The concept of door locks means something totally different in our current age of smarter buildings that house data-driven businesses. Hardware locks and keys are still around, but they co-exist with a brave new world of electronic locks, wireless locks, networked systems, and smarter access control. Locks can also increasingly be a part of a smart building’s flow of data. The opportunities of these new technologies and approaches are significant, but there are also pitfalls. I heard an interesting discussion about these topics presented by several business leaders from lock company Allegion at a press event at ISC West earlier this year. Here are some highlights from that discussion.


Q: What new developments in emerging technologies do you see in the coming years?

There’s opportunity for implementation of the technology to solve real problems"

Mark Jenner, Market Development Director: Connected locks, other types of sensors and all the data being aggregated inside buildings provide opportunity for data analytics. The buzzwords around technologies can cause confusion for integrators and end users, such as artificial intelligence, deep learning and machine learning, and what’s the difference among all of them? My opinion is that they are important, but the big theme across them all is opportunities for new business models for the integrator, and opportunities to solve problems for end users. And it’s not just technology for technology’s sake. There’s opportunity for implementation of the technology to solve real problems.

Devin Love, Market Development Manager: You can’t just have a solution looking for a problem. You see a lot of people who understand technology in their own lives, and they want to translate that into their businesses. That’s where I think it’s exciting. You now have all this technology, and people understand it to the extent that it improves their daily life. They go through their day with less friction, with more ease, and technology fades to the background. There are two levels of value. One is the longer, bigger, broader scope of what the technology can bring to a company using it, but on an immediate basis, there is the value of tracking how a business is running. These sensors are collecting data. For example, if you are a multi-tenant property, you can look at how amenities are being used. What do my residents really care about? That informs future decisions.

Robert Gaulden, Project Based Business Leader, Electronic Access Control: I have been studying the multi-family space for the last couple of months. The customer experience is really driving a lot of that technology adoption. What you’re seeing today, whether it’s a mobile device or some other device, is the ability to move throughout the property, and gain access to the perimeter and to your tenant space. All of this adoption is around that experience. There’s multiple players coming into the space, from Amazon wanting to deliver packages into the tenant space to residents who don’t want the inconvenience of using a key. Technology adoption to solve problems, and also to drive experiences, is where a lot of the balance will play out.

It’s important that we look at how integrators can use the technology to do business more effectively and efficiently"

Brad Aikin, Channel Led Business Leader, Integrator Channel: From an integrator perspective, there are two things. One is how they can approach end users, and the scope of what integrators consult with them about is wider. I think we as an industry are getting beyond those high-traffic, high-security applications. Those are still critical, but the value we bring around security and convenience is opening a new incremental opportunity. Also, the experience of the integrator and how they conduct their business is important, from generating quotes to communications to proactive servicing. It’s important that we look at how integrators can use the technology to do business more effectively and efficiently.

Gaulden: We as an industry, and we as manufacturers, need to understand what data we are generating so we can run our businesses more efficiently from every aspect, whether you’re the property manager, the building owner, the integrator, or whether you’re the manufacturer. These devices and technology are being pushed out everywhere and will generate the data. How we learn from that – especially when you apply security to it to be more proactive – provides huge opportunities.

Jenner: What data is important and what’s not? Folks get overwhelmed with too much data at some point. What’s important for an application at the end user level? What do they really need to solve the problem?

Love: Privacy gets involved as well, especially with consumer products. The attitude is “stay out of my private business.” But if you’re an employee now, all bets are off. Now you have a professional relationship with the people you work with, so there is a different lens that you look through when tracking data. You use the data to everyone’s benefit, and it’s a different paradigm than in your private life.

Aikin: Also, where does that data create a better experience for the person? That’s what drives the money and value: What level of information sharing makes my experience better? The technology is also getting smarter in terms of “how do we sort through the valuable information?

Hardware locks and keys are still around, but they co-exist with a brave new world of electronic locks, wireless locks, networked systems, and smarter access control

Q: As facilities connect more devices and sensors, the cybersecurity threats increase. We have already seen Internet of Things (IoT) devices being used as the attack point of cyber breaches. What are the vulnerabilities that make those attacks possible, and how can integrators protect their customers?

Love: Certainly, this is an extremely – maybe the most important – piece of our industry. What is the point of everything we do if we can’t instill that trust? But what we need to solve here also comes with opportunity. There’s certainly hope. You’re not seeing a frontal attack on the technology. It’s usually some loophole, or some older device that hasn’t been updated, or wasn’t installed correctly, or it was social-engineered. The opportunity is, not that it can’t be solved, but that it absolutely needs to be solved – and it can.

Gaulden: Integrators need the ability to understand that cyber layer and what it means. Nowadays, everything runs on the network, and you won’t even get past the IT department to get on the network if you don’t have the right staff, the right credentials. From an integrator standpoint, you need the ability to add to your staff, to understand everything from the product level to the firmware and the software level, all the way to the deployment of the holistic system. You can’t just say, “That’s not part of our responsibility.” All these devices are now riding on the network. They can be protected from a cyber perspective, or you will have vulnerabilities.

As manufacturers and business consultants to integrators, we should facilitate the conversation, that it is one ecosystem"

Aikin: Everything is a communication device. With the concern and need comes an opportunity for the integrator. But it’s also in making sure integrators are having that conversation with end users and setting the expectations up front. What I’m providing you on day one is the best in the industry at this time, but tomorrow it may not be. My accountability and service are to maintain that environment and keep it running. I may not physically change the device you see, but the service I’m bringing to you is that security, and that comprehensive dialogue. The IT stakeholders already have that expectation, but there is a chasm in some organisations between the physical security and the IT stakeholders, and the integrator is facilitating that conversation. As manufacturers and business consultants to integrators, we should facilitate that conversation. It is one ecosystem.


Q: Aside from cybersecurity, what are some of the other threats that integrators should be aware of as they work with customers to implement the new trends and technologies we have mentioned?

Aikin: It is diversifying, all the options and the capabilities. With that comes confusion and misapplication. If I look at the trends around just wireless; I go back 10 years ago, there were even questions of whether wireless was a secure technology. That has progressed and continues to be part of the cyber conversation, just like any hardwired product. It’s something you have to maintain and be aware of. Wireless has really diversified. There is still a need for education within the channel, and most importantly, to the end user. There are still end users that assume a WiFi widget is the same thing as a Bluetooth widget is the same thing as a low-frequency widget. But they are all different. There are reasons there are different technologies. Nothing stifles the adoption of technology more than misapplication.

We have different architectures within our lock base and among our software partners to allow a mix of technology"

Gaulden: Integrators understand the differences in how various doors are used and how those applications will work. In the K-12 school environment, you want the ability for an instant lockdown, and a WiFi deployment probably isn’t your best option. You need a real-time deployment. However, my office door at headquarters doesn’t necessarily need real-time communication. I can pull audits off it once or twice a day. You have to mix and match technologies. For a high security door, you would proactively monitor it. But for a door where convenience is the goal, we can put electronic security on it but we don’t need to know what’s going on at any moment in time. We have different architectures within our lock base and among our software partners to allow that mix of technology.

Jenner: End users want the latest technology, but it may not be for their applications. Those things drive more costs into it, when end users need to be putting money into cybersecurity and some other things. That’s part of the misapplication. Another risk is interoperability. That’s a big piece of the technology and as things change. How do we do a better job of supporting open architecture? It may not be a standards-based protocol, although we use a lot of standards, but we just need to make sure whatever protocols we use are open and easily accessible so we can continue to work with them in the future. We know that when our devices go in, they will support other parts of the ecosystem from an interoperability perspective. That’s important for integrators to know: How is this going to be applied and integrate with something in three, four or five years from now? It’s an expensive investment, and I want to make sure it will work in the future.

Main photo: Business leaders from Allegion discussed new trends in electronic and wireless locks at a recent press event: (L-R) Robert Gaulden, Devin Love, Brad Aikin and Mark Jenner.

Download PDF version

Author profile

Larry Anderson Editor, SecurityInformed.com & SourceSecurity.com

An experienced journalist and long-time presence in the US security industry, Larry is SourceSecurity.com's eyes and ears in the fast-changing security marketplace, attending industry and corporate events, interviewing security leaders and contributing original editorial content to the site. He leads SourceSecurity.com's team of dedicated editorial and content professionals, guiding the "editorial roadmap" to ensure the site provides the most relevant content for security professionals.

In case you missed it

Why moving to a risk-based approach helps business
Why moving to a risk-based approach helps business

Today’s security leaders encounter many challenges. They have to operate with reduced budgets and face challenging and evolving risks on a daily basis. Security leaders are often ignored and only called upon when needed or in disaster situations. Many don’t have an ongoing relationship with the C-suite because the C-suite doesn’t understand the value they bring to the whole business. In order to resolve these challenges, a security leader can apply a risk-based approach to their security program. According to  dictionary.com, risk is “exposure to the chance of injury or loss; a hazard or dangerous chance”. Risk is broader than a security concern and involves the entire business.  Through utilising a 3R model - considering resources, risks and resolutions - a security leader can evaluate the output from the model to build the foundation of a strong plan. This allows the leader to make security decisions based on a quantified risk measure.  A business determines what resources it wants to protect, what risks it needs to protect the resources from and what resolutions it can put in place to mitigate the risk. Decisions are based on measurable evidence. Free online risk assessment tools are available to provide a fast, easy way to determine an organisation's basic security risks through an investigative approach The 3 Rs The first step in the 3R model is to figure out what resources need protection. This could be physical - such as buildings, critical infrastructure or valuable equipment, knowledge-based - such as intellectual property, or organisational - such as people or governance structure. Understanding the business will help the security leader develop a list of critical elements. Look for tangible resources such as buildings and machinery, and intangible resources like reputation, knowledge and processes. Second, determine what the resources need to be protected from. Anything that threatens harm to the organisation, its mission, its employees, customers, partners, its operations or its reputation could be at risk. These can include contextual risks (workplace safety or natural disasters), criminal risks (theft or cybercrime) or business risks (compliance or legal issues).  Anything that threatens harm to the organisation, its mission, its employees, customers, partners, its operations or its reputation could be at riskFree online risk assessment tools are available to provide a fast, easy way to determine an organisation's basic security risks through an investigative approach. The tools ask several questions and determine risk based on an organisation’s location and the answers provided. Security leaders can also work with security companies and consultants that offer risk assessments to determine their company’s needs, and then offer solutions based on that assessment.  The third objective is to determine how businesses can best protect the identified resource. The last of the 3 Rs - resolutions - are those security activities that enable the business to mitigate the impact of security risks. Resolutions can potentially prevent a security incident from occurring, contain the impact to resources if an event does occur and also assist the organisation in recovering from an impact more quickly or easily.   The first step in the 3R model is to figure out what resources need protection, this could physical such as buildings or critical infrastructure  The path forward Understanding what risks a business faces in totality provides an opportunity for the security leader to collaborate with other department heads. This gives security leaders an opportunity to engage with functions outside their norm as well as a chance to demonstrate their subject matter expertise. A risk-based approach also helps security leaders fully understand an organisation’s needs and concerns, which they can communicate to the C-suite to help them make better business decisions. Metrics can also help business leaders understand the cost/benefit of resolutions C-suite and executives help define an acceptable level of security risk tolerance to resources and make quality, educated decisions about mitigating security risks. Through collaborating with security leaders using a risk-based approach and the 3R model, metrics and reports show the impact of security expenses, and there is a transparent view of security risk. The final decision about how to mitigate and resolve risks is up to the business owner of the resource and the risk stakeholders. To obtain funding, show the risk and value of resources exposed to potential impact. Then present the recommended resolution that reduces the potential level of impact and the associated cost benefit savings. By providing this information, security leaders can ensure that the business owners can make an educated decision. Measuring success A risk-based approach aligns the security mission with the organisation’s mission. Security leaders should have these conversations with their business leaders on a regular basis. Understanding the thresholds of risk tolerance and showing when incidents or activities are trending outside of acceptable boundaries will help business leaders make educated decisions. The 3R model also helps a business to track occurrences, quantify the direct and ancillary impact and make continuous adjustments to the security program Determining a baseline of acceptance gives a foundation for security leaders to point out when the organisation is not meeting its own requirements. Metrics can also help business leaders understand the cost/benefit of resolutions and demonstrate when costs may be trending outside of acceptable boundaries. The 3R model also helps a business to track occurrences, quantify the direct and ancillary impact and make continuous adjustments to the security program. It is important to note that this process is not stagnant, and needs to be constantly revisited. Examining risks, resources and resolutions in a systematic way will help security leaders understand what they are protecting Defining risks and vulnerabilities Continuous conversations using the 3R model also help business leaders understand what security risks could interfere with meeting business objectives. It also aligns the total cost of ownership for the security program with the business value of the resources at risk.The approach puts the security risk decisions in the hands of the ones impacted by those risks And it defines the security role as risk management, not just task management. The approach puts the security risk decisions in the hands of the ones impacted by those risks…the “owners” of the resources. Examining risks, resources and resolutions in a systematic way will help security leaders understand what they are protecting, what they are protecting it from, and how they can help prevent, contain or recover against a specific risk. Followers of this approach are in a better position to ask for funding because they can clearly define and quantify risks and vulnerabilities. Applying these principles will equip security leaders with the knowledge needed to have better dialogue with colleagues in other departments, encouraging more proactive discussions about security.

Why regional? Inside ADT's mergers and acquisitions of US security integrators
Why regional? Inside ADT's mergers and acquisitions of US security integrators

ADT Inc.’s acquisition of Red Hawk Fire & Security, Boca Raton, Fla., is the latest move in ADT Commercial’s strategy to buy up security integrator firms around the country and grow their footprint. In addition to the Red Hawk acquisition, announced in mid-October, ADT has acquired more than a half-dozen security system integration firms in the last year or so.  Here’s a quick rundown of integrator companies acquired by ADT: Protec, a Pacific Northwest commercial integrator (Aug. 2017); MSE Security, the USA’s 27th largest commercial integrator (Sept 2017); Gaston Security, founded in 1994 as a video surveillance integration company and whose services have since expanded to include intrusion, access control, and perimeter protection (Oct. 2017); Aronson Security Group (ASG), which delivers risk and security program consultants and offers advanced integration services, consulting and design engineers and a National Program Management team (March 2018);  Acme Security Systems, among the largest privately held security systems integrators in the Bay Area, focusing on electronic security systems, access control, video networks and more (March 2018); Access Security Integration, a regional systems integrator specialising in design, delivery, installation and servicing of electronic security systems including enterprise-level access control, video and visitor management solutions, perimeter security and security operation command centers (Aug. 2018); In addition to their moves in the commercial integrator space, ADT has also sought to expand their presence in cybersecurity with the following two acquisitions: Datashield, specialising in Managed Detection and Response Services (Nov 2017); Secure Designs, Inc., specialising in design, implementation, monitoring, and managing network defense systems, including firewall services and intrusion prevention, to protect small business networks from a diverse and challenging set of global cyber threats (Aug. 2018). ADT has acquired more than a half-dozen security system integration firms in the last year or so For additional insights into ADT’s game plan and the strategy behind these acquisitions, we presented the following questions to Chris BenVau, ADT’s Senior Vice President of Enterprise Solutions. Q: ADT has been actively acquiring regional integrators this year – more than a half a dozen to date. Please describe the history of how ADT came to embrace a strategy of acquiring regional integrators as a route to growth? ADT's acquisition of Red Hawk is set to close in December, and brings premiere fire and life/safety solutions BenVau: Our acquisition strategy started at Protection 1 when we embarked on our journey to build out our commercial and national account business and add enhanced integration capabilities to our portfolio. The merger of Protection 1 and ADT brought that foundation to ADT which up to that point was primarily a residentially and SMB-focused company. After the merger, we set out to identify and acquire additional regional integrators that would continue to build on that foundation and deliver enhanced technical solutions, advanced technologies and an expanded service, install and support footprint. Through our acquisitions we now operate two Network Operations Centers and three Centers of Excellence. We are also unique in the industry with the number and variety of certifications, like Cisco and Meraki, our engineers hold which ultimately allows us to offer Managed Security as a Service. They have also enhanced our operational capabilities. Q: What criteria do you use to evaluate whether an integrator is a good “fit” for ADT? BenVau: First and foremost, we look at the culture of the companies. The companies that we target for acquisition must be metrics- and customer service-driven. Secondly, we look at the leadership teams. ADT view their acquisitions more like mergers and take a patient approach to integrating them into their business We have been fortunate in the fact the leadership of the companies we acquired remain with us today in key management and executive positions helping to drive continued growth within their organisations. We also evaluate their current customer base, unique solutions and their ability to complement and enhance our portfolio with the goal of becoming a leading full-service, enterprise commercial provider. Our acquisitions have bolstered our network capabilities, brought enterprise risk management services, and a broader solution set in high-end video and access control solutions. Our most recent acquisition – Red Hawk, set to close in December – brings us premiere fire and life/safety solutions. Q: What changes are typically needed after an integrator is acquired in order to adapt it to the ADT corporate model? BenVau: We view our acquisitions more like mergers and take a patient approach to integrating them into ADT while taking into account their culture. We want to ensure that we find the right positions for their people, embrace the right messaging and put the right processes in place. We acquire these companies because they are the best in their respective businesses and geographies and bring their knowledge and experience in markets or with solutions that we may not have had previous access to. ADT can support clients with their own in-house technicians which helps to ensure a consistent security program Q: How can regional integrators benefit from the ADT brand? Have your newly acquired integrators realised additional growth? BenVau: The companies we have acquired, generally, have exceeded expectations and surpassed initial goals. ADT brings expanded opportunities for these companies as well with our national footprint. Our National Account Sales Team has seen impressive growth over the years and are only limited by our ability to deliver. These integrators help to deliver on that. In the past, the regional players may have had to rely on sub-contractors to service their larger clients. With ADT, we can now support those clients with our own in-house technicians which helps to ensure a consistent security program across multiple locations.Our National Account Sales Team has seen impressive growth over the years and are only limited by our ability to deliver" Q: Are additional integrator acquisitions planned this year and into 2019? How much is enough and when will it end (or slow down significantly)? BenVau: We expect to close on our latest acquisition, Red Hawk, before the end of 2018. Red Hawk brings a national footprint focused on fire/life safety and security to ADT. While ADT already had a robust security offering, Red Hawk will contribute significantly to the fire side of the business. In addition, we will continue to evaluate the companies in the industry to determine if additional acquisitions make sense. Q: Do you expect greater consolidation of the integrator channel in the industry as a whole? Why is this a good time for consolidation? Is it a good M&A market for buyers like ADT? BenVau: We will continue to evaluate companies in the industry to determine if further acquisitions make sense. As for the industry, we can only speak for ourselves. Our focus is on investing in our field organisation, in particular our service technicians, engineers and project management teams" Q: What other trend(s) do you see in the industry that will impact ADT (on the commercial side) in the next year or so, and how? BenVau: In addition to their moves in the commercial integrator space, ADT has also sought to expand their presence in cybersecurity Networking is a big one. As we continue to drive integration of devices and services, from AI, “the cloud,” machine learning and even analytics, there will be more focus on the network they ride on. A deeper knowledge of network design, bandwidth impact, and system integration will be critical. As part of our acquisition strategy, we focused on talent to add to the team and have been able to add to our bench strength in this area. Q: Any other comments/insights you wish to share about ADT’s strategy, future, and role in the larger physical security marketplace? BenVau: Our focus is on investing in our field organisation, in particular our service technicians, engineers and project management teams. The cornerstone of our success lies in our ability to deliver outstanding customer support and service. It starts with sales and the ability to deliver security and life safety technologies, but it ends with a delighted customer who partners with us to help secure the things that matter most to them. Our recent acquisitions have more than doubled our commercial field operations teams and are key to establishing the ADT Commercial brand as a leading full-service provider of enterprise solutions to the marketplace.

Does “security technology” cover the broader application possibilities of today’s systems?
Does “security technology” cover the broader application possibilities of today’s systems?

The concept of how security systems can contribute to the broader business goals of a company is not new. It seems we have been talking about benefits of security systems beyond “just” security for more than a decade. Given the expanding role of technologies in the market, including video and access control, at what point is the term “security” too restrictive to accurately describe what our industry does? We asked the Expert Panel Roundtable for their responses to this premise: Is the description “security technology” too narrow given the broader application possibilities of today’s systems? Why?