The State of Physical Security & Compliance

Ask the leaders doing the most sensitive work in the world whether their program would stop an intruder, and most say yes. Ask what is actually instrumented behind that confidence, and the number drops. A net 58% believe their program would prevent unauthorized physical access, yet only 52% have badge control on sensitive doors and only 47% escort visitors at all times.

The belief is running ahead of the build. And confidence is not universal. The same question that produces a 58% majority also leaves 42% who will not say their program would stop an intruder, including 35% who actively doubt it. The picture splits two ways: a slight majority who feel protected but have not built the controls to be, and a large minority who already know they are exposed.

Look at what these organizations have actually put in place and the confidence looks generous. Badge or key-card control on sensitive doors, the single most basic instrument, is present at just over half. Escorting visitors, capturing a government ID, revoking a terminated employee’s access within a day: each is a coin flip. A single visitor record that persists across all sites, the thing that would let identity follow a person, exists at barely a quarter.

In fact, 92% are missing at least one of the five physical-security basics for sensitive work. Programs are being graded on intent, not on what is instrumented.

This is not unique to high-security labs. In the broader compliance study of 782 enterprise leaders, the same overconfidence appears: 62% are very confident they could pass a physical-security audit today with no time to prepare, and another 34% are somewhat confident. Near-total assurance, in a population where most had a real incident this year.

The cleanest test of a physical security program is a simple one: can you say who was inside yesterday? For 44% of leaders doing some of the most sensitive work across industries, the answer is no. And the lived experience backs it up. Over a third (35%) personally saw someone they didn’t recognize and weren’t sure should be there within the past month, and one in five (19%) still run visitor sign-in on a paper logbook.

The number is not an abstraction. It is the difference between being able to investigate an incident and not. When 44% cannot reconstruct a single day, the ability to prove who touched what, or to close a gap they cannot see, goes with it.

More than half of these leaders saw an unrecognized person inside within the past three months. This is a regular occurrence, not a rare one.

The unrecognized people aren’t staying in the lobby. Two in five (39%) leaders have personally seen a visitor or contractor reach a restricted physical area, and a fourth (28%) have seen someone view or photograph work-in-progress on whiteboards, screens, or prototypes. Unauthorized people ending up where they shouldn’t be is a regular occurrence, not a rare one.

Ask how often it happens and the frequency is striking. Four in five leaders (79%) report at least one unauthorized-access incident in the past year. Only 21% say it never happened.

The broad enterprise reports the same failures, in the same shapes. In the compliance study, the front-door breakdowns are just as common: a visitor who was not properly signed in (29%), an employee who could not identify themselves at check-in (28%), a visitor who could not be verified at all (22%). The specific ways people slip past the entrance are identical whether the building holds a frontier model or a filing cabinet.

If the sensitive-workspace study showed the sharpest edge of this problem, the compliance study shows its breadth. Among 782 enterprise leaders in physical security, compliance, IT, and facilities, the identical structural gap appears: identity does not persist across sites. 71% do not give contractors a single identity across all their locations. In the sensitive-workspace study, asked a different way in a different sample, 72% do not keep a single visitor record that persists across sites. The two figures land one point apart.

The two studies used different instruments and never shared a respondent, so the near-match is not an artifact of pooling. It is two independent samples describing the same missing layer. The rest of this chapter stays inside the compliance study, where the larger sample lets us see exactly where the gap concentrates.

The gap is deepest where the most third parties move through the building. Healthcare gives contractors a single identity just 22% of the time and manufacturing 26%, against financial services at 31%. No industry clears one in three.

Scale, which you might expect to help, barely does. The largest estates consolidate slightly, but even at twenty or more sites a strong majority still cannot give a contractor one identity.

The reason is sprawl. 74% of enterprises run two or more visitor-management systems and 46% run six or more. Each site, each acquisition, each lobby brought its own tool, and nobody ever connected them.

The consequence is not hypothetical in the broad enterprise either. 68% of compliance-study organizations had a real physical-security incident in the past year, and in the sensitive-workspace study 78% had an unauthorized person reach a restricted area. Different question, different sample, the same verdict: most organizations had a breach of some kind this year.

High security does not buy safety. The frontier AI labs and defense-tech firms in the sensitive-workspace study report incidents at rates even with, or above, the ordinary offices in the compliance study. The sensitivity of what an organization protects does not change the outcome when the identity layer underneath is missing.

The entry-level failures are only half of it. A second cluster of incidents comes from access that should have ended and lingered: a compliance gap surfaced during an audit (24%), a former contractor who kept access after the work ended (21%), a former employee who kept access after leaving (20%). The front door held. The memory behind it lapsed.

That last failure, access that outlives the engagement, shows up at nearly the same rate in both studies. A third of compliance-study organizations logged it as an incident, and a nearly identical share of sensitive-workspace leaders are not confident a departed contractor loses access at all.

Between the incidents sits the daily tax, the one that never makes it into a board deck because it is invisible until an auditor asks. When the systems don’t talk, a human has to be the integration layer. Pulling access logs in a normal week means reconciling six or more separate systems for 49% of enterprises.

That reconciliation costs real hours. 56% of teams lose six hours a week or more to manual physical-security tracking, before an audit even begins. During an active audit, the burden spikes.

The pain of audit prep is not the paperwork itself. It is the scramble to assemble evidence that lives in too many places at once.

Here is the part that doesn’t add up. The same leaders watching strangers walk through their buildings are confident those buildings are secure. In the sensitive-workspace study, 58% believe their program would stop an unauthorized person and 83% say their physical-cyber budget balance is about right. In the compliance study, 62% are sure they could pass an audit today with no preparation, even as most had an incident. The witnessed reality and the stated confidence point in opposite directions.

In the compliance study, confidence is highest exactly where exposure should worry leaders most or least in inverse. Single-site organizations, with the least to reconcile, are the most confident. The moment a second site opens, confidence dips, precisely where multi-site fragmentation first appears.

Ask the specific questions and the confidence thins further. 44% of sensitive-workspace leaders cannot say who was in their building yesterday. Yet 83% still say their budget balance is about right and only 12% admit they underinvest in physical security.

Physical and cyber teams “coordinate closely” at 82% of compliance-study organizations, yet the physical side still runs blind. The threats leaders rank highest, insiders and unsupervised contractors, are the ones their controls handle weakest.

This gap would matter anywhere. It matters most here, where teams are developing the most sensitive work in the world. When we asked what these leaders most fear losing, AI models and training data top the list, narrowly ahead of client data and proprietary research. No single asset dominates, which means the physical program has to defend a wide front.

And the worry runs inward. Two-thirds are concerned about contractors in spaces unsupervised and about insiders exposing information, whether by intent or by mistake. These are precisely the threats a shared identity layer is built to catch, and precisely the ones today’s disconnected stack misses.

The reason the gap persists isn’t cost. When we asked sensitive-workspace leaders why missing controls weren’t in place, the runaway answer was that they had considered them and never prioritized them: 58% said so, nearly three times the share who cited expense. Another 9% didn’t know the more advanced capabilities were an option at all.

The compliance study reaches the same conclusion from a different angle. When those leaders rank what’s blocking better physical security, complexity of compliance requirements tops the list at 39%, above budget constraints at 32%. The barrier is not the checkbook.

Asked what they actually need, teams point straight at the missing layer: real-time visibility into who’s on-site, integration between physical and cyber, and a single identity that persists across sites. The conviction is already there.

Close the gap. Know who is in your building.

Who we surveyed

Two independent studies, nearly 1,100 leaders, analyzed separately and compared.

Research powered by

79% were the primary decision maker for physical security, and 86% described their knowledge of protocols and spend as extensive.

All respondents worked in technical departments, product and engineering, per the study’s screening criteria, and all held direct physical-security responsibility. 87% operate under formal hybrid or flexible work policies. Company size skewed mid-market to enterprise, with roughly three-quarters at 501 or more employees. Geographic breakdown is drawn from panel-provider data for this sample.

Methodology