🎙 Secured Podcast
Episode 37 | HID Sells PKI, Allegion’s Two Company Story, and Why Security Needs to Get Sophisticated
From a $75 classroom barricade device to AI agents managing building systems, the details matter. This week, Lee digs into school safety, mobile credentials, installer tools, and the five community articles challenging how we design, deploy, and communicate security. Plus, find out how to get involved in the Secured Lounge at ISC East. Listen here.
🎤 Secured Events | Secured Lounge @ ISC East
Built in partnership with RX Global at ISC East. The Lounge facilitates a creator space for interviews, live “Convince Me” debates, and recording your own content. November 4th & 5th. See below for more details.
🫣 Premium Content
Lee and Lance Smith sit down for a conversation | The Most Underappreciated Part of Physical Security.
Everything in physical security eventually comes back to the door, yet the people responsible for that last mile are often overlooked. Lee sits down with Lance Smith of Badlands to talk about locksmithing, building and acquiring security businesses, and what it takes to move the industry forward without losing sight of the people behind it. Watch here.
✍🏻 Articles
Amber Jarvis-Wilson and Erin Wilson | Lock, Don’t Block: Aligning Classroom Security with Partner Alliance for Safer Schools (PASS) School Safety and Security Guidelines
School barricade devices may seem like an affordable way to protect classrooms, but they can introduce serious risks to students, staff, and first responders. This article explores the hidden costs of barricades and why code-compliant locking solutions are essential to school safety.
Ryan Salmons | The Future of Access Control Is Open, Connected, and Intelligent
Access control has become better at issuing credentials, but the systems managing why, where, and when someone needs access often remain disconnected. The next step is connecting access decisions to the workflows that drive them, without sacrificing security or accountability.
James Gammon | Who Should Own the Specification? An Industry Debate Worth Having
Independent specifiers, distributors, and manufacturers each bring something valuable to the specification process, but their priorities don't always align. This article examines the trade-offs and asks how the industry can balance design integrity, competition, and accountability on construction projects.
Anna-Karin Tullock and Björn Jägevall | From Plastic Cards to Digital Wallets: The Next Step in Access Control
Plastic cards have shaped physical access control for decades, but security concerns, administrative burdens, and user expectations are pushing the industry toward digital wallets. Explore how mobile credentials, modern cryptography, and open standards are changing the future of access control.
Ellie Portugali | Retire the laptop. Keep the deliberate friction.
The industry is building smarter systems and autonomous workflows, yet technicians still depend on laptops, outdated tools, and manual workarounds to get installations across the finish line. This article explores why reliable automation starts with better engineering, verifiable outcomes, and deliberate human oversight.
🚨 Breaking News
Secured: Episode 37
This week, Lee digs into the strategy behind HID’s PKI divestiture, what Allegion’s latest numbers reveal about its Americas and international businesses, and five community articles challenging how we approach school safety, access control integrations, specifications, mobile credentials, and installer technology. Plus, get the details on the Secured Lounge coming to ISC East and Lee’s take on why technical expertise alone isn’t enough anymore. As physical security steps into the mainstream, how the industry communicates, presents itself, and makes its case matters more than ever. Listen here.
This Week's Featured Content 👀
For Lance Smith, the future of physical security isn’t just about new technology. It’s about the people running the businesses, the relationships they’ve built in their communities, and what happens when those businesses change hands. In his conversation with Lee, Lance gets into Badlands approach to acquisitions, what business owners should be thinking about before they’re ready to sell, and the personal experience that shaped his philosophy of investing in people. They also get into AI and the practical ways it can give locksmiths and other tradespeople time back without replacing the work they do. Watch here.
Barricade devices refer to any supplemental hardware or product designed to restrict the movement of a door, typically deployed in specific situations. These devices may include permanently installed components affixed to the door, as well as temporary solutions such as placing a fire hose over the door closer. Any item added to a door with the intent of limiting its movement qualifies as a barricade device.
Barricade-type devices appear in several forms, all of which share the same fundamental problem: they are not traditional door hardware and often violate egress, accessibility, and fire code requirements.
Each of these products may be marketed as a “simple” lockdown solution, but these devices can transform a code-compliant classroom into a non-compliant and potentially dangerous environment in seconds.
At the Capital Gazette in 2018, a shooter used previously installed barricades to block a rear exit, trapping victims and delaying rescue despite police arriving within two minutes of the emergency call. In Pennsylvania’s West Nickel Mines School and Colorado’s Platte Canyon High School shootings, barricaded doors also enabled attackers. It’s also important to remember barricades are not up to security code standards and are deemed one of the top ten K-12 safety and security pitfalls (see PASS Guidelines, page 11).
In most successful school incident responses, locked doors were essential to thwarting or at least minimizing a threat. Even such tragedies as Sandy Hook Elementary can attest to the importance of locked doors. Sandy Hook’s first grade teacher was able to lock her students inside her classroom, and the shooter passed by her door.
Still, to some, on the surface, barricades seem like a good way to stop intruders within limited school safety and security budgets.
This America's Safe Schools Week gives us the opportunity to clarify why the most cost-effective safety choice to use barricades is not the best — or safest — option for students and staff.
Hidden Costs of Barricades
For school administrators, budget pressures are real when the time comes to assess upgrades to security protocols. For less than $75, schools can buy hardware that allows anyone inside a classroom to bolt a door shut. As Amber Jarvis-Wilson, a safety consultant in the school safety and security industry on behalf of PASS member dormakaba, noted, “This ‘easy’ answer to remove one-motion egress could be much more costly than utilizing code-compliant locking devices.” These costs are not always monetary, either. For instance:
- Forced Entry Damage: Schools could potentially face thousands of dollars in damage to doors, frames, flooring, and walls if first responders must breach a barricaded door.
- Psychological Trauma: Students and faculty who are trapped inside a barricaded room during a crisis can experience mental and emotional trauma, not to mention the emotional cost to students and staff who return to the damaged scene.
Unintentional Consequences of Barricades
Across the country, state legislators and local code officials have introduced bills and proposed amendments to building and fire codes that would allow the installation of classroom barricade devices. These proposals are often driven by the understandable desire to increase security in schools, but they overlook the complex interplay of fire, life safety, and accessibility codes that already govern classroom doors.
Unfortunately, some manufacturers of these products claim compliance with building and fire codes — claims that are misleading at best. This creates confusion and a false sense of security for schools that believe they are protecting students when, in reality, they may be introducing greater risk.
Trapped With the Assailant
While the goal is to block the perpetrator from entering a school building before any harm can be done, research suggests they may already be inside the barricaded room. This means barricades can actually empower an attacker. “The students know the building, the lockdown protocols, and where to hide that the schools use during an event,” said Erin Wilson, learning strategist at dormakaba and member of the International Code Council Means of Egress Technical Committee. If a student attacker can barricade themselves inside a classroom, they have more time to harm others and prevent rescuers from reaching the injured.
As Jarvis-Wilson explained, “An attacker could use the barricade devices to lock themselves in with peers, who can then not as easily escape. This gives the intruder more control and responders less access. We’re back to the issue of lost time.”
Unintentional Blocking: Barricades Don’t Discriminate
In reality, these “blocks” lock out the first aid personnel from entering and prevent teachers from intervening in student-on-student violence. Simply stated, barricades can block anyone from entering — including emergency personnel (especially in cases of a student suffering a seizure, asthma attack, or allergic reaction, when every second counts).
Click here to read the full article.
A prospective renter schedules a self-guided apartment tour for 2:00 p.m. on Saturday. The leasing platform knows who they are, which unit they're visiting, and when their appointment ends. But the access control system may know none of it.
Instead, someone on the property team logs into a separate platform, creates a temporary credential, sends it to the prospect, and remembers to revoke it afterward.
That process introduces more than administrative inefficiency. It creates opportunities for security gaps.
Access control has advanced considerably in how credentials are issued, managed, and authenticated. Yet the processes surrounding those credentials often remain disconnected from the systems that determine why someone needs access in the first place.
The next opportunity for access control isn't simply improving how doors unlock. It's improving how access decisions are made and carried out across systems.
Access Should Follow the Workflow
Consider how many everyday activities require physical access: leasing tours, maintenance requests, vendor visits, resident move-ins, and contractor assignments.
In most cases, another software platform already holds the information needed to make an access decision. It knows who is arriving, where they need to go, and how long they should be there.
When that information remains disconnected from access control, someone has to manually translate it into permissions. Each additional step introduces the possibility of human error, outdated credentials, or access extending beyond its intended purpose.
A more connected approach allows the software managing an activity to initiate the corresponding access request.
A touring platform could issue credentials valid only during a scheduled appointment. A maintenance system could coordinate technician access around an assigned work order. Vendor management software could align permissions with scheduled visits.
The goal is to connect access to the context that makes it necessary, reducing manual intervention while maintaining appropriate oversight.
More Integration Requires More Control
Opening access control to external software introduces legitimate security considerations. Interoperability is only valuable when it operates within clearly defined boundaries.
An integration should never give another application unrestricted authority over a property's doors.
Instead, a well-designed system should support role-based permissions, restrict applications to explicitly authorized entry points, establish appropriate credential expiration rules, and maintain records of access activity.
Operators must also retain the ability to review permissions and disconnect integrations when necessary.
These safeguards become increasingly important as access extends into applications beyond traditional security management software.
The distinction is critical: automating access does not mean surrendering control over it.
The access control platform must remain responsible for enforcing the policies that govern physical entry, even when another application initiates the request.
The Real Measure of Integration
Technology integrations are frequently evaluated by whether two systems can exchange information. But exchanging data alone does not necessarily improve security or operations.
A more meaningful measure is whether the integration eliminates unnecessary steps while preserving accountability.
Can a credential be issued without someone manually copying information between platforms? Does access expire when the authorized window ends? Can an operator determine which application issued a credential and why?
These questions matter because access management increasingly depends on decisions made throughout a property's operational technology ecosystem.
When systems share the right information, security teams can spend less time managing routine credential changes and more time overseeing exceptions, investigating concerns, and maintaining consistent access policies.
Moving Beyond the Door
Physical access control will always depend on reliable hardware and strong security practices. But its effectiveness is also shaped by the software and processes surrounding it.
The industry has an opportunity to move beyond managing individual credentials toward coordinating access based on identity, purpose, location, and time.
That requires systems designed to work together, with security and accountability built into every interaction.
When the next prospect arrives for a scheduled tour, the door should already know who is coming, where they're authorized to go, and when their access should end.
In the door and hardware industry, few decisions have a greater impact on a construction project than the specification and the resulting hardware schedule. Yet, an important question remains: Who is best suited to own the specification process—independent specification writers, distributors, or manufacturers?
Recently, I had two conversations that highlighted very different perspectives on this question. Both made compelling arguments, and I believe the industry would benefit from a broader discussion.
The first was with an independent specification writer who believes the industry needs more independent professionals. The argument is straightforward: independent specification writers are best positioned to work with architects and develop truly open specifications. By focusing on design intent, functionality, and code compliance rather than brand preference, they can create a level playing field for manufacturers whose products meet the project's requirements. This approach encourages competition, provides architects with more options, and prioritizes the right solution for the building.
The second conversation was with a well-established distributor owner who believes distributors should have greater ownership of the specification process. His argument centers on accountability and execution. Distributors are often responsible for furnishing and installing the products, managing callbacks and service issues, and navigating fluctuating lead times. From this perspective, having a voice in the specification helps ensure product availability, purchasing flexibility, and the ability to keep projects on schedule.
For distributors, time is money. Construction delays, last-minute substitutions, and products that fail to arrive when needed can quickly erode gross margins. Why shouldn't the party responsible for delivering the finished installation have a meaningful role in determining which products are specified?
Of course, manufacturers have a compelling argument of their own. Today, manufacturers write a significant portion of the industry's specifications. They maintain ongoing relationships with architects, engineers, and general contractors, and they can provide comprehensive, building-wide solutions supported by technical expertise. Their involvement can simplify the design process and help ensure that specified products work together as intended.
However, when a specification is built around a particular manufacturer's products, distributors may find themselves with limited purchasing flexibility. When lead times become an issue, the resulting delays or substitutions can place additional pressure on the distributor's margins and project commitments.
Each approach offers advantages, but each also presents challenges:
-
Independent specification writers can promote open competition and manufacturer-neutral solutions, but their availability and ability to support projects throughout construction may be limited.
-
Distributors bring practical knowledge of installation, service, product availability, and project execution, but their preferred product lines may limit the range of manufacturers represented.
-
Manufacturers offer technical expertise, product knowledge, and comprehensive solutions, but manufacturer-led specifications can limit competition and reduce distributor purchasing flexibility.
Ultimately, the question is bigger than who writes the specification. It is about balancing design integrity, open competition, product performance, project accountability, and the commercial realities of delivering a successful construction project.
So, who should own the specification and the resulting hardware schedule for new construction: independent specification writers, distributors, or manufacturers?
Is there a better model—one that combines independent design guidance, manufacturer expertise, and distributor accountability without giving any single party too much control?
I welcome your perspectives. This is an important conversation for our industry, and I would be interested to hear how others believe we can get it right.
For decades, plastic cards have been the standard credential for physical access control. They were easy to issue, cost-effective, and compatible with a wide range of systems. Technologies such as MIFARE, HID Prox, and DESFire shaped how access control infrastructures were designed and deployed.
But the limitations of plastic cards have become increasingly evident. Security vulnerabilities, administrative overhead, and the cost of managing large credential populations have led many organizations to look for a more modern alternative. Today, the question is no longer whether mobile access will replace physical cards, but how it can be implemented securely, efficiently, and at scale.
The Challenges of Physical Credentials
Plastic cards solved many problems when they were introduced, but they also create ongoing operational challenges.
Key limitations include:
-
Administrative burden: Cards must be issued, distributed, replaced, and revoked throughout their lifecycle.
-
Security risks: Many legacy technologies can be cloned, while symmetric-key systems rely on shared secrets that can become a single point of failure.
-
User inconvenience: Lost or forgotten cards require replacement and create disruption for both users and administrators.
-
Environmental impact: Millions of cards are manufactured, transported, and discarded every year.
While plastic cards will remain part of the access control ecosystem for years to come, these challenges drive the demand for more flexible credential technologies.
Why Mobile Access Is Gaining Momentum
Mobile access has existed for more than a decade, but early solutions often depended on dedicated apps and complex device management.
The emergence of native wallet-based credentials has changed the landscape. Instead of relying on a separate application, credentials can be stored directly in the smartphone wallet alongside payment cards and digital identities.
This offers several advantages:
-
Credentials can be distributed instantly.
-
Users carry their credentials on a device they already use every day.
-
Built-in biometric authentication adds an additional layer of security.
-
The user experience becomes more seamless and intuitive.
Rather than simply digitizing the plastic card, wallet-based credentials introduce a fundamentally different model for identity and trust.
A Shift Toward Modern Security Models
One of the most significant differences between traditional cards and mobile credentials lies in the underlying security architecture.
Many physical cards rely on symmetric cryptography, where card and reader share the same secret key. If that key is compromised, large groups of credentials may be affected.
Mobile credentials are increasingly moving toward public key infrastructure (PKI) and asymmetric cryptography, where each credential has its own unique key pair. This approach aligns physical access with the same security principles already used throughout modern IT environments.
Combined with biometric verification and certificate-based credential management, mobile access supports Zero Trust strategies and stronger protection against cloning and credential sharing.
The Importance of Open Standards
The long-term success of mobile access depends not only on security but also on interoperability.
Several industry standards play a key role:
-
ISO/IEC 14443 for NFC communication
-
NFC Forum standards for device interoperability
-
OSDP (Open Supervised Device Protocol) for secure communication between readers and controllers
-
Emerging initiatives such as PKOC and Aliro that promote open, public key-based credential ecosystems
Open standards reduce dependence on proprietary technologies and give organizations greater freedom when choosing readers, controllers, and credential providers.
Just as internet standards enabled interoperability across the IT industry, open credential standards are helping create a more flexible ecosystem for physical access control.
Simplifying Credential Management
One of the biggest operational benefits of wallet credentials is the ability to manage access digitally.
Administrators can:
-
Issue credentials remotely within minutes
-
Revoke or update access instantly
-
Provide temporary credentials for visitors, contractors, or projects
-
Scale access programs without producing physical cards
This shifts the focus from managing physical objects to managing digital identities, bringing physical access closer to the flexibility organizations already expect from IT systems.
Looking Ahead
The transition from plastic cards to wallet-based credentials is part of a broader digital transformation already seen in payments, identity management, and cybersecurity.
For organizations evaluating the future of access control, the key considerations are no longer whether mobile credentials will become mainstream, but how to implement them in a way that delivers security, interoperability, and long-term flexibility.
Plastic cards will continue to play a role for some time, but their importance is gradually declining. Wallet-based credentials, built on open standards and modern security principles, represent a more scalable and future-ready approach to managing physical access. Organizations that begin preparing for this transition today will be better positioned to meet tomorrow's security and operational requirements.
In TACC’s community, Rodney Thayer recently asked what tools a physical security installer actually needs to carry.
His list started with a laptop—one the technician is allowed to install programs on, connect through USB, and attach to a network.
We love discussing intelligent buildings and autonomous workflows. Meanwhile, picture the installation: someone balancing on a ladder with a battered ThinkPad and a configuration utility that looks personally offended by the retirement of Internet Explorer.
In the same issue, TACC asks: “The technology is ready. So why is adoption still lagging?”
What did we test before declaring it ready?
Engineering teams declare technology ready the moment the API returns 200 OK on a bench test.
When that workflow depends on a technician arriving with local admin rights, undocumented utilities, and permission to connect wherever necessary, engineering has pushed its unresolved dependencies into the field.
Experienced installers cover those gaps. They remember which undocumented error means power-cycle the reader. They know which software build crashes over USB. Their expertise keeps deployments moving. It can also make unfinished product delivery look like a repeatable process.
That debt becomes harder to ignore when we ask AI agents to perform the work.
Consider a firmware update that loses communication halfway through. Did the device reject the package, finish installing, restart successfully, or enter a recovery state?
Conversational fluency cannot supply the missing evidence. If the tool reports only that the request was accepted, an agent can mistake successful submission for successful completion. The dashboard celebrates while the technician reaches for the ladder again.
Treating an installer's unmanaged laptop as a mandatory configuration tool is an architectural relic. Transport and local connectivity are solved problems and relying on a technician's machine to bridge those gaps exposes both the customer and the product.
Hunting for a driver or unlocking a USB port provides no equivalent assurance. Neither does connecting a laptop establish that the machine is secure.
The backlog should reflect the actual conditions of delivery:
1. Run updates over degraded and interrupted connections, and verify the device’s resulting state.
2. Make installation and maintenance work within the intended customer’s security policies, with documented requirements.
3. Expose machine-readable progress, failure, uncertainty, and recovery states.
4. Enforce privileged actions independently of the agent, binding any required approval to the operation being performed.
5. Secure systems in a way that is resilient to, or detects and manages, insecure elements.
Before asking AI to run a deployment, engineer a workflow whose outcome can be established and whose failures can be recovered.
Let the laptop become optional. Keep human judgment and deliberate approval where they earn their place.
👀 As Seen In the Secured Community 👀
💼 Jobs & Opportunities
Brian Karas is looking for someone who can combine the skills of a Sales Engineer, Project Manager, and Integration Hacker. He has a few people in mind but are open to recommendations from the community. Interested or know someone who might be a fit? Reach out!
🤖 AI & Technology
Michael Miller shared, from an integrator perspective, a community member shared that his team has been diving deep into AI, MCPs, APIs, and how to connect everything together. He's looking to connect with others exploring these technologies and discuss how they’re being applied in the field. Reply here.
🔐 Identity & Privacy
Sal D’Agostino shared a New York Times article on Meta’s penalty in New Mexico, bringing data privacy and accountability into the conversation. Read here.
📰 Industry News & Insights
Lee Odess shared an unconfirmed rumor about Siemens potentially acquiring JCI’s access products. This is still speculation, but it raises questions about what could be next for the industry. See post.
💬 Interesting Topics
Tony Dong shared a question about Arlo Technologies, one of the mid-cap companies in the industrials space, and asked whether anyone has firsthand experience with its products. Reply here.
📣 Shameless Plugs
Jon Polly shared that CONSULT ProTecht Solutions Partners was awarded the Eliott A. Boxerbaum Award for Security Design Project of the Year. He credited the relationships and collaboration within the industry for helping make the project possible, and asked the community to reflect on the power of the rooms they’re in. See the post here.
📅 Events
Jon Harris is bringing back the ISC East Happy Hour at Beer Authority on Wednesday, November 4, tentatively scheduled for 5–6:30 PM. He’s teaming up with Jon Uren for an evening of appetizers, drinks, and community. More details to come once confirmed.
Lee Odess shared takeaways from Securing New Ground, comparing different perspectives on AI and disruption from Genetec CEO Pierre Racz and MC Dean CTO Eric Dean. Lee sees a contrast between a more defensive approach and an integrator ready to embrace disruption, asking what that shift means as physical security moves into a much larger market. He also shared a write-up of the event’s lunch roundtables. Read here.
🗣️ General
Jon Polly shared an article for Security Business Magazine exploring how trust and data privacy are shaping debates around ALPR and biometrics. The argument: the underlying issue may not be the technology itself, but the trust lost when data privacy is compromised. Read here.
The Secured Lounge November 4–5, from 10 AM–4 PM! Come hang out with us!
The Secured Lounge, built in partnership with RX Global at ISC East, is a creator space for interviews, live “Convince Me” debates, and recording your own content. Stop by to record, take photos, or hang out with coffee in the morning and a bar in the afternoon. Check the collective for more information & access to the sign up form.
ACS26 was just two weeks ago.
It truly was something special, and we couldn’t have done it without our Collective. Huge thanks to Gallagher, Safetrust, and ColorID for helping make it happen.
We can’t wait to share the live sessions with you. And ACS27? We’re already planning it, and it’s coming back around very.... very soon. 👀
🗣️ Your Voice Matters.
Share your feedback, suggest topics, and tell us what questions we should be answering. Help us shape future issues and contribute to the conversations that move the industry forward.
PS: I am sure some of you may forward this, but please do so sparingly and encourage others to sign up here: https://www.tacc.me/secured Thank you!
