It started with a phishing email to an HR manager in Cincinnati. Within 72 hours, the attacker had pivoted from the corporate email server to the building management system, disabled three access control zones on the executive floor, and looped 40 minutes of archived camera footage to cover their tracks. No alarm triggered. No one noticed until Monday morning.

This isn't a hypothetical. Variants of this attack pattern have been documented across critical infrastructure, corporate campuses, and healthcare facilities throughout 2024–2025. If your physical security and cybersecurity teams still operate in separate silos, you are not running two security programs. You are running zero.

The Old Model Is Broken

For decades, organizations relied on a legacy model where physical security (guards, cameras, and badge readers) was managed by a facilities or corporate security team, while cybersecurity was the domain of IT. These departments operated with different budgets, leadership, vendors, and incident response playbooks.

Today, that wall has dissolved. We now see IP-connected cameras feeding into cloud VMS platforms, badge readers integrated with Active Directory, and HVAC, elevators, and lighting on building automation systems (BAS) connected directly to corporate networks. Visitor management systems are synced with HR databases, and SIEM platforms are increasingly ingesting physical access logs alongside network logs.

The critical point to understand is that every one of these integrations is a lateral movement opportunity for an attacker. According to the SIA Security Megatrends 2025, IT-OT convergence is no longer a future trend. It is a top industry force.

How Attackers Are Actually Exploiting This

Modern attackers follow a sophisticated, composite attack chain that bridges the digital and physical worlds.

Stage 1 - Initial Access via Cyber The breach often begins with a phishing email or a vulnerability exploit hitting an IT endpoint. This stage is now heavily AI-assisted, as attackers use Large Language Models (LLMs) to craft hyper-personalized spearphishing at scale, dramatically lowering the barrier to entry.

Stage 2 - Lateral Movement to Physical Systems From the compromised IT endpoint, the attacker enumerates the network to find poorly segmented VMS servers, access control databases, or BAS controllers running legacy firmware.

Stage 3 - Physical World Impact Once inside these systems, the attacker can unlock doors or disable turnstiles to enable a physical intrusion. They may loop or corrupt camera feeds to blind security operators, or trigger false alarms to cause alert fatigue and mask a real intrusion. They can even exfiltrate sensitive building floor plans, personnel schedules, and camera coverage maps.

Stage 4 - Persistence and Exfiltration The attacker now possesses both digital persistence through a backdoor on the IT network and physical intelligence regarding building layouts and blind spots. This classic Advanced Persistent Threat (APT) behavior is now accessible even to mid-tier threat actors because AI has leveled the skills gap. As noted in recent trends, phishing and vulnerability exploitation lead straight to physical systems.

The Governance Gap: Why Most Organizations Are Exposed

Despite widespread awareness, most organizations still have structurally siloed security governance. Physical security often reports to Facilities or Legal, while OT systems like the manufacturing floor are managed by Engineering or Operations, both typically outside the CISO’s visibility. Budgets remain separate, yet unified security platforms require joint investment that neither team can own alone. Furthermore, incident response plans often fail to account for cross-domain scenarios.

The data highlights this vulnerability:

● The WEF Global Cybersecurity Outlook 2026 reports that 45% of organizations cite a skills shortage as a top-three resilience barrier. ● Only a small minority of organizations are at "mature" cyber readiness per Cisco’s 2025 Cybersecurity Readiness Index. ● Interestingly, 52% of CEOs at highly resilient organizations actively prioritize integrated threat intelligence, compared to just 13% at their less resilient peers.

The governance gap can be summarized with one question: Who owns the incident when the attacker entered through email and exited through the loading dock? If your answer requires a meeting to figure out, you have a gap.

Where Does Your Program Stand?

You can’t secure what you haven’t mapped, and you certainly can’t bridge a gap you haven’t first acknowledged. To move from a fragmented, siloed setup toward a truly integrated shield, you need an honest look in the mirror. Use the Cyber-Physical Maturity Model below as your diagnostic tool. This three-stage framework is designed to help you identify existing blind spots and prioritize the necessary investments for convergence.

Currently, most mid-market organizations sit between Stage 1 and Stage 2. The goal for 2026 is completing the move to Stage 2 while building the roadmap to Stage 3.

What a Converged Program Looks Like in Practice

In a Stage 3 "Unified" environment, a security operator's day-to-day experience is transformed. A single dashboard might surface a physical anomaly, such as tailgating at a secure door, alongside a simultaneous IT alert for an unusual login using those same employee credentials from a different city. AI video analytics flags this behavior in real-time, rather than during a post-incident review. The operator receives a verified, context-rich alert instead of a flood of false positives, allowing them to act in seconds. Finally, the full event chain is logged automatically across both physical and cyber domains for forensics.

This kind of integrated, real-time situational awareness is exactly what AI video analytics platforms like Scylla are built for. By combining weapon detection, behavior anomaly recognition, and access control integration into a single operational layer, Scylla bridges the physical-cyber gap from the camera outward, offering up to a 99.95% reduction in false alarms.