There is a gap running through the security architecture of most organizations. It does not appear on organizational charts. It is not flagged in annual risk reviews. It rarely comes up in board-level security briefings. Yet it is widening every year – and sophisticated threat actors have already learned how to exploit it.
The gap exists at the convergence point between physical security systems and cyber infrastructure. It is not a technical vulnerability in the traditional sense. It is a structural blind spot created by the way organizations have historically divided security responsibility – and it exposes critical assets in ways that neither team, working alone, is equipped to detect or address.
The Architecture Problem Nobody Owns
Walk into most large organizations, government agencies, or facility operators and you will find two distinct security functions. There is an IT security team – typically staffed with analysts, engineers, and architects focused on networks, endpoints, identity systems, and data. And there is a physical security team – responsible for access control, surveillance, perimeter management, and on-site response.
Both teams are professional. Both teams are often well-resourced. And both teams are operating with a fundamentally incomplete picture of the threat landscape.
The reason is structural rather than capability-related. IT security teams understand networks, protocols, and digital attack surfaces. They are trained to think about cyber threats in cyber terms. Physical security teams understand facilities, personnel, and spatial vulnerabilities. They are trained to think about unauthorized access in physical terms. What neither team is systematically positioned to evaluate is what happens when those two domains intersect – and that intersection is now everywhere.
Access control systems run on TCP/IP. Surveillance cameras communicate over corporate networks. Building management platforms control HVAC, lighting, and fire suppression through interfaces that can be reached from outside the building. Smart locks authenticate against cloud-based identity services.
Every one of these connections is simultaneously a physical security element and a networked digital asset. Every one of them represents an attack surface that spans both domains. And in most organizations, the responsibility for securing that surface belongs to no one in particular.
What Convergence Actually Means in Practice
The term ‘physical-cyber convergence’ has been in circulation long enough to become something of a buzzword. What it actually describes is the erosion of a boundary that once made separate security functions practical – the boundary between the physical world and the networked world.
A decade ago, most physical security systems were largely isolated. Access control panels communicated over proprietary protocols. Camera systems recorded to local storage. Building management was handled by dedicated, air-gapped infrastructure. The attack surface for a physically-motivated threat actor was predominantly physical.
That isolation is gone. The operational advantages of networked physical systems – remote management, integrated monitoring, data analytics, automated response – have made connectivity the default. The same IP infrastructure that carries business communications now carries video feeds, door sensor telemetry, and environmental control commands.
The attack surface has not simply expanded. It has changed shape. An attacker targeting a facility no longer needs to choose between a cyber approach and a physical approach. They can move between domains, using each to enable the other.
The Multi-Vector Threat Pattern
Consider the threat pattern that physical-cyber convergence enables. A threat actor begins with cyber reconnaissance – identifying the building management system vendor, mapping the access control architecture, locating surveillance camera models. This intelligence, freely available through a combination of open-source research and basic network scanning, establishes a picture of the physical environment without requiring physical presence.
From that intelligence, the actor identifies a networked entry point – perhaps an IP camera with default credentials, an access control server with an unpatched firmware vulnerability, or a building management portal accessible from the public internet. The initial compromise is digital. But the objective may be entirely physical: disabling specific cameras in advance of an intrusion, cloning credential data to enable unauthorized entry, or manipulating environmental controls to create operational disruption.
The inverse pattern is equally viable. Physical access to a network closet, server room, or poorly secured terminal can provide the foothold for a cyber intrusion that would otherwise require sophisticated remote exploitation. An attacker who can walk into a building – through tailgating, social engineering, or the use of a compromised credential – may be able to accomplish in minutes what would otherwise require weeks of remote attack.
Neither of these patterns is hypothetical. Both reflect documented attack methodologies that have been observed across critical infrastructure sectors, healthcare systems, financial institutions, and government facilities globally.
Why Siloed Teams Cannot Close This Gap
The structural problem is not that IT security teams and physical security teams are incompetent. The problem is that they are each optimized for a threat model that no longer reflects reality.
IT security teams conduct penetration testing, vulnerability assessments, and threat modeling exercises that are focused on digital systems. When they audit access control systems, they typically evaluate network configuration, authentication protocols, and patch status. They rarely evaluate the physical implications of a compromise – what a door that fails open means for personnel safety, or what unauthorized entry to a data center means for the integrity of the systems inside.
Physical security teams conduct site assessments, conduct access control audits, and evaluate camera coverage. When they assess vulnerabilities, they typically evaluate physical barriers, guard protocols, and response procedures. They rarely evaluate the cyber attack surface of the systems they operate – whether surveillance cameras are hardened against remote compromise, or whether the network segment carrying access control data is properly isolated.
The gap between these two perspectives is not filled by occasional cross-functional meetings or joint briefings. It requires a fundamentally different assessment methodology – one that evaluates security posture across both domains simultaneously, maps the interdependencies between physical and cyber systems, and identifies vulnerabilities that only become visible when both perspectives are applied together.
The gap between IT and physical security is not a personnel problem. It is a methodology problem - and it requires a methodology built for integrated threats.
The Compounding Risk in Critical Infrastructure
Across critical infrastructure sectors – energy, water, transportation, healthcare, and government facilities – the physical-cyber convergence risk carries consequences that extend well beyond data loss or operational disruption.
Industrial control systems and operational technology (OT) networks, once considered separately from enterprise IT, are now deeply integrated with corporate information systems. The same convergence dynamic that affects commercial facilities plays out at larger scale and with higher stakes in environments where a compromised system can affect public safety, service continuity, or national security.
Building management systems in hospitals control environments that are directly tied to patient outcomes. Access control failures in secure government facilities have national security implications. Energy management systems in utilities are targets for adversarial disruption campaigns that combine cyber intrusion with physical reconnaissance.
In these environments, the cost of an integrated threat is not measured in recovery time and incident response fees. It is measured in service disruptions, public safety incidents, and the erosion of institutional trust. The organizations responsible for these environments cannot afford a security architecture that leaves the convergence point unowned.
Tandu's Integrated Approach
Tandu Security Consulting‘s methodology is built on a foundational recognition: that physical and cyber security are not parallel disciplines that occasionally need to communicate. They are interdependent components of a single threat environment, and they must be evaluated and managed as such.
This integrated approach begins with joint assessment – teams with expertise across both physical and cyber domains conducting unified site evaluations that map physical vulnerabilities, network architecture, system interdependencies, and the attack vectors that span both environments. The objective is not to produce two separate reports that are later reconciled. It is to produce a unified threat picture that captures the convergence risk that neither discipline could identify independently.
From this unified assessment, Tandu’s methodology develops security recommendations that address the convergence points directly – governance structures that establish clear ownership over cross-domain systems, technical controls that address both physical and cyber attack surfaces, and incident response protocols that coordinate physical and cyber response capabilities in real time.
The approach reflects Tandu’s position in the security landscape: a firm with deep expertise across both physical and cyber security domains, operating in the critical space between the two that most organizations have not structured themselves to manage. For organizations that have recognized the convergence risk but lack a framework to address it, this integrated methodology represents a meaningful departure from the siloed approaches that have left that risk unaddressed.
What Organizations Should Be Asking
Organizations evaluating their exposure to physical-cyber convergence risk should begin with a set of questions that cut across the traditional silo boundary:
- Which physical security systems in our environment are networked, and do we have a complete inventory of those systems?
- Are those networked systems included in our cyber vulnerability management program, or does responsibility fall between teams?
- When was the last time our access control, surveillance, and building management systems were evaluated by a team with expertise in both physical and cyber security?
- Do our incident response procedures account for scenarios that begin in one domain and propagate into the other?
- Is there a designated owner for security at the convergence point between our IT and physical security functions?
For most organizations, honest answers to these questions reveal exactly the kind of structural gap described above. The good news is that this gap is addressable – not by hiring more people into existing siloed functions, but by adopting an assessment and management methodology designed for the integrated threat environment that now exists.
The Bottom Line
Physical security and cyber security have converged. The systems organizations use to protect their facilities are now part of their digital attack surface. The threats targeting those organizations increasingly exploit both domains simultaneously.
Organizations that continue to manage these domains as separate functions, with separate teams operating under separate frameworks, are accepting a structural vulnerability that neither team is positioned to close. Addressing it requires integrated expertise, integrated assessment methodology, and integrated governance.
That integration is not a future aspiration. For organizations operating critical infrastructure, managing sensitive facilities, or holding assets that attract sophisticated adversaries, it is an operational necessity that the threat landscape has already imposed.
