For years, physical security and cybersecurity operated as parallel disciplines. Facilities teams managed badges, doors, and visitors; IT teams managed credentials, endpoints, and networks. That division made sense when employees occupied fixed desks in a single office and most digital access began beyond the building’s walls.
Hybrid work has blurred the lines between those roles. “There used to be two separate jobs,” says Jason Mordeno, Director of Compliance and Security at Sign In App.
“You used to have locks and guards on one side physically and then, digitally, you had firewalls and passwords on the other.”
But hot desking, multi-tenant sites, contractors, and occasional suppliers have made workplace access more fluid, creating more opportunities for bad actors to blend into the flow of people coming and going. For companies, that means rethinking physical access and cybersecurity as parts of the same risk model and examining the weaknesses that emerge when they are managed separately.
Flexible Access Creates a Quieter Attack Path
A physical intruder does not necessarily need to breach a firewall to create a cyber incident. Physical access can enable a range of low-cost attacks, including connecting an unknown device to a meeting-room network, leaving a malicious USB drive where a helpful employee might use it, accessing an exposed laptop, viewing printed documents, or reading information left visible on a whiteboard. Even copied or poorly managed badges can turn a small lapse into repeated unauthorized access.
The human element makes this route particularly difficult to police. An unauthorized person may attract little scrutiny once inside an office, especially in busy shared workplaces where staff do not know every colleague, tenant, or visitor.
That is because conventional building defenses often focus too heavily on the perimeter. As Mordeno explains:
“Most building defenses are designed to stop somebody arriving from the outside. But we should treat this as if the person’s already on the inside.”
This reframes the issue from securing a door to limiting what an individual who appears authorized can do after entering.
Legacy badge processes compound the risk. Permanent passes were designed for workforces with predictable attendance. But as Mordeno puts it, “One solution does not fit all anymore.” A permanent pass is poorly suited to temporary workers, suppliers requiring access for a single appointment, or employees moving between sites. When HR, facilities, and IT records do not update in sync, access can outlast the reason it was granted. Businesses therefore need a more targeted approach to keeping offices cyber-safe.
Turning Access Into an Identity and Risk Decision
The practical starting point is to apply a familiar cybersecurity principle to the physical environment: least privilege. Access should be granted for a defined purpose, location, and time window rather than through a broad, persistent credential. A contractor attending a one-hour meeting should not automatically receive all-day, building-wide access simply because that is how the badge system was configured.
But this approach depends on connecting data that organizations frequently hold in separate systems. Visitor registration, room bookings, access permissions, and live occupancy records can provide a clearer view of whether someone is expected, where they should be, and whether their authorized access period has expired. Sign In App’s platform, for example, supports preregistration, identity checks, visitor badges, and real-time site visibility. These capabilities can make entry controls part of a wider security workflow rather than an isolated reception task.
Pre-arrival checks matter because they move decisions away from a pressured front-desk interaction. Mordeno warns that AI has made convincing impersonation cheaper, from realistic voice calls to fabricated video. Verification should therefore not rely solely on a familiar-sounding request. Document checks, approvals, and relevant watchlist screening can establish confidence before an individual reaches an office, while clear retention and privacy rules can prevent monitoring from becoming excessive.
Accountability must also cross departmental lines. Facilities may operate the building, IT may manage the network, and HR may maintain joiner and leaver records, but Mordeno says an executive should own the risk across these functions. This is more than operational tidiness. NIS2 requires in-scope organizations to take proportionate measures covering areas including physical and environmental security, access-control policies, and human resources security, while placing oversight responsibility on management bodies. These governance expectations point to what businesses should watch next.
Compliance Will Make Joined-Up Evidence Essential
The regulatory direction is clear, even where local implementation differs. Under NIS2, significant incidents may require an early warning within 24 hours and a notification within 72 hours. A physical access event is not automatically reportable simply because it occurred, but it can become important evidence when unauthorized access contributes to a cyber incident, operational disruption, or material harm.
That raises the value of accurate, retrievable records. During an investigation, organizations need to establish who entered, when they arrived, where they were permitted to go, and what controls were applied. Fragmented sign-in sheets, disconnected badge systems, and outdated access lists make that task slower precisely when incident responders and regulators need a defensible account.
The broader lesson is not that every office should become a high-security site. It is that organizations should calibrate controls to risk while recognizing that a reception desk, meeting room, and door reader may now sit on the same security chain as identity systems and endpoint protection.
