Volume 13

🎙 Secured Podcast

Episode 38 | The Partner Portal is Dead
This week on Secured, Lee Odess covers major industry acquisitions, the latest earnings, Genea's expansion into video, and Brivo's new MCP server. Plus, why IT systems integrators are moving into physical security and what it means for the industry's future: access control is becoming part of a much bigger platform. Listen here.

🎤 Secured Events | Secured Lounge @ ISC East
Built in partnership with RX Global at ISC East. The Lounge facilitates a creator space for interviews, live “Convince Me” debates, and recording your own content. NEXT WEEK. November 4th & 5th. See below for more details.

🫣 Premium Content

Lee and Lance Smith sit down for a conversation | The Most Underappreciated Part of Physical Security.
Lee sits down with Lance Smith of Badlands to talk about locksmithing, building and acquiring security businesses, and what it takes to move the industry forward without losing sight of the people behind it. Watch here.

📰 The Access Control Executive Brief 158 by Lee Odess | Go All In

At the Brivo Cloud Summit in Dallas, Lee challenged integrators to rethink the beliefs and business models that have shaped physical security for the past 30 years. From enterprise software and AI to the future of integration, he shares why the next 30 years will require a different approach and one action integrators can take today.

✍🏻 Articles

Kabir Maiga | Beyond Credentials, part 1 of 7: The door doesn’t have to issue the credential
What if access control didn't require issuing a credential at all? Kabir Maiga explores how digital identity could change the way we think about access, shifting the focus from managing credentials to verifying the people behind them.

Michael Stuer | Who decided that? Who can go where, and should they still?
Automating access doesn't necessarily mean making better access decisions. Michael Stuer examines how outdated permissions can persist unnoticed and why organizations need to understand not just who can enter, but who decided they should be able to.

Pan Kamal | Streamlining Turnaround Contractor Surges with PIAM Software: The Turnaround Challenge
When industrial plants shut down for maintenance, their workforces can surge from hundreds of employees to thousands of contractors almost overnight. Pan Kamal explores how physical identity and access management can help streamline onboarding, verify qualifications, and maintain visibility throughout the turnaround process.

Billy Paton | Should Technology Adapt to People, or Should People Adapt to Technology?
The newest technology isn't always the right solution, especially when accessibility, existing infrastructure, and individual needs vary from building to building. Billy Paton challenges the industry to start with people and their needs, rather than expecting people to adapt to the technology.

🚨 Breaking News

Secured: Episode 38

This week on Secured, Lee Odess breaks down the latest earnings from the industry's biggest lock companies, the private equity acquisition of Johnson Controls' intrusion business, and Genea's move into cloud-native video. Plus, Brivo's new MCP server signals a shift in how integrators interact with security systems and data. Lee also shares why the rise of IT systems integrators in physical security isn't just a trend, but a sign of a much bigger shift. As access control becomes part of a broader platform experience, the question is: will you be the platform customers build around, or the system they work around? Listen here.

Shared last week, don’t miss it!

Everything in physical security eventually comes back to the door. Lee sits down with Lance Smith of Badlands to discuss locksmithing, building and acquiring security businesses, and moving the industry forward without losing sight of the people behind it. Watch here

I just gave a new talk at the Brivo Cloud Summit in Dallas this week, and it was the first time I've taken something I wrote (the single-sourced integrator piece) and turned it into a presentation on its own. Most talks that give over and over until they wear grooves in my brain. This one was new, so what I was most looking forward to wasn't the talk itself... it was the response.

It's also always a bit of a homecoming for me, since my security story started at Brivo. Walking into the stadium the night before, I felt like the company finally showed up at the size of who it actually is (there has always been a humbleness to that organization, and this time it was on full display).

I opened by asking how many people in the room were single sourced Brivo dealers. A handful of hands went up. That was the point of the talk, really. The handful was right there, and the question was what the rest of the room would do with what they already believe.

So what did I actually say? The core argument is that our industry runs on beliefs because we have almost no data (we all hallucinate the same $10 to $12 billion market number and nod along). Without data, your beliefs drive your direction, and I laid mine out plainly:

Software is the center of gravity, and we are an enterprise software industry applied to security.
AI is taking configuration off your plate. What else will it do?
Manufacturers now create demand directly with end users (get over it. Embrace it. Use it to your advantage)
Customers expect the enterprise software experience.

If you believe those 4 things, certain things must follow, and the biggest one is that the math has changed. Lines carried x bids chased x win rate x project size built the last 30 years. Accounts on your platform x modules per account x retention x services margin will build the next 30. The numerator and the denominator both changed this time, which is why shoving new stuff through old constructs keeps producing old results.

I also said something I don't think gets said enough: it's ok to stay the same. The legacy business will be around until most of us are retired (or dead), and someone will happily grow 5 to 8% selling on-prem, non-mobile, non-AI everything. Just understand what comes with that choice, and don't hold back the people who want to go after something different.

Then I asked the room how many were certified in Workday... Google Cloud... Salesforce? No hands went up. That’s more important than anything I said…I'll come back to it.

Was it perfect? No. I went long (sorry, Brivo), and at one point I banged through all 4 belief slides in a single breath before realizing I'd skipped ahead of my own deck. That's what happens when you care more about the argument than the slides (and lack a rehearsal or tried it before).

What happened next is why I love what I do. Within an hour of walking off stage, I had 2 messages waiting (an email and a LinkedIn DM). One came from someone at an integrator who said their business already mirrors what I described and asked for an hour next week to see how they can accelerate it. The other came from a leader 9 weeks into a new role at a doors, frames, and hardware company. They were brought in to build out the security and access control side (Division 28) on exactly the model I described: let the existing business fund the new one until the new one becomes the larger side of the company. They told me they come in with deep leadership experience and virtually no access control background... and that they see that as an advantage, since there are no old habits to break.

I agree with them. That is the 5'5" guard and 7' center point (from my talk track) in real life. You don't coach the existing team into something they aren't. You draft for the new game, give it its own P&L, and let it run. Sometimes the best person for the new division is someone who never learned the old truths in the 1st place.

And then, on the way out, someone stopped me and asked, "What's the one thing I can do?" My answer was to go get certified in one of the big enterprise software platforms (Salesforce, Workday, Google Cloud, Microsoft, pick one). It won't change your line card on day one, but I bet it changes how you operate, how you talk to customers, and how you see your own business. It is the fastest way I know to stop being a security integrator and start becoming a systems integrator, and the people coming into our market from enterprise IT already think that way.

The next 30 years have little to do with the past thirty, and the room in Dallas proved to me that more people believe that than the loudest voices in our industry would have you think.

You believe it? Act on it.

Let me start with an example I use a lot. Two thousand years ago a guard stood at a gate with no technology. He had instructions from whoever owned the place: Jonathan has access. When Jonathan showed up, the guard recognized him with his own eyes and let him in. That’s access control. Identify the person, check what they’re allowed to do, decide.

The moment we put a machine on the door, that broke. A reader can’t recognize Jonathan. So we gave him a token the reader could recognize and attached his permissions to it. That’s the birth of the credential. Every generation since, cards, fobs, Bluetooth, NFC, changed the user experience. None of it changed the architecture. We issue a thing, then we verify the thing we issued.

Here’s what’s different now. For the first time, Jonathan can exist digitally in a form the door can trust. A mobile driver’s license, a digital passport, a national ID: a government has already proofed him, bound that identity to keys, signed it, and put it in the wallet on his phone. When he taps, he proves with cryptographic certainty that an issuer we trust says he’s Jonathan. Which puts us right back at the gate. Recognize the person, check what they’re allowed to do, decide. We didn’t issue anything.

Think about what falls away when you don’t issue. Enrollment. Provisioning. The help desk for whatever got lost. Lifecycle management as people join, change roles, and leave. The whole orchestration dance of texting someone a link so they can sign into something and hunt for the add-to-wallet button. All of that exists because we had to manufacture the token. If the token already exists and somebody else maintains it, I’m out of the issuance business. That’s it.

The paper states this precisely, and the precision matters because the loose version is wrong. Issuing a credential creates a standing obligation that lasts as long as the credential does and grows with every one you issue. Verifying one creates no obligation at all. A verification happens, produces a decision and an audit record, and leaves nothing behind to tend. The issuing side of this industry carries a portfolio it maintains forever. The verifying side carries nothing between transactions. That isn’t a smaller cost. It’s a different shape of cost.

Now the part people get wrong. This doesn’t eliminate issuance. It moves the expensive part. Identity proofing, device provisioning, recovery, the work that actually costs money, moves to the government that already does it as public infrastructure. Your bank consumes the plastic license in your wallet every day and never paid a dime for it. What’s left for an organization to issue isn’t an identity. It’s an authorization: this person works here, holds this role, can get into this area until this date. No government encodes that, because it isn’t an identity fact. It’s a relationship between you and the person, and only you can attest to it. An authorization is a far lighter thing than a credential. No proofing, no provisioning, no recovery, usually short-lived.

I’ll also say plainly what this isn’t. It isn’t a replacement. Physical and mobile credentials remain the right answer for plenty of environments, and a single-modality product has never made commercial sense in this industry. This is a third modality, the one we never had shared infrastructure to consume. The paper’s claim is narrower than replacement and more durable for it: the architecture is cleaner, its cost scales with access events instead of credentials outstanding, and as government identity reaches more people, new deployment drifts toward it.

Three things I’ve seen recently tell me where this is going. A member of our working group walked up to a standalone lock, presented the license his state issued him from the wallet on his phone, and opened the door. Nobody enrolled him. One major wallet’s latest release offers, after a first presentation, to remember the disclosure so it stops prompting on every tap; consent at access tempo is a problem the paper lists as still in development, and the platforms are working it from their end. And in a meeting not long ago, a CEO opened the wallet on his phone and found his state license already in it. He hadn’t known. A lot of people are carrying the credential and don’t know it yet.

What makes this deployable instead of merely possible is the layer between the credential and the door: knowing which issuers and verifiers count, a shared format for what the verifier attests, a registry that resolves trust across credential types, governance for extending and revoking it, and the operational properties a regulated site needs. That layer is what the NFID Foundation exists to specify, and it’s what the next six pieces in this series are about.

The way we tap to pay everywhere we go, we’ll tap to ID everywhere we go. The door is one of the places it happens.

A new technician starts in the maintenance team on a Monday. Ten years ago that meant a form, a signature from her manager and a walk to the key desk. Now most of it happens before she arrives. HR creates her record, the access control system pulls it in overnight and by seven her card opens everything the maintenance group opens. Nobody had to do a thing and that’s pretty much what our industry has spent a decade working towards.

The maintenance group also opens the switch rooms and the roof. Someone set that group up by copying the profile of a caretaker who really did need all of it and every new starter since has inherited it. The system handed her a decision made for somebody else in 2019 and it did that perfectly.

I think that’s where most sites are now. We’ve got very good at handing out access and we haven’t got much better at deciding it. A cleaner feed from HR and a card on someone’s phone are both useful but neither tells you who decided she should have the switch rooms or whether that still holds a year later.

Even where the access control system takes its people straight from HR, the keys still go out at a desk on someone’s word. In her second week her card doesn’t open the plant rooms, so her supervisor signs a key out for her at the desk and the key register gets his initials. Now she holds access from two places. One came from a group nobody has looked at in years and the other from a supervisor on a busy morning. Neither says why.

Cybersecurity has been through this already. Accounts used to be handed out and forgotten the same way until deciding who gets access and setting it up became two separate jobs. The person who owns a system decides who should be in it, IT sets up the access and every few months somebody has to confirm it should still stand. Some sites already make that split for cards and some key desks run an approval for the sensitive keys. The yearly key check, where there is one, confirms she still has the key, not that she still should.

Deciding means the organisation says who should be able to open what, for what reason and until when. It says it once, whether the door takes a key or a card. So when a new security lead asks why, there’s an answer with a name and a reason on it.

You decide who can go where. We call that access authority.

She’ll be fine. Her card works, her supervisor trusts her and the work gets done. She can also open the switch rooms, and the only decision behind that was made for a caretaker in 2019.

Large process plants in oil and gas, refining, and chemicals periodically shut down units for planned maintenance, inspection, and upgrades. These turnarounds (also called shutdowns or outages) may last a few weeks and cost an operator millions of dollars per day in lost production, so schedule is everything.

A turnaround also changes the plant's workforce overnight. A site with several hundred employees may host thousands of contractors: pipefitters, welders, scaffolders, insulators, inspectors, electricians, and specialty service crews. Many have never been on site, work in shifts around the clock, and arrive in waves as the work scope unfolds.

Traditional approaches struggle with this surge:

Mobilization bottlenecks. Badging and orientation queues with huge backups at the gate delay crews who are being paid to wait.
Document chaos. Training records, fitness-for-duty results, and background checks arrive from dozens of contracting firms in inconsistent formats.
Qualification gaps. Confirming that each worker holds the right certifications for hot work, confined space entry, or work at height is hard to verify at scale.
Poor headcount accuracy. In a hazardous environment, not knowing who is inside the fence is a serious safety risk.
Demobilization drift. When a crew finishes, badges often stay active long after the work is done.

How PIAM Software Helps

Physical Identity and Access Management (PIAM) software manages the full lifecycle of a person's physical access: request, vetting, approval, credentialing, monitoring, and removal. It connects the systems that matter during a turnaround, including access control, visitor management, contractor qualification and training records, and HR or procurement data, under one set of rules. This turns turnaround onboarding from a manual scramble into a repeatable, auditable process.

Pre-Turnaround Planning and Bulk Pre-Registration

Weeks before shutdown, contracting firms can submit worker rosters through a self-service portal. Workflows route each request to the right approvers, and security, EHS, and operations see the same data. Workers arrive already vetted, so gate processing becomes a quick verification and badge issuance rather than a paperwork exercise.

Qualification-Based Access

Access can be tied directly to verified qualifications. Site safety orientation, H2S awareness, confined space and hot work training, medical clearance, and background screening can all be required before a credential is activated. If a certification expires mid-event, access can be restricted automatically. Compliance becomes a built-in control rather than a manual check, supporting contractor safety obligations under frameworks such as OSHA's Process Safety Management standard and equivalent regional regulations.

Zone and Schedule Control

Turnaround scope is organized by unit, and different crews need different access. PIAM supports least-privilege rules by area, shift, and date range, so a crew working on one unit does not automatically have access to adjacent operating units. Time-bound credentials align access with the work schedule and shift patterns.

Integration with Permit-to-Work Processes

Permit-to-work systems govern high-risk tasks, while PIAM governs who may enter the site and specific zones. When the two are aligned, a worker whose training lapses or who is removed from a crew list can be flagged before a permit is issued or an entry is made. This tightens control over simultaneous operations in congested areas of the plant.

Real-Time Visibility and Emergency Readiness

Live dashboards show who is on site, by contractor firm and by zone. During an emergency, accurate muster reporting tells responders who is unaccounted for. Between emergencies, the same data helps planners monitor labor levels against the turnaround schedule and spot gaps early.

Rapid Demobilization

As work packages close, access can be revoked in bulk, by contractor, crew, or work order. Automatic expiration dates eliminate the lingering-badge problem, and badge returns can be tracked to completion. Because credentials are removed promptly, the plant returns to normal operations with a clean access environment.

Business Impact

Faster mobilization: Less idle crew time and smoother ramp-up at the start of the event.
Improved safety: Fewer unqualified workers in hazardous areas and better emergency accountability.
Lower risk: Reduced exposure from shared badges, tailgating, and stale credentials.
Audit readiness: A complete record of who was authorized, by whom, and with what qualifications.
Repeatability: Lessons and configurations carry forward to the next turnaround, and across multiple sites.

What you can do

Start early. Begin portal setup and contractor communication well ahead of mobilization.
Align stakeholders. Operations, EHS, security, procurement, and turnaround management should agree on requirements and ownership.
Standardize qualifications. Use consistent criteria across contractors and sites wherever possible.
Plan for scale. Confirm that badging capacity, gate throughput, and system performance can handle peak headcount.
Integrate key systems. Connect access control, training records, and permit processes before the event, not during it.
Finally, Adopt PIAM Software that has Contractor Management capabilities including the ability to hold contractor identities to complete the vetting process.

Turnarounds compress enormous workforce, safety, and compliance demands into a short, high-stakes window. PIAM software gives plant operators a structured way to onboard thousands of contractors quickly, verify qualifications, control access by zone and schedule, and close out access cleanly when the work is done, protecting both the enterprise and the people on site.

It's a question I've been thinking about while working across door entry and communication technology, particularly in housing.

Residents have different abilities, preferences and circumstances. Buildings have different infrastructure. Budgets vary, and existing systems may still have plenty of useful life left in them.

So why should introducing new technology automatically mean replacing what already works?

Start with the people, not the product

In our industry, it's easy to focus on what technology can do. New features, new platforms and new ways of connecting systems all create opportunities.

But before deciding what to install, shouldn't we first understand the people who will use it, the building it needs to work within and the problem we're trying to solve?

For residents, the best solution isn't necessarily the newest or most advanced. It's the one that works for them, fits their circumstances and allows them to use their home with confidence and independence.

For housing providers, that may mean balancing accessibility, reliability, cost and the practicalities of maintaining existing infrastructure.

These considerations should shape the solution from the beginning, rather than becoming problems to overcome after the technology has been chosen.

Flexibility means having options

I've been thinking about how technology can be applied in different ways to suit the requirements of individual buildings, particularly across housing.

Technology doesn't always need to operate in isolation or require everything around it to change. There can be real value in making different systems work together, retaining existing infrastructure where appropriate and introducing new capabilities without unnecessary disruption.

For me, this is why flexibility matters so much.

No two buildings are exactly alike, and no single approach will meet every resident's needs. A solution that works well in one setting may be entirely unsuitable in another.

Technology should create options, not unnecessary barriers.

Listen to understand

For manufacturers, installers, consultants and housing providers, this calls for a slightly different starting point.

Rather than beginning with a product and looking for where it fits, we should begin by listening, understanding the challenges and exploring the available options.

That means considering the resident experience alongside technical requirements, recognising the value of existing infrastructure and being prepared to approach different buildings and circumstances differently.

For me, that's what flexibility and inclusion should really mean: finding the right approach for the people, property and circumstances involved.

As an industry, we have an opportunity to do more than introduce new technology. We can help make homes more accessible, communication more effective and systems more responsive to the people who rely on them.

But that starts with understanding what is actually needed.

Should technology adapt to people, or should people be expected to adapt to technology?

I know which question I'd rather we started with.

Let's listen to understand, rather than listen to respond.

👀 As Seen In the Secured Community 👀

💼 Deal Activity

Lee Odess shared news that Thrive Holdings is acquiring ADT for $10.00 per share in an all-cash deal valued at $15.3 billion, representing a 45.6% premium. Apollo Global Management is providing the financing, with closing expected in Q1 2027.

ADT announced the acquisition, describing Thrive Holdings as a long-term holding company focused on investing in established businesses and advancing their capabilities through technology.

Lee highlighted the opportunity this presents as physical security continues its digital transformation. He also emphasized the importance of investing in recognizable, trusted industry brands, noting that brand drives awareness, and awareness drives growth. Read here.

📅 Events

Lee Odess shared that he and Hilary Gallagher will be attending Honeywell's Accelerate conference in Orlando in two weeks.

They'll have access to Honeywell's leadership team, customers, and other attendees for one-on-one conversations, as well as the opportunity to sit in on presentations.

Lee is looking to learn more about Honeywell's vision for “autonomous buildings,” how they plan to get there, and the current state of the LenelS2 integration.

What would you like them to ask or find out? Ask here.

The Secured Lounge opens up NEXT WEEK! November 4–5, from 10 AM–4 PM.

The Secured Lounge, built in partnership with RX Global at ISC East, is a creator space for interviews, live “Convince Me” debates, and recording your own content. Stop by to record, take photos, or hang out with coffee in the morning and a bar in the afternoon. Check the collective for more information. Come hang with us!

ACS26 was just two weeks ago.

It truly was something special, and we couldn’t have done it without our Collective. Huge thanks to Gallagher, Safetrust, and ColorID for helping make it happen.

We can’t wait to share the live sessions with you. And ACS27? We’re already planning it, and it’s coming back around very.... very soon. 👀

🗣️ Your Voice Matters.
Share your feedback, suggest topics, and tell us what questions we should be answering. Help us shape future issues and contribute to the conversations that move the industry forward.

Community input form!

PS: I am sure some of you may forward this, but please do so sparingly and encourage others to sign up here: https://www.tacc.me/secured Thank you!

Volume 13

Start with the people, not the product

Flexibility means having options

Listen to understand

Join Our Free Trial