Beyond the lobby: What new research reveals about the state of visitor security

Visitor management has evolved far beyond a sign-in sheet or a check-in app at the front desk. For organizations managing multiple facilities, sensitive workspaces, and large contractor populations, knowing who enters a building is only the beginning. Security teams also need to know who that person is, where they’re authorized to go, what screening they require, and whether their access should still be permitted.

Yet new research from Envoy reveals how often gaps in these processes persist. 79% of security leaders reported at least one unauthorized or unverified person entering their facilities in the past year. And as organizations expand across sites, maintaining consistent security controls and audit-ready records becomes even more challenging.

In our recent webinar, The State of Physical Security & Compliance, Bridget Scott Akinc and Peter McLaughlin unpacked these findings, explored real-world security scenarios, and shared practical ways organizations can strengthen their approach.

It was a packed conversation, so we've pulled together the key insights and takeaways for security leaders: why visitor management needs to account for different levels of risk, where gaps tend to emerge, and what organizations can do to build a more consistent, audit-ready security strategy.

Watch the webinar on demand, or read on for the key takeaways below.

Visitor management isn't one-size-fits-all

A delivery driver, a contractor, a job candidate, a foreign national visiting a research facility, and an employee's family member don't present the same risks or require the same level of screening. Their workflows may call for different identity checks, approvals, documentation, escort requirements, and access permissions.

Several scenarios discussed during the webinar illustrate what can happen when those distinctions aren't addressed:

• A dismissed contractor returns at another site. At a semiconductor company, a contractor who had been dismissed showed up at a nearby facility weeks later. Without reliable identity verification and a global block list, the organization couldn't consistently enforce its decision across locations.
• Identity verification stops a potentially dangerous visitor. A delivery driver subject to a restraining order was flagged through a block list and ID verification, preventing the individual from entering the workplace.
• Visitor screening creates compliance exposure. An aerospace and defense scenario highlighted an ITAR-related fine associated with unapproved visitors and missing restricted-party screening.
• Vendor access complicates data center security. Multi-tenant facilities often involve multiple vendors, badge systems, and access requirements, making consistent oversight more difficult.

The common thread is that security policies are only as effective as an organization's ability to enforce them. A block list that doesn't carry across sites or a screening requirement that gets overlooked can undermine otherwise well-designed controls.

The goal isn't to make every visit more complicated. It's to apply the right checks and permissions to the right people, based on the risks of each visit.

The compliance gap grows with every additional site

Maintaining consistent security controls at one facility is challenging enough. Across multiple locations, the complexity compounds. Envoy's research found that confidence in audit readiness drops from 71% among organizations operating a single site to 58% when a second site is added.

The research also revealed gaps in how organizations protect sensitive spaces:

• 39% reported a visitor or contractor reaching a restricted area.
• 28% reported someone viewing or photographing work in progress.
• 67% expressed concern about intentional insider exposure.
• 66% were concerned about unsupervised contractors.

These findings highlight a broader issue: knowing someone checked in doesn't mean they were authorized to enter every space or that the organization can demonstrate its policies were followed.

As Peter emphasized during the webinar, security leaders should ask themselves: If an auditor showed up this afternoon, what could you prove?

Audit readiness requires more than a visitor log. Organizations need documented policies, processes that enforce those policies, and reliable records they can retrieve quickly. When information is spread across disconnected systems, even basic questions about visitor identity, approvals, or access can become difficult to answer.

Four ways to strengthen visitor security

Bridget and Peter discussed practical steps security teams can take to close these gaps and build more consistent programs.

1. Match access controls to the risk. Establish zones based on the sensitivity of each area, then align screening, approvals, escorts, and permissions accordingly. Someone approved to enter a general office may not be authorized to enter a lab or production floor.

2. Keep security-sensitive information protected. Visitor wayfinding should help people navigate a facility without exposing detailed security maps or restricted-area information.

3. Build safety requirements into check-in. For contractors and visitors entering specialized environments, use the check-in process to confirm required safety assessments, training, acknowledgments, and device protocols before access is granted.

4. Keep access current and prepare to prove compliance. Connect relevant workflows, including HRIS processes, so employee departures and other status changes trigger timely access revocation. Establish clear host and escort responsibilities, and ensure visitor records can be retrieved when needed.

Together, these practices help move visitor management from a one-time check-in transaction to an ongoing process for managing identity, authorization, and accountability.

Connect systems without losing visibility

Organizations don't always operate with a uniform technology stack. Companies that have grown through acquisitions may use different badge systems across facilities, while data centers must accommodate multiple tenants and vendors. That doesn't have to mean fragmented visitor oversight.

During the webinar Q&A, Peter confirmed that Envoy integrates with more than 35 other access control systems. Bridget highlighted the value of maintaining one visitor system of record, even when individual sites use different badge systems.

For security teams, the goal isn't necessarily to make every facility identical. It's to establish consistent visitor workflows and visibility across locations while working with the systems already in place. Security also extends beyond preventing unauthorized entry. Organizations need ways to communicate with people on-site and coordinate a response when an incident occurs. Envoy Response brings together threat intelligence, two-way communications, and incident management.

Learn more from Product Manager for Response, Aditi Ganpule latest blog on Envoy Response.

What's next for highly regulated environments?

As security requirements grow more complex, organizations need stronger controls without making legitimate visits unnecessarily difficult. During the webinar, Peter teased a major release for highly regulated environments, coming soon. More details will be shared when available.

In the meantime, security leaders can start by evaluating whether visitor workflows reflect different levels of risk, whether access restrictions and status changes carry across sites, and whether they can produce reliable evidence that policies were followed.

Putting the takeaways into practice

The conversation reinforced a critical point: effective visitor management is about more than knowing who walks through the door. It's about applying the right controls to the right people, maintaining visibility across locations, and being able to demonstrate that security policies work in practice.

For security leaders, the next step is to look at where gaps might exist in their own visitor workflows, access controls, and audit processes, and identify opportunities to strengthen them.

These are just a few of the insights Bridget Scott Akinc and Peter McLaughlin shared during The State of Physical Security & Compliance. 

Watch the full webinar on demand to hear the complete discussion, explore the research, and learn more about building a stronger approach to physical security and compliance.

‍