The State of Physical Security & Compliance

Ask the leaders doing some of the most sensitive work in the world whether their program would stop an intruder, and most say yes. Ask what is actually instrumented behind that confidence, and the number drops. A net 58% believe their program would prevent unauthorized physical access, yet only 52% have badge control on sensitive doors and only 47% escort visitors at all times.

The belief is running ahead of the build. And confidence is not universal. The same question that produces a 58% majority also leaves 42% who will not say their program would stop an intruder, including 35% who actively doubt it. The picture splits two ways: a slight majority who feel protected but have not built the controls to be, and a large minority who already know they are exposed.

In practice, the security controls in place vary considerably. Badge or key-card control on sensitive doors is present at just over half. Escorting visitors, capturing a government ID, revoking a terminated employee’s access within a day, and maintaining an auditable visit record are each used by fewer than half. These controls will not be appropriate in exactly the same way for every environment, but together they show how differently organizations approach identity verification, access governance, and evidence.

The research shows a wide range of physical security approaches. In the sensitive-workspace study, 92% lack at least one of five common controls measured across identity verification, access governance, and documentation. That doesn't necessarily mean those organizations are insecure. Different environments require different controls based on their risks, operations, and compliance obligations.

Confidence stays high across both studies. In the broader compliance study of 782 enterprise leaders, 62% are very confident they could pass a physical-security audit today with no time to prepare, and another 34% are somewhat confident.

Taken together, the findings shift the question from whether organizations have the "right" set of controls to whether the controls they choose work together, are consistently applied, and can be demonstrated when needed.

The cleanest test of a physical security program is a simple one: can you say who was inside yesterday?

For 44% of leaders doing some of the most sensitive work across industries, the answer is not a confident yes. That lack of visibility also shows up in day-to-day operations. More than a third (35%) personally saw someone within the past month they didn’t recognize and weren’t sure should be there, while one in five (19%) still rely on paper logbooks for visitor sign-in.

An unfamiliar face is not necessarily a security threat. It could be, but the real question is whether teams can quickly establish who that person is, why they are there, and whether they are authorized to be onsite.

The number is not an abstraction. When 44% cannot confidently reconstruct a single day, investigations and audits become harder because teams may have to piece together who was present from multiple records. The security value of presence data is the ability to move from who was expected or approved to who was actually onsite.

The challenge isn't simply noticing someone unfamiliar. It's having enough visibility to resolve that uncertainty quickly, without piecing together information across systems, locations, or records after the fact.

An unfamiliar person is not automatically a threat. But the data also captures situations where uncertainty becomes a clear access-control problem. Two in five (39%) leaders have personally seen a visitor or contractor reach a restricted physical area, and 28% have seen someone view or photograph work-in-progress on whiteboards, screens, or prototypes. These incidents show why identity must continue to stay connected to authorization after check-in, not stop at the lobby.

Ask how often unauthorized or unverified access occurs and the frequency is striking. Four in five leaders (79%) report at least one instance in the past year of an unauthorized or unverified person ending up in a workspace where they should not be. Only 21% say it never happened.

The broad enterprise reports related failures in different forms. In the compliance study, organizations report visitors not properly signed in (29%), employees unable to identify themselves at check-in (28%), visitors who could not be verified (22%), and unauthorized people in restricted areas (13%). Together, the findings show that access risk can emerge at verification, admission, and movement through the workplace.

Identity continuity does not mean access continuity. A contractor known at one facility should not automatically receive the same access at another. Different sites, zones, projects, and types of work may require different approvals, training, screening, escorts, credentials, or time-bound access.

What should carry across locations is the ability to know you are dealing with the same person. Yet 71% of enterprises do not give contractors a single identity across locations, while 72% of sensitive-workspace organizations do not maintain a single visitor record across sites.

These findings come from two different studies and measure different populations, but they point to a similar challenge: maintaining enough identity continuity to understand who someone is while adapting authorization to the context. Who someone is can remain consistent while what they are permitted to access changes based on their role, location, risk, and purpose.

Identity continuity also does not require every record to be centralized or retained indefinitely. In regulated environments, privacy, data segmentation, retention, and facility-specific requirements may shape how identity information is managed across locations. The security objective is to maintain enough continuity to recognize and appropriately govern the same person while applying the controls each environment requires.

The two studies used different instruments and never shared a respondent, so the near-match is not an artifact of pooling. It is two separate samples pointing to the same challenge: identity continuity across locations remains uncommon. The rest of this chapter stays inside the compliance study, where the larger sample lets us see how that challenge varies by industry and scale.

The compliance study shows meaningful differences across industries. Identity continuity is least common in healthcare, where 22% give contractors a single identity across sites, followed by manufacturing at 26% and financial services at 31%. These figures should not be read as a universal security score: some organizations deliberately require site-specific credentialing. The operational question is whether teams can recognize the same person while still applying the right site-specific controls.

These figures should not be read as a universal measure of security maturity. Lower cross-site identity continuity may reflect deliberate choices around privacy, data segmentation, credentialing, retention, and facility-specific requirements, particularly in regulated environments. The survey does not tell us why organizations chose a particular architecture.

The more important security question is whether teams can recognize and appropriately govern the same person across locations while maintaining the controls each environment requires. Identity continuity does not require universal access, identical policies, or every record to be centralized and retained indefinitely.

Scale doesn't eliminate the challenge. The largest estates report slightly more identity continuity, but even at twenty or more sites, most organizations do not give contractors one identity across locations. As environments grow more complex, organizations must balance cross-site visibility with site-specific authorization, privacy, retention, and compliance requirements.

Fragmentation is part of the operational challenge. 74% of enterprises run two or more visitor-management systems and 46% run six or more. As sites, acquisitions, and local processes accumulate, identity and access records can end up distributed across multiple tools.

Access risk shows up across both studies, although each measures it differently. In the compliance study, 68% of organizations reported at least one physical-security incident in the past year. In the sensitive-workspace study, 78% reported an unauthorized person reaching a restricted area.

High security does not buy safety. It raises the cost of getting it wrong. Organizations protecting sensitive research, technology, infrastructure, and intellectual property still report unauthorized-access incidents. Their security requirements may be more rigorous than those of a typical workplace, but higher sensitivity also increases the importance of applying the right controls to the right people, places, and situations. The frontier AI labs and defense-tech firms in the sensitive-workspace study report incidents at rates even with, or above, the ordinary offices in the compliance study.

The entry-level failures are only half of it. A second cluster of incidents comes from access that should have ended and lingered: a compliance gap surfaced during an audit (24%), a former contractor who kept access after the work ended (21%), a former employee who kept access after leaving (20%). The front door held. The memory behind it lapsed.

Access that outlives an engagement shows up in both studies, measured in different ways. In the compliance study, 33% reported a former contractor or employee retaining access. In the sensitive-workspace study, 31% are not confident a departed contractor loses access promptly. Together, the findings point to the importance of time-bound access and reliable revocation.

Between incidents sits a daily operational burden. When identity, access, and presence data live across separate systems, security teams become the integration layer. Pulling access logs in a normal week means checking six or more separate systems for 49% of enterprises.

That reconciliation costs real hours. 56% of teams spend six hours a week or more on manual physical-security tracking, before an audit even begins. During an active audit, the burden spikes. The issue is not only efficiency: fragmented evidence can slow the team's ability to establish what happened and demonstrate that the right controls were followed.

The pain of audit prep is not the paperwork itself. It is the scramble to assemble evidence that lives in too many places at once. A connected security chain makes that evidence easier to produce on demand.

Here is where the data gets interesting. Confidence remains high even as organizations continue to experience physical security incidents. In the sensitive-workspace study, 58% believe their program would stop an unauthorized person, while 83% say their physical-cyber budget balance is about right. In the compliance study, 62% are confident they could pass an audit today with no preparation. Yet 63% of that very-confident group also experienced an incident this year.

An incident doesn't necessarily mean a security program failed. But the findings raise a more important question: when something does happen, can organizations quickly demonstrate who was involved, what they were authorized to access, and whether the right controls were followed?

In the compliance study, audit confidence is highest among single-site organizations at 71%, falls to 58% among organizations with two to four sites, then rises to 63% for five to 19 sites and 61% for 20 or more. The pattern suggests that multi-site complexity may affect confidence, but the survey does not establish fragmentation as the cause.

Ask more specific questions and the evidence challenge becomes clearer. 44% of sensitive-workspace leaders cannot confidently say who was in their building yesterday. At the same time, 83% say their physical-cyber budget balance is about right and only 12% say they underinvest in physical security. The takeaway is not necessarily that budgets are wrong; it is that investment alone does not guarantee connected visibility or proof.

Physical and cyber teams 'coordinate closely' at 82% of compliance-study organizations, yet the research still finds gaps in presence visibility and access lifecycle management. The threats leaders rank highest, including insiders and unsupervised contractors, reinforce the need to connect identity with authorization and ongoing presence rather than treating entry as the end of the security process.

This gap would matter anywhere. It matters most here, where teams are developing the most sensitive work in the world. When we asked what these leaders most fear losing, AI models and training data top the list, narrowly ahead of client data and proprietary research. No single asset dominates, which means the physical program has to defend a wide front.

And the worry runs inward. Two-thirds are concerned about contractors in spaces unsupervised and about insiders exposing information, whether by intent or by mistake. These threats reinforce why identity alone is not enough: organizations also need appropriate authorization, visibility into actual presence, and reliable access lifecycle controls around sensitive work.

Cost is not the leading reason respondents give for missing controls. In the sensitive-workspace study, 58% say they had considered missing capabilities but had not prioritized them, compared with 31% citing implementation resources and 21% citing expense. Another 9% did not know the more advanced capabilities were an option at all. The findings suggest that prioritization and implementation capacity matter alongside budget.

The compliance study adds another dimension. When leaders rank what is blocking better physical security, complexity of compliance requirements tops the list at 39%, followed by budget constraints at 32%. Fragmented or outdated tools (26%) and fragmentation across sites (25%) also rank among the barriers. The data points to a mix of complexity, resources, prioritization, and tooling rather than a single cause.

Asked what they need most, teams point to capabilities across the full security chain: real-time visibility into who's on-site, integration between physical and cyber, faster incident response, automated compliance logging, better visitor and contractor verification, and a single identity record across sites. Taken together, the priorities are less about one missing tool than about connecting identity, authorization, presence, response, and evidence.

Close the gap.
Know who is in your building.

Who we surveyed

Two separate studies, nearly 1,100 leaders, analyzed separately and compared.

Research powered by

79% were the primary decision maker for physical security, and 86% described their knowledge of protocols and spend as extensive.

All respondents worked in technical departments, product and engineering, per the study’s screening criteria, and all held direct physical-security responsibility. 87% operate under formal hybrid or flexible work policies. Company size skewed mid-market to enterprise, with roughly three-quarters at 501 or more employees. Geographic breakdown is drawn from panel-provider data for this sample.

Methodology