Volume 10

🎙 Secured Podcast

Episode 35 | We've built the future. We just haven't built the bridge to it…
The technology is ready. So why is adoption still lagging? Recorded live at Bergfest 2026, industry leaders get candid about the barriers holding access and identity back, and what it will take to move forward together. Listen here.

🫣 Premium member-only content

Inside dormakabas Alliants Aquisition with Darien Long, SVP Specialty Access Control
Last week, we shared this conversation with Darien Long of dormakaba, unpacking the Alliants acquisition, the “power of choice,” and where Agentic AI fits into the future of hospitality.

📰 The Access Control Executive Brief 156

Tony Dong | Why Access Control Executives Need to Think Like Macro Investors: Part 2
Interest rates don’t just affect the economy. They can directly shape how access control companies think about debt, refinancing, acquisitions, buybacks, and dividends. In Part 2, we take a closer look at Allegion’s debt structure and what a higher-rate environment could mean.

✍🏻 Articles

Jacob McKinney | Single-Source the Platform, Not the Identity

What happens when one connected security device is compromised? This piece looks at blast radius, device keys, issuer authority, and the uncomfortable reality of offline access, arguing that security has to account for what happens after something breaks, not just how we protect it before it does.

Bobby Ballance | Your Company's Ultimate Valuation Shield
Physical security is often treated as a facilities expense, but in high-consequence environments, the stakes are much bigger. This piece explores how physical security can become a strategic asset for protecting digital assets, intellectual property, operations, and ultimately enterprise value.

Daniel Greenburg | Why retail security is moving beyond the four walls of the store
Retail security doesn’t stop at the front door. This piece looks at the overlooked spaces and handoffs around a store, and why protecting them requires more than simply adding more cameras.

Ellie Portugali | Your AI concierge is a credential issuer. Who approved that?
The convenience is obvious. The security implications are a lot less simple. Before we let conversational AI start opening doors, we need to ask who is actually authorized to make that decision.

🚨 Breaking News 

• Allegion Acquires Overly Door Company
• Ring launches its own smart lock
• Secure Passage and EyePop.ai are integrating real-time computer vision into Truman.
• Rhombus launches Rhombus Studio, a custom dashboard build service for physical security data

ACS26 was this week! 

What an event. ACS26 would not have been the same without a Collective. This industry deserves once-in-a-lifetime experiences to connect, learn, and grow, and we fully intend to keep creating and facilitating experiences like these.

There is a lot to take away from this one. The people of this industry are ready to build together, get ahead of this new era of intelligence, and figure out what comes next. We can’t wait to share the recaps, full-length conversations, and highlights from the event with you!

A huge thank you to Gallagher for being our City Host and welcoming us to your beautiful home, New Zealand. Thank you to SafeTrust for co-hosting the Warm-up Happy Hour, and to ColorID for co-hosting the Waiheke Sunset Evening and helping us close out ACS26 in style.

And yes, we are already thinking about ACS27. Stay tuned.

Secured: Episode 35

Recorded in Munich, Lee sits down with leaders from across the credential and access control industry for a honest conversation about why the technology is ready for what comes next, but adoption hasn’t caught up. From mobile credentials and open standards to fragmented systems, migration costs, and outdated sales models, the discussion gets into what’s actually holding the industry back. The group explores what needs to change, why collaboration matters, and how shifting the conversation from products to customer outcomes could reshape the future of access and identity. Listen here.

Don’t miss last week’s premium member content in the community 👀

In this conversation, Lee sits down with Darien Long, SVP of Specialty Access Control at dormakaba, to talk about the company’s acquisition of Alliants and what it says about the broader shift happening across the hospitality ecosystem. They get into why dormakaba chose to acquire rather than build or simply partner, the “power of choice” for customers, and how access control, identity, mobile credentials, digital check-in, payments, and software are increasingly connected. The conversation also explores where Agentic AI actually fits into hospitality and how it could take transactional work off hotel teams so they can focus more on the guest experience.

In Part 1, we looked at why access control executives need to think beyond the industry itself and consider the bigger macroeconomic picture, including bottom-up vs. top-down investing, foreign currency risk, and how those factors can affect a global company like ASSA ABLOY.

Now, we’re getting into the other side of the equation: interest rates, bond yields, and debt, with a closer look at Allegion’s debt structure and what a higher-rate environment could mean for refinancing, acquisitions, buybacks, and dividends.

Understanding the Yield Environment

Before looking at any specific company’s debt stack, it is worth separating two concepts that often get used interchangeably: interest rates and bond yields. They are related, but they are not the same thing. Both can affect a company’s valuation and, more importantly, its ability to borrow. But the transmission mechanism depends heavily on how that company’s debt is structured.

When people say, “the Fed raised rates” or “the Fed cut rates,” they are usually talking about the federal funds rate, which is the short-term policy rate the Fed uses to influence the cost of overnight money in the banking system. The Fed adjusts this rate in pursuit of its dual mandate: price stability and maximum employment. In plain English, the Fed is trying to manage inflation without breaking the labor market.

That policy rate has a direct influence on the short end of the yield curve. It affects bank lending rates, money market yields, floating-rate loans, revolving credit facilities, and other borrowing costs tied to short-term benchmarks like SOFR. So, when the Fed hikes, floating-rate debt usually becomes more expensive fairly quickly. When the Fed cuts, floating-rate debt can become cheaper just as quickly.

Bond yields are different. The 10-year and 30-year Treasury yields are not set directly by the Fed. They are set by the market. Buyers and sellers are constantly repricing them based on inflation expectations, economic growth, fiscal deficits, Treasury supply, foreign demand, recession risk, and the extra compensation investors demand for lending money over longer periods. Nobody “controls” the 10-year Treasury in the same direct way the Fed controls its overnight policy rate.

That is why the 10-year Treasury is so closely watched. It is the benchmark for long-term money. Mortgages, corporate bonds, infrastructure financing, acquisition debt, and valuation models all take cues from it. If the 10-year yield rises, the hurdle rate for long-term investment rises with it. Future cash flows become worth less today, and companies have to pay more to issue new fixed-rate debt.

Right now, both sides of that equation are moving against borrowers. The Fed raised its target range by 25 basis points to 3.75% to 4.00% in September, its first hike since 2023, and the Fed’s own projections suggest at least one more increase before year-end remains on the table. That will hurt any company using floating-rate debt, revolvers, or bank financing tied to short-term benchmarks.

At the same time, longer-term yields have moved sharply higher. The 10-year Treasury recently hit 5.24%, its highest level since 2007, while the 30-year reached 5.56%, its highest since 2002, according to the Wall Street Journal. This is a headwind for companies issuing or refinancing fixed-rate debt. Even if their existing coupons are locked in, the next refinancing window may be materially more expensive.

Therefore, a company can look insulated from Fed hikes if most of its debt is fixed-rate and long-dated. But it can still be vulnerable if bond yields rise before a major refinancing window. Likewise, a company with floating-rate debt may benefit quickly if the Fed cuts, but suffer quickly if rates move against it.

This is why asserting “rates are going up” or “rates are going down” is too superficial. You need to ask: what kind of debt does the company have, when does it mature, what benchmark is it tied to, and what happens if the market demands a higher yield the next time it borrows?

Allegion’s Debt Stack Under Today’s Yield Pressure

Looking at Allegion’s latest 10-Q, total debt was about $2.03 billion as of June 30, 2026, up modestly from $1.98 billion at year-end 2025. The increase came almost entirely from the revolving facility, which rose from $190.6 million to $240.6 million. Allegion tapped a bit more of its corporate credit line, but the overall capital structure did not meaningfully change.

The revolver is the most rate-sensitive part of the stack. It matures in 2030, provides up to $1 billion of borrowing capacity, and had $240.6 million drawn plus $25.3 million in letters of credit. That still leaves roughly $734 million of remaining capacity before considering any other technical adjustments.

The interest rate on the drawn balance was SOFR plus 1.125%, resulting in an all-in rate of 4.753% at quarter-end. Because this facility floats with short-term rates, Fed policy flows through fairly quickly. If short rates rise, this gets more expensive. If the Fed cuts, this part of the debt stack gets relief.

But the revolver is only about 12% of total borrowings outstanding. Most of the debt is fixed-rate senior notes: $400 million due 2027 at 3.55%, $400 million due 2029 at 3.50%, $600 million due 2032 at 5.411%, and $400 million due 2034 at 5.60%. The interest expense on those bonds does not suddenly reset because the Fed changes policy or Treasury yields move higher.

However, the pressure point is refinancing. Allegion’s 2027 notes carry a very attractive 3.55% coupon. In the current yield environment, replacing that debt will almost certainly cost more unless rates fall materially before maturity. If Allegion refinanced that $400 million at, say, 5.5% to 6.5%, the incremental annual pre-tax interest expense would be roughly $8 million to $12 million. That is not catastrophic for a company of this size, but it is is cash that cannot be used for acquisitions, buybacks, or dividends.

The 2029 maturity is the next watch item. That tranche also carries a low coupon at 3.50%. Together, the 2027 and 2029 notes represent $800 million of cheap legacy debt that will eventually need to be refinanced, repaid, or rolled into a new capital structure. The 2032 and 2034 notes already reflect a higher-rate world, with coupons in the mid-5% range, so there is less of a sticker shock there.

From a credit quality perspective, I think Allegion is still in decent shape. The notes are senior unsecured, meaning lenders are willing to lend against the overall enterprise rather than demanding specific collateral. The revolver is also unsecured and guaranteed across key Allegion entities. Management remains in compliance with its leverage covenants.

In this case, Allegion has borrowed reasonably well. The company has avoided a dangerous maturity wall, kept most of its debt fixed rate, maintained a large unused revolver, and preserved access to unsecured borrowing. In yesterday’s lower-rate world, Allegion could borrow cheaply, buy companies, repurchase shares, and grow the dividend with less tension between those choices.

But in today’s environment, every dollar has to work harder. Acquisitions need to clear a higher hurdle rate, buybacks need to be more valuation-sensitive, and their current high pace of dividend growth becomes less attractive if debt refinancing starts eating into free cash flow.

So, will higher bond yields and rising rates affect Allegion? Yes, but not immediately in a crisis-like way. The effect is gradual. It shows up through higher refinancing costs, tighter acquisition math, and less room for capital allocation mistakes. The balance sheet is not flashing red, but the macro environment raises the bar for management discipline.

A customer arrives in the parking lot. An employee carries an order to a curbside collection point. A delivery driver waits behind the building. After closing, a manager walks alone to their car.

Each situation is part of running a retail business. Yet a security strategy built around the sales floor may give these moments far less attention than the merchandise inside.

That is the gap retail leaders need to confront: the store’s walls are a physical boundary, but they are a poor boundary for security planning.

For customers and employees, the retail experience begins before the entrance and continues after the exit. Protection should follow the same path.

The National Retail Federation’s 2026 research reinforces the need for a broader view. Surveyed retailers reported declining shoplifting and merchandise theft in 2025, while other forms of external theft, fraud and scams increased. Improving one part of the operation does not remove vulnerabilities elsewhere.

Consider curbside collection. When an employee takes an order outside, the transaction moves into a space shared with vehicles, pedestrians and people who may have no connection to that purchase. The retailer has extended its service beyond the building. Its procedures for employee safety, order verification and incident response need to extend with it.

The same reasoning applies to loading areas, rear doors and delivery routes. These spaces connect a store to the wider movement of goods. A carefully controlled sales floor offers limited protection if a delivery entrance is left unsecured or nobody knows who should respond to activity behind the building.

The difficult question is often ownership.

In a shopping center, a retailer may control its premises while a landlord manages the parking lot. A security contractor may patrol common areas. Store employees may assume someone else is watching outside.

Those arrangements can work, but only when responsibilities are clear. Who receives an alert? Who checks it? Who contacts emergency services? Who supports an employee who feels unsafe leaving at night?

A camera cannot resolve an unanswered management question.

This is why expanding security beyond the store should begin with a review of daily operations, rather than a shopping list of equipment. Retailers should trace how people and goods move through the property, identify vulnerable handoffs and agree on who takes action.

Technology can then support that plan. Video coverage can improve visibility around entrances and loading areas. Analytics can flag defined activity for review. Remote monitoring can help assess an event and coordinate a response under agreed procedures.

But detection is only one step. An alert has little practical value if it reaches an unattended inbox or leaves a store employee to investigate a potentially dangerous situation alone. The response process deserves as much scrutiny as the camera coverage.

Retailers also need to distinguish unusual activity from threatening behavior. A person waiting near an entrance may be collecting a family member. A driver behind the building may be making an authorized delivery. Effective security requires context, proportionate decisions and respect for privacy.

A broader security boundary should make the property easier to use safely. Better lighting, clear collection points, controlled delivery access and reliable ways to request help can support that goal without making every visitor feel scrutinized.

My view is that retail security needs a broader measure of success. Merchandise losses matter, but so do safe deliveries, confident employees and customers who feel comfortable arriving and leaving.

The practical starting point is simple: walk the property through the eyes of an opening employee, a delivery driver, a curbside customer and the last person leaving after dark.

Then ask where protection becomes uncertain.

A retail business depends on everything that happens around its four walls. Its security strategy should reflect that reality.

When dormakaba announced it is acquiring Alliants, the press releases were predictably giddy about seamless journeys and frictionless hospitality. The moment you hook a conversational guest platform directly into digital access and PMS backends without an independent guard, you quietly promote a chatbot to Chief Credential Officer. I must have missed the board meeting where that got approved.

Picture the textbook demo that makes enterprise buyers nod approvingly:

“My partner’s arriving before me. Can you let them into the room?”

To an AI optimizing for hospitality, this is pure magic. It parses the message, identifies room 412, provisions a mobile key, and throws in a digital coupon for the spa. The front desk avoids looking up from their screens, and the demo gets polite golf claps.

Now trace what that workflow actually authorizes. The model translated conversational comprehension into executive authority. Even if the requestor's session is authenticated, does the system validate the recipient's identity? Verify whether they are entitled to access? Check if property policy permits guest-directed delegation in the first place? And what is the operational answer when the guest texts ten minutes later: “Actually, cancel that, we just broke up in the cab.” The lock cannot act on a breakup text. What turns that conversation into an enforced cancellation?⠀

If you issue a key without knowing when it stops working, you’ve engineered an unguided missile. Issue short-lived credentials and define that exposure window. Expiry limits the damage; it doesn’t make revocation instant. Are you tempted to solve all of this with a system prompt? Something like: “Only issue keys to authorized guests, and please, be very careful.”  Telling an LLM to be careful is just a prayer.⠀

Campbell’s Law warns us that the more weight we put on a performance measure, the more pressure there is to distort the process it measures. Apply that to an AI concierge judged on ticket resolution and guest satisfaction. A refused request can look like a service failure. Without independent authorization enforcement, the system gets rewarded for finding a way around the checks that protect the guest. The AI concierge really wants that five-star review.

In physical security, we spend millions obsessing over hardware secure elements, elliptic curves, and cryptographic handshakes. We treat the key like the Crown Jewels. Meanwhile, an AI agent skips the math entirely and asks the backend to mint a valid credential. The cryptographic pipeline remains pristine, the lock behaves impeccably, and the wrong person walks straight into room 412. A valid credential only proves the system issued it.⠀

If access control leaders want conversational front-ends without physical security liabilities, conversation must be severed from authorization. That is where a divergence guardrail belongs. Put a bouncer outside the model: a hardened, deterministic policy engine that has never once been charmed. The credential service must honor its verdict on every issuance path, with no side door for the agent. Before anyone touches a door, the bouncer checks whether the proposed action diverges from business intent, contracts, and verified identity.

Here is what to demand before you sign off:

1. Who can the agent issue a key to? Verify authorization and policy.

2. Check every action against verified guest records. Don't ask the agent if it is sure; it’s always sure.

3. Scope every credential to one authenticated person, one door, and a rigid time window to minimize the blast radius of failure.

4. After a guest says “cancel”, how long until the key stops working? Name that number.

5. Log every issuance with the reason. "The chatbot felt confident" is useless in an audit.

Before rolling out the next autonomous guest journey, have your team run one simple demo: ask the concierge for a key you shouldn't have.

Anyone can build an agent that says yes. Show me the boundary that holds when it has to say no.

👀 As Seen In the Secured Community 👀

👨🏻‍💻 Product/Solution Questions

Rodney Thayer kicked off a practical discussion about what tools physical security installers should have on hand, especially for students attending OSDP Bootcamp. He highlighted the challenges of using corporate-issued laptops that restrict software installations, USB access, and network connections in a lab environment.

📰 Industry News & Insights

Lee Odess shared his take on Ring rolling out its own smart locks, questioning the messaging around energy harvesting and “smart lock anxiety.” His post challenges whether these are truly new problems or a way to manufacture concern around a product category.

Tony Dong also shared news of Apple’s smart home expansion, including a doorbell and lock being co-developed with LG. Read the article.

🗓️ Events

Brett Ennals shared that he and Stew Pennykid will be attending SNG this year and invited others attending to connect. View the agenda.

Lee Odess shared a video from the welcome reception kicking off ACS26, hosted by Lady Judy and Sir William Gallagher at their home. He reflected on how each event develops its own character while bringing people together through networking and shared experiences.

Zachary Klares asked the community about upcoming events and sponsorship opportunities for ISC East, opening the door for members to share ideas and opportunities.

🗣️ Your Voice Matters.
Share your feedback, suggest topics, and tell us what questions we should be answering. Help us shape future issues and contribute to the conversations that move the industry forward.

Community input form!

PS: I am sure some of you may forward this, but please do so sparingly and encourage others to sign up here: https://www.tacc.me/secured Thank you!