New Envoy Research: 44% of High-Security Workplaces Can't Say Who Was in Their Building Yesterday

SAN FRANCISCO, September 22, 2026 — Envoy today released "The State of Physical Security & Compliance," a new, comprehensive research report revealing that most organizations have no single, persistent identity for the visitors and contractors moving through their buildings — and that most have already experienced a real physical security incident despite high confidence in their programs. 

The findings draw on two independent 2026 studies that interviewed 782 enterprise compliance leaders and 294 leaders at frontier AI labs, defense-tech firms, and biotech/medical R&D sites – the organizations with the most to protect.

The research shows a wide gap between confidence and coverage. 44% of leaders at high-security workplaces say they cannot confidently state who was in their building yesterday. 79% report at least one unauthorized or unverified person in a workspace where they shouldn't be in the past year. Across both studies, 71–72% give contractors no single identity that follows them across locations. And despite that exposure, 62% say they're confident they'd pass a compliance audit today with no preparation.

The confidence is real. The coverage is not. 

The numbers tell a consistent story across both studies: 

• 44% of leaders at high-security workplaces can’t confidently say who was in their building yesterday
• 79% report at least one unauthorized or unverified person in a workspace where they shouldn't be in the past year.
• 71-72% give contractors no single identity that follows them across locations
• Yet 62% are very confident they’d pass a compliance audit today with zero preparation

That confidence gap holds even as security programs mature. In the sensitive-workplace study, 58% of leaders believe their program would stop an unauthorized person from entering, yet only 52% have badge control on sensitive doors and just 47% escort visitors at all times. In the separate enterprise compliance study, audit confidence peaks at single-site organizations (71% very confident), but drops to 58% the moment a second site enters the picture — the exact point where identity stops following a person from building to building.

No industry has solved it

The gap widens further by industry. Healthcare organizations give contractors a single identity across sites only 22% of the time; manufacturing, 26%. Financial services (31%) and technology (30%) fare modestly better, but no industry clears even one in three. Scale doesn't fix it either: even organizations with 20+ sites still fail to give most contractors a persistent identity, at just 32%.

The stakes: what’s actually on the line

For leaders protecting the most sensitive work in the country, the exposure is direct: 

• AI models and training data top the list of intellectual property they fear losing (18%), narrowly ahead of client data (17%) and proprietary research (16%) 
• 39% have personally seen a visitor or contractor reach a restricted area
• 28% have seen someone view or photograph work-in-progress on whiteboards, screens, or prototypes
• 67% are concerned about intentional insider exposure and 66% about unsupervised contractors — the exact threats current controls handle worst

"In our facilities, we're not just protecting a building but protecting technology that has national security implications," says Tim Carr, Senior Security Manager at Attalon, one of more than 16,000 workplaces that use Envoy to support security and compliance. “Knowing exactly who's on-site at any given moment, and being able to prove it after the fact, isn't a compliance checkbox for us, it's core to how we operate. This research confirms what we see every day: confidence in a security program means nothing if you can't actually account for who came through the door."

Take a closer look‍

‍Want to dig deeper into the findings? Read "The State of Physical Security & Compliance" for the full research, then join Envoy on October 7 for a live webinar exploring what the data reveals and what it means for physical security and compliance leaders.

About Envoy

Envoy empowers over 16,000 workplaces and properties around the globe to redefine how their workplaces run. We connect people, spaces, and data in one seamlessly integrated workplace platform, providing a single solution to manage every aspect of any facility, anywhere. Companies of all sizes can deliver unrivaled employee and visitor experiences to optimize working together in-person. By capturing data and space usage across multiple sources, we help customers make informed workplace resourcing and investment decisions–all while supporting the requirements of operating a secure, safe and fully compliant workplace. We power the places where people work best together.