy to the right video?

Then comes the question that can make every other storage decision irrelevant:

Is it working?

A camera appearing online does not necessarily mean the complete video path is operating correctly.

A failure can occur at the camera, network, recorder, server or storage layer. Configuration issues can reduce retention periods, recording can stop, storage can fill and network interruptions can prevent video from reaching its intended destination.

Too often, the problem isn’t discovered until someone needs the video.

That creates another requirement: service assurance.

Rather than waiting for someone to discover missing video, service assurance continuously diagnoses the operation of the video infrastructure, identifies downtime and recording failures, and alerts the organization so the problem can be addressed.

This adds a fourth question to the video lifecycle:

See It Live. See It Later. Where Does It Live? Is It Working?

Matching Video Storage to the Mission

There is no single next-generation video storage architecture that fits every organization..

A remote perimeter camera may need edge storage because communications cannot be guaranteed. A large facility may need high-capacity local recording. A distributed enterprise may prioritize centralized cloud access. Critical video may require redundancy or off-site backup. Older recordings may move into lower-cost archives. Law enforcement video may become managed digital evidence.

One organization may need several of these approaches simultaneously. The storage discussion should begin with the mission rather than the hardware.

See It Live: Can the system recognize an important event and put the right live video in front of someone who can act?

See It Later: Will the right video still be there, protected and accessible when someone needs it?

Where Does It Live? Which combination of edge, local, enterprise, cloud, archive and evidence storage best meets the requirement?

Is It Working? Can the organization verify that the video infrastructure is operating and that required recordings are actually being retained?

The traditional video storage question was largely about capacity:

How many cameras can we record for how many days?

That question hasn’t disappeared.

But the more important question today is:

Can we be certain the right video will be available, protected and accessible when we need it?

That is the new measure of modern video storage.

What’s New in Video Storage?

These products illustrate how manufacturers and technology providers are addressing different parts of the modern video-storage lifecycle.

Why “who are you?” is becoming the question at every digital and physical doorway

The Who’s 1978 classic rock anthem “Who Are You,” written by Pete Townshend and sung by Roger Daltrey, asks a question that gets right to the heart of the identity industry: Who are you — and how do we know you are who you say you are?

I got a crash course in the past, present and future of Identity & Access Management (IAM) when I took my first opportunity in the digital identity space.

In early 2021, when I entered the ID Verification (IDV) market while we were still in the middle of COVID,– and VC companies were pouring billions into digital identity proofing companies like Jumio, Socure, ID.me to help identify online personal and business transactions while the world was stuck at home.

I began speaking and moderating panels — in-person and masked up — at security events, across government (TSA, DHS S&T, Identity Week), air travel/hospitality (FTE), banking (Money 20/20), healthcare (HIMSS) and digital identity (Identiverse + Authenticate).  As I sat in those rooms, I kept wondering: if companies can authenticate who you are throughout the digital world, why aren’t we authenticating identity at every perimeter and doorway in the physical world? Your identity shouldn’t be divided into two worlds.

From Digital Identity to the Physical Perimeter

Why isn’t the traditional physical security industry — where I’d spent the previous 20 years — investing more heavily in bringing IAM technology into physical security operations?

Aha! This was my Richard Dreyfuss Close Encounters moment — except instead of aliens, I’d discovered the potential for zero trust at the physical perimeter.

I began using the term AID2entry to describe what “converged access” meant to me. Today, I tell people AID2entry is just like what happens when you go through TSA or Clear at the airport. If you choose to participate and provide consent, it can be a mobile, touchless, frictionless experience. And pretty soon you may start seeing this technology used at your doctor’s office, bank, school, hospital or workplace — should you choose to opt in.

In 2022, I began creating speaking panels at the major North American physical security events, including GSX and ISC East/West, to highlight biometrics and digital identity, bringing consultants, integrators, end users and vendors onstage to discuss biometrics and digital identity for physical access.

Laws like Illinois’ Biometric Information Privacy Act (BIPA) have made the state a focal point in the debate over biometric privacy and identity. As a resident of the state, I became passionate about the topic. Through AID2entry events in Illinois, I’ve had the opportunity to participate in those conversations with policymakers, lawyers, end users, and privacy and security professionals. As AI and identity technologies become increasingly embedded in everyday life, these issues increasingly warrant attention at the federal level.

Identity & Access Management: Fence Defense for Physical and Cyber IAM

Identity and Access Management (IAM) has traditionally focused on confirming “who you are” in the digital world. So, what are the most immediate opportunities to bring “who are you?” from the digital world to the physical perimeter? The encounter is closer than you think!  Think about it in these terms:

One Identity: You Are the Credential

What if a company could issue an employee or visitor a mobile credential, badge, fob, wearable or QR code that provided access to digital resources — workstations, applications and networks — as well as physical spaces such as gates, doors, buildings, elevators and rooms?

Even better, with consent, what if identity could be verified using patterns or signals inherent to you and detected by a sensor, such as an existing video camera?

This is where I believe we are headed — toward security that can be both more convenient and more secure, while making it more difficult for bad actors to gain unauthorized access in either the digital or physical world.

Digital + Physical = Converged IAM

Physical Access Control Systems (PACS) and logical IAM systems increasingly share identity data and authentication policies. This is one of the most interesting security conversations happening today. With deepfakes and technologies such as automated license plate recognition now mainstream, identity is a topic you can discuss with almost anyone. My conversation starter goes something like this: “Do you have a REAL ID or passport? Have you traveled on a commercial airline and gone through TSA?”

Very soon we will start seeing this type of converged identity in enterprise security applications.

Identity becomes the key to securing the online + physical enterprise perimeter — Instead of treating the physical perimeter and network perimeter as two separate entities, security organizations can manage both perimeters through a trusted identity source of employees and approved guests/visitors — whether on a device, at the edge, in the cloud or behind a firewall on the network. Cameras and other identity sensors can increasingly act as readers, helping confirm that you are who you say you are.

Zero Trust moves into the physical world — It seems strange that the physical security industry hasn’t adopted the same concepts used in IT departments to protect against cybersecurity threats. The same concept of continuous verification used on company networks can be applied to physical doors and entryways. Security and IT can work together to give employees and visitors the access privileges they need while monitoring risk and keeping “humans in the loop” to make real-time access decisions that protect the enterprise.

Lifecycle management: driving the car while you are fixing it — Security never sleeps. Keeping enterprise PACS and video systems current can help you make your existing infrastructure do new things while staying ahead of evolving threats. Over time, lifecycle upgrades can add capabilities such as AI, mobile access and biometric integrations without requiring a complete rip-and-replace of the existing system.

When a person joins, changes roles or leaves a company, their physical and digital permissions can be updated or revoked together.

Upgrading PACS and video systems can take this further by adding AI and biometric capabilities, including liveness detection, to “the other side of the reader” at the doorway or desktop.

Passive + active signals for converged access — One of the most interesting possibilities in converged access is the use of passive signals that require no user interaction but are extremely accurate. Examples of passive signals include behavioral, device, location, and biometric signals from an identity system into an enterprise’s PACS access control system. Layering digital identity signals with physical and mobile credentials, passkeys, PINs and digital wallets can potentially support both physical and digital access.

Identity Is Redefining the Security Perimeter

The next generation of IAM won’t distinguish between a computer login and a door opening.  Both are identity decisions surrounding the person, device, permissions and applications involved across the digital and physical enterprise.

The perimeter isn’t just the fence, door or network anymore. It is the point at which the most critical identity decision occurs. And when the decision to grant access happens at the perimeter — rather than at the front entrance or lobby — security teams have more time to identify and respond to potential risks.

The smartest perimeter may be the one that knows who you are before you reach the door.

By Doug OGorden

 

How intelligent video monitoring tools provide a cost-effective way to improve security and operations

Every second counts when a security threat emerges, yet traditional surveillance still relies heavily on on-site guards and constant human oversight. This dependence not only drives up operational costs but also puts staff in harm’s way during high-risk incidents, especially when confronting potentially aggressive individuals. As threats evolve, organizations are seeking ways to strengthen security without depending solely on in-person guarded protection.

Modern strategies for remote monitoring can reduce the need for continuous human involvement, while intelligent, cloud-powered video solutions relieve security teams of routine tasks, freeing them to focus on higher-value responsibilities that improve overall safety and operations.

Challenges of Manual Surveillance

Organizations have traditionally relied on security guards and monitoring teams to surveil facilities, respond to incidents, and keep people and assets safe. While human oversight remains an important component of surveillance, it brings notable complexities that can affect both productivity and safety.

Employing a security staff complete with on-site guards requires significant resources. Overnight or weekend shifts often result in substantial salary expenses and overtime payments. In many cases, multiple staff are needed to ensure complete coverage and reduce the possibility of blind spots, further driving up operational costs. As many organizations struggle to fit these costs into tightening budgets, finding solutions that are more cost-effective while still providing complete security coverage becomes vital.

No matter how skilled or dedicated security staff may be, on-site personnel can only monitor a limited area at a time, inevitably leaving blind spots and vulnerabilities. This becomes further complicated for remote, low-traffic sites that need continuous coverage but cannot justify round-the-clock physical guarding. These realities highlight the need for alternative security approaches that can ensure round-the-clock vigilance.

On-site security roles inherently involve personal risk, especially when dealing with potentially aggressive or violent individuals. In high-tension situations, security personnel can quickly become the focus of confrontation, and incidents can escalate suddenly, leaving little time to react. Beyond the immediate danger, these encounters can have lasting effects on a guard’s well-being. Even the most experienced and well-trained security professionals operate in unpredictable environments where safety cannot be guaranteed, underscoring the need for monitoring approaches that can manage threats effectively without requiring constant physical presence.

Enhancing Operations with Intelligent Video Monitoring Tools

Intelligent video monitoring tools (including active deterrent cameras, video analytics, multi-region analytics, virtual arm/disarm, and two-way audio) can alleviate the burden on security teams by providing additional, cost-effective layers of monitoring.

These tools work together to provide a comprehensive security network across a facility, helping ensure a building remains protected even when a guard isn’t present, and allowing security teams to respond proactively to threats without putting themselves in harm’s way.

Automated Remote Management

Virtual arming and disarming capabilities within a cloud video platform unlock new flexibility for remote security management. This approach allows a location to be armed or disarmed from any device, anywhere, rather than relying on a traditional intrusion alarm panel. Operators can set an armed state tied to specific events, cutting down on noise and limiting false alarms. Location schedules can also be implemented so facilities arm automatically when needed, ensuring personnel respond solely to critical incidents rather than unnecessary alerts.

Proactive Threat Deterrence

Active deterrent cameras are programmed to activate a bright light when specific events occur, such as the detection of a person or vehicle, discouraging unwanted activity. In cases of attempted break-ins, trespassing, or vandalism, the sudden light, combined with the awareness of being recorded, can prompt offenders to abandon their actions and leave the premises. Strategically placed in high-risk areas, these cameras can serve as an alternative to a physical security presence, helping de-escalate incidents and reduce risk to staff.

Intelligent Video Analytics Alerts

AI-powered video analytics can help identify relevant activity that might otherwise be missed by teams monitoring multiple feeds manually. Smart detection algorithms analyze video and alert based on a range of events, including unauthorized entry, loitering, license plate recognition, and person and vehicle detection.

Video analytics help cut through the noise of routine activity by surfacing only the events that matter most, minimizing false alarms while reducing the need for human involvement when it isn’t necessary. Additional video verification by remote monitoring teams can help confirm whether an event requires intervention or can be dismissed as a harmless anomaly, streamlining response times and helping construct a more effective incident response plan.

Multi-region analytics extend the power of AI analytics by allowing operators to set up multiple separate analytic areas within a single camera’s view, creating options for how an event escalates based on where the detected activity occurs in the frame. For example, if an intruder nears a perimeter fence, an initial region can trigger a deterrent light. If the intruder continues closer, a second region can notify monitoring teams to intervene using two-way audio. This layered approach ensures only the most pressing events are escalated to a human team, saving time and resources without sacrificing coverage of the situations that matter most.

Two-way audio, whether integrated through a third party or built into a camera, extends remote intervention capability further. Monitoring teams can listen in and communicate directly with individuals captured on camera, helping deter suspicious activity in real time regardless of physical location. This is particularly useful for persistent individuals not immediately deterred by a warning light. Beyond security use cases, two-way audio can also support other operational needs, such as communicating with a delivery driver after hours or assisting an employee on-site who needs help.

Looking Ahead

Leveraging intelligent video monitoring tools within a cloud-managed platform is a powerful way to reduce reliance on constant human oversight while improving both safety and operational efficiency. Organizations evaluating these tools should look for platforms that combine AI-based analytics, active deterrence, layered escalation, and remote arm/disarm capability within a single system. This reduces false alarms, speeds response times, and frees security personnel to focus on the incidents that genuinely require human judgment.

By Brent Boekestein, Vice President, Enterprise, for OpenEye. Email: bboekestein@openeye.net.

LiDAR, digital twins and AI are transforming the modern perimeter from static detection into real-time operational intelligence

For decades, perimeter security has followed a familiar formula: deploy sensors at the fence line, generate alerts when something crosses a boundary and present operators with a camera view for verification. Fence breaches, intrusion alarms, zone crossings and camera pop‑ups have defined how risk is detected and managed.

That model is no longer sufficient.

Across critical infrastructure, corrections, energy and transportation, the environments operators are responsible for have become larger, more complex and more dynamic. Threats no longer arrive as clean, binary events. Yet most security systems are still designed to answer a single, outdated question: Did something trip a sensor?

The industry is beginning to recognize this gap. Discussions are shifting toward software‑defined perimeters, sensor fusion, AI‑driven decision support, autonomous response and reductions in false alarms. But there remains a fundamental white space in the conversation: how the operational model itself changes when systems become spatially aware.

The future of perimeter security is not about detecting more events. It is about understanding environments.

Coverage is not visibility

Most facilities today are well covered. Cameras and radar are deployed across vast perimeters. Yet coverage is often mistaken for visibility.

Operators are still managing snapshots instead of environments. An alert fires, a camera appears, a short clip plays and the operator is left to mentally reconstruct what is happening — where an object came from, how it is moving and what it might do next. This process repeats hundreds or thousands of times per shift.

The result is not situational awareness; it is cognitive overload.

The future security operations center does not have a visibility problem — it has an understanding problem. Traditional systems present the world in flat abstractions: 2D maps, static zones, icons and camera tiles. These tools struggle to represent real‑world complexity such as elevation changes, overlapping infrastructure, occlusions, vehicle movement and human behavior.

Put simply, 2D monitoring cannot understand 3D environments. And as long as security platforms remain event‑centric and two‑dimensional, blind operational gaps will persist.

From Detection to Spatial Understanding

Spatially aware perimeter security introduces a fundamentally different model. Instead of asking whether a line was crossed, systems understand what is happening within space — continuously and persistently.

This shift is enabled by the combination of LiDAR, multi‑sensor fusion and AI‑driven spatial analytics. Objects are no longer fleeting detections that disappear after an alert. They become persistent entities tracked through three‑dimensional space over time.

That persistence changes everything. Systems can understand trajectories rather than isolated events, behavior rather than momentary motion and environmental relationships rather than static zones. Detection evolves into cognition.

LiDAR plays a critical role in this transition, but not because it is simply “another sensor.” Its value lies in the quality of information it introduces. LiDAR generates precise 3D spatial data that is resilient to lighting conditions and weather, providing a reliable foundation for volumetric tracking. When fused with video, radar and other inputs, it enables accurate object classification and spatial persistence within a shared coordinate system.

This is where the concept of the digital twin becomes operationally meaningful.

Often referenced casually, the digital twin is frequently misunderstood as a static 3D map. In a spatially aware perimeter system, it is something far more powerful: a living, continuously updated representation of the physical environment.

Operators no longer interact with alerts alone. They experience the perimeter as a live 3D environment where objects persist, move and interact. They see trajectories, dwell times, elevation, proximity and context in real time.

Static maps remain useful for orientation and visualization, but they cannot independently represent the continuously changing state of a dynamic security environment.

The Emergence of the Spatial Intelligence Layer

The next generation of perimeter security will not be defined by any single sensor. Cameras, radar, LiDAR, analytics and intrusion detection systems will continue to play important roles. The transformation occurs when these technologies contribute to a shared spatial understanding of the environment.

This creates a new architectural layer within the security ecosystem: a spatial intelligence layer between detection and decision.

Rather than forcing operators to interpret isolated alerts from disconnected systems, the spatial platform continuously maintains the state of the physical environment — correlating objects, location, movement, behavior and sensor information within a common operational model.

The result is a security architecture in which sensors detect, the spatial layer understands, and operational systems respond.

Security systems must evolve from event generation to environmental understanding.

Autonomous orchestration and the path to predictive intelligence

Once a system understands the environment spatially, response no longer needs to be manual. This is where autonomous orchestration and AI‑assisted workflows change the game.

Instead of operators steering cameras or chasing alerts, the system can automatically navigate PTZ cameras based on object position and trajectory, maintain visual verification across sensors and present operators with prioritized, contextualized intelligence rather than raw events.

Machine‑driven camera navigation and sensor‑directed response compress time‑to‑assess and time‑to‑respond while dramatically reducing cognitive load. Humans remain in control, but they are no longer buried in noise.

Over time, spatial awareness unlocks the next evolution of perimeter security: predictive intelligence. By understanding behavior patterns, movement histories and environmental context, systems can anticipate risk rather than merely react to it. Detection, assessment and response converge into a single, orchestrated operational loop.

This marks the end of static perimeter security.

The perimeter is no longer a fence line or a collection of devices. It becomes an intelligent, spatially aware environment capable of understanding what is happening within it. Organizations that embrace this shift will move faster, respond smarter and operate with clarity instead of chaos.

Detection was the first chapter.

Understanding is the next.

By Bill Eckard, Senior Director of Public Safety/Federal Sales and Corrections for Physical Security, Octave.

We know vehicles crash into storefronts. We know pedestrians are struck in parking lots. And we know crowded public spaces can be vulnerable to both accidental and intentional vehicle incursions.

We also know how to reduce those risks.

What we don’t have is a consistent requirement to do so.

There is currently no overarching national requirement for vehicle-incursion protection that applies consistently across states and municipalities. Building codes also leave gaps, particularly for temporary events such as parades and festivals where large crowds may be exposed to vehicle incursions.

Changing national building codes isn’t a quick answer, either. Efforts to increase protection in parking lots and storefronts have been underway for approximately 15 years, and meaningful changes could still be another decade away.

So what happens in the meantime?

Vehicle Incursion Protection Standards and Requirements

Some applications already have defined protections. Gas pumps and fuel dispensers, for example, are addressed by the International Fire Code, with protection under the authority of state and local fire-code officials through NFPA 30A, Code for Motor Fuel Dispensing Facilities and Repair Garages. Efforts to strengthen vehicle-impact protection around fueling areas have also been underway for several years.

There is also movement at the state and local levels. In 2024, Smithfield, Rhode Island, adopted an ordinance establishing vehicle-impact protection requirements for new retail construction and outdoor pedestrian seating near parking areas.

At the state level, Illinois lawmakers introduced legislation in 2026 that would require counties and municipalities to establish vehicle-impact protection requirements for certain businesses, residential care facilities, outdoor dining areas and day care play areas when specified vehicle-approach conditions are present. The bill has not yet become law, but it provides a current example of lawmakers considering a broader approach to vehicle-incursion protection.

Across much of the country, requirements remain inconsistent. For many storefronts, parking areas and other public-facing properties, protection may still depend on whether an owner recognizes the risk and decides to address it proactively.

What Should Vehicle Incursion Protection Requirements Include?

The answer isn’t necessarily to require the same bollard in front of every business.

Vehicle-incursion protection should begin with risk. Where do vehicles travel and park in relation to people? Can a vehicle approach a storefront or pedestrian area directly? What speeds are possible? Are large groups of people regularly present? What could happen if a vehicle leaves its intended path?

From there, the appropriate protective measures can be determined.

Insurance companies can play an important role by recognizing vehicle-incursion exposure and encouraging appropriate mitigation. Architects, engineers and other design professionals can identify vulnerabilities before a property is built or renovated. Municipalities can adopt practical local ordinances addressing higher-risk conditions instead of waiting years for changes to national building codes.

And property and business owners can act before they are required to.

We already have vehicle-impact protection products and recognized methods for evaluating their performance. The more difficult question is establishing where protection should be expected and who should be responsible for requiring it.

That conversation becomes even more important when considering the scale of the problem. Approximately 100 vehicle-into-building crashes occur every day, while an estimated 160 pedestrians are struck in parking lots daily.

When an incident occurs, driver insurance will typically be involved, but property owners and, frequently, business owners may also face liability. The consequences can become significantly greater when a known risk existed and protective measures were not taken.

One prominent example is the $91 million settlement following a storefront vehicle crash, a case that brought significant attention to the potential consequences of failing to address foreseeable vehicle-incursion risks.

Liability is an important part of this discussion, but it shouldn’t be the reason protection is installed. The objective is to prevent the incident in the first place.

Waiting until after a vehicle crashes into a building or pedestrian area is not a safety strategy. Until broader requirements exist, municipalities, insurers, design professionals and property owners all have opportunities to address foreseeable risks before someone is injured.

$5 Million Federal Grant Targets Bollard and Pedestrian Protection

The federal government is also putting new funding behind vehicle-impact protection.

The U.S. Department of Transportation’s Federal Highway Administration is offering up to $5 million through the FY 2026 Stopping Threats on Pedestrians Competitive Grant Program (Bollards). The program funds bollard installations designed to prevent pedestrian injuries and acts of terrorism in areas used by large numbers of pedestrians. State DOTs and local governments are eligible, with federal funding covering up to 100% of eligible project costs.

The program also emphasizes performance. Funded bollard systems should meet recognized vehicle-impact standards including ASTM F2656, ASTM F3016, U.S. Department of State SD-STD-02.01 or PAS 68. Systems that don’t meet one of those standards require independent engineering and physical testing demonstrating that they can mitigate the identified vehicle threat.

Applications close September 9, 2026, at 11:59 p.m. ET.

The funding is significant, but the larger issue remains: protection from a known vehicle-incursion risk should not depend on whether someone decides to address it voluntarily.

We have spent years documenting the risk, developing standards and engineering solutions capable of protecting people from vehicle incursions. Now federal funding is putting additional resources behind that protection. What remains is the willingness to turn what we know into meaningful policy.

By Rob Reiter, Co-Founder of the Storefront Safety Council

Plan your time. Maximize your visit.

Start at Doors B2/B3 near Aisle 1800 and follow this curated route to many of the industry’s leading perimeter security manufacturers, technologies and experts. From AI-powered video analytics and autonomous security robots to access control, radar, intrusion detection and life safety, this guide highlights the companies helping shape the future of perimeter security.