Tim Purpura and Jordan Andrews from Morse Watchmans share information about how rising insider threats are causing lines between cyber and physical security to vanish.
Individuals responsible for security worldwide find that the greatest security vulnerabilities and threats are not always from outside the facility perimeter.
Most already exist inside it. Insiders already carry credentials, keys and access permissions that outside attackers spend most of their effort trying to obtain.
Their daily presence allows them to study routines, exploit blind spots and act. However, insider activity is more difficult to detect due to built-in trust.
Whether the environment is a data centre in Singapore, a prison in the UK or a federal law enforcement agency in the US, physical and cybersecurity have converged into a broader attack surface.
Physical access points controlled by digital systems and digital systems that control physical outcomes create vulnerabilities where one can be exploited to compromise the other.
Any access point can easily be spoofed, hacked and manipulated by insiders, leaving enterprise operations managers grappling with vulnerabilities.
For security and operations leaders around the world, they recognise that cyber-physical convergence is what now drives security strategy.
Data makes it clear why the management of access, accountability and control must be urgently addressed: $16.2m average annual cost of insider-related incidents per organisation – a 40% increase since 2020 (Ponemon Institute); 50% of all global ransomware attacks in 2025 – 2,332 incidents – targeted critical infrastructure sectors, a 34% year-over-year increase (CISA, 2025 Year in Review)
An accelerating global threat landscape
In a 2025 study, The Ponemon Institute, a research centre dedicated to privacy, data protection and information security policy, recorded 7,868 insider incidents, which is more than double the 3,269 incidents reported in 2018.
Also reported is the number of organisations that experienced insider attacks, which rose from 66% in 2019 to 76% in 2024.
Most notably, 90% of security professionals now report that insider attacks are as difficult or more difficult to detect than external attacks.
In 2025, threat intelligence company Flashpoint observed 91,321 instances of insider recruiting and threat-actor discussions involving insider-related illicit activity. The analysis determined that it is more efficient for organised crime actors to recruit insiders who can bypass a multi-million-dollar security stack than it is to develop a plan using individuals outside the facility.
“The conversation from our customers across our vertical markets has shifted from, ‘How do we keep people out?’ to, ‘How do we know exactly who had access to what, and when?’,” said Jordan Andrews, Sales Manager, Morse Watchmans.
“That shift is really a recognition that insider employees are often the bigger unknown than outside people trying to get through the front door.”
Access attacks: the physical-cyber convergence
Security and IT professionals recognise that physical and digital access are two gateways to the same risk.
In critical infrastructure, identity is the primary cyber-attack method, and one compromised account can open access to related systems, according to Microsoft Defender Threat Intelligence. Notably, 97% of identity-based attacks target password-based authentication.
The physical side is just as consequential. Direct access to hardware, server racks, communication lines, and critical infrastructure can quickly escalate into a major cyber-incident, leaving little separation between physical and digital breaches.
“In high-security environments, this convergence is pushing leaders to unify physical and cybersecurity. While access control is already part of prevention strategies, teams increasingly need auditable, time-stamped, role-specific evidence to detect, investigate and substantiate insider incidents,” added Tim Purpura, VP Global Sales.
Where physical access equals digital catastrophe
The global data centre physical security market was valued at $2.15b in 2025 and projects 14% annual growth through 2030, according to Mordor Intelligence. With about 10,978 data centres worldwide, the physical security challenge is growing. These facilities support financial records, healthcare data, government systems and AI infrastructure. A server-room breach involving stolen hardware can expose millions of records and create regulatory liability.
Growing demand for edge computing is expanding the threat surface. Unlike centralised, heavily secured facilities, edge sites sit closer to local networks to enable faster data processing.
This growth creates sites with leaner staffing and more access-control variables, making unauthorised access a persistent, underrated risk. Contractors, engineers and IT staff often hold elevated privileges that blend into normal operations, allowing insider activity to go undetected until damage is done.
Managing physical access to prevent digital threats
Key control systems provide a foundation for an auditable access control governance framework.
Managing physical keys to secure access points and locked server cabinets demonstrates to internal security teams, to customers and to regulators who accessed what key to what area and under what authorisation.
Automated key control systems provide timestamped audit trails, which is the evidentiary record that manual processes and systems cannot create.
Beyond the audit trail, key control systems reduce insider threat exposure by enforcing access privileges and authorisation. Employees can access only the keys required for their roles and access can be revoked instantly when responsibilities change or employment ends. This closes gaps common in manual key logs or unmanaged cabinets, where outdated access can persist.
By governing physical keys with the same rigor as digital credentials, organisations eliminate a frequently overlooked path for insider threats and strengthen their overall cybersecurity posture.
“The single biggest insider threat gap is a key that nobody can account for,” explained Purpura. “Once you automate that process, you’re not just closing a security hole, you’re giving the facility a record they can actually stand behind when an incident happens or an auditor walks in.”
Insider risk in high-stakes environments
If data centres represent the juncture of physical access and digital catastrophe, correctional facilities represent the crossroads of physical access and direct public safety risk.
For correctional facilities, the risk in access control violations is immediate. A missing key in a data centre might mean a breach discovered days later in an audit log while a missing key with no digital trail in a correctional facility can mean an elopement of a prisoner that immediately compromises public safety.
Every door in a correctional facility represents a potential point of failure through unauthorised activity. Staff need fast, reliable access to move between units, respond to incidents and manage shift changes, while administrators need an unbroken chain of custody showing exactly who held which key, for how long and when it was returned.
A single unaccounted-for key can force a full facility lockdown, an expensive rekeying project, or worse, become the instrument in an escape or an act of violence. This is why accreditation standards now treat key control as paramount to institutional safety, along with staffing ratios and surveillance.
Automated key management systems replace manual sign-out sheets with tamper-evident cabinets, credentialed access and real-time alerts when a key has not been returned as scheduled.
The hierarchy of the insider threat challenge involves officers, civilian staff, contractors, healthcare providers and educators with varying levels of access to areas. Understaffing in correctional facilities is a persistent operational pressure, and shortcuts often compromise security protocols.
A rushed shift change means keys can get handed off informally and out of compliance. Automated key control systems ease the burden of understaffing by providing accountability and permissions for every single key within highly regulated compliance parameters with a full audit trail always available.
The cybersecurity dimension of correctional security has also grown substantially. Facilities now rely on networked systems for inmate management, medical records, communications platforms and surveillance infrastructure.
A guard’s mistake, a shoulder-surfed password and an unsecured terminal left open can cascade into compromise. Cyber-breaches can cause inmates to exploit such gaps to commit identity theft, access external networks or compromise the personal information of staff.
The imperative audit trail
Across these markets, and across all critical infrastructure environments globally, the most consistent gap that security auditors, regulators and incident investigators encounter is the same: the absence of a reliable, tamper-resistant record of physical access activity.
Manual key logs and unsecured key boxes or pegboards are still standard in many facilities.
Ironically, organisations investing hundreds of thousands of dollars in cybersecurity monitoring, may be leaving out an important physical access control environment that is auditable only if someone remembers to check the logbook.
“International standards and regulatory frameworks are increasingly specific about this gap: access governance must be demonstrated,” commented Purpura. “The ability to produce a complete, time-stamped, role-verified record of who accessed which area or asset, is moving from best practice to a compliance baseline.”
A key control and asset management perspective
Electronic key control and asset management systems provide a foundational layer for compliance.
These systems transform physical key management from a manual process into an auditable, policy-enforced system that integrates with broader security ecosystems and generates the access intelligence that insider threat investigations, insurance reviews and regulatory audits require.
“The key cabinet is no longer a box on the wall,” remarked Andrews. “It is a critical component in access governance architecture.”
Beyond the audit trail, these systems provide granularity and immediacy data.
A modern key cabinet doesn’t just log that a key was removed, it captures who removed it, when, for how long and whether that access aligned with an authorised schedule or policy exception. That level of detail matters when an insider threat investigation needs to reconstruct a timeline.
Security with a strategic direction
The convergence of insider threats and physical-cyber risk will drive security strategies.
AI also has significant impact on both sides of the equation, with better tools for anomaly detection as well as giving new capabilities to security threat actors for research, targeting and social manipulation.
“For security professionals, physical access governance needs to be handled with the same rigor, investment and audit capabilities that are applied to the digital layer,” said Andrews.
“Insider threats do not distinguish between digital credentials and physical keys. Both represent access, carry risk and require accountability.”
The lock on the server room door and the policy controlling who holds the key to the cell block are part of the same security story.
Organisations that close the gap between physical and digital security will be better positioned to reduce the likelihood of insider threats, and respond to regulatory, reputational and operational pressures around operations security and protection.
