SecuriTea

Biometric access control is ready for your door. Can you prove it to your board, your lawyers, and the people walking through it?

Biometric testing is moving from vendor claims to independent, recurring, public results. In this solo episode of SecuriTea, I break down what that means for physical access control (PACS) and for security leaders deciding whether to put face and fingerprint readers on their doors.

What we cover:

- What DHS's remote identity testing (RIVR) found, and why it covers remote selfies, not door readers

- Europe's end-of-2026 testing deadline and the AI Act's December 2027 date

- Why a door reader and a phone selfie are different attack surfaces

- Why you can't reset a fingerprint, and where the template should live

- One-to-one vs one-to-many, and the three objections you'll hear

- The Three Tests Before a Reader Goes on the Wall: Attack, Template, Permission

Monday morning: email your vendor the three questions, map where biometric templates already live, and book 20 minutes with counsel and staff reps before any rollout.

Drop a headline, a security headline you want me to check out, and I'll bring the receipts.

Subscribe to the SecuriTea Substack: [Substack link]

CHAPTERS

0:00 Cold open

0:31 Episode 20

1:09 What DHS just changed

3:51 Europe's testing clock

5:15 It's about proof and permission

5:53 Why biometrics wins at the door

7:34 A door reader vs a phone selfie

9:43 The weak spot: thin test data

11:01 Permission and the 67%

11:43 "Fingerprints can't be stolen"

13:29 You can't reset a fingerprint

14:52 Three objections you'll hear

17:36 The Three Tests

20:36 A hospital example

22:00 Monday morning actions

23:05 The testing clock

23:52 Where I land

SOURCES

DHS RIVR-2 (Maryland Test Facility): https://mdtf.org/Rivr2

DHS puts numbers behind RIVR-2 (Biometric Update): https://www.biometricupdate.com/202610/dhs-puts-numbers-behind-rivr-2-details-new-deepfake-testing

EU identity providers' end-2026 testing deadline (Biometric Update): https://www.biometricupdate.com/202610/qtsps-face-end-2026-deadline-for-biometric-attack-testing-under-eidas

Regulation (EU) 2026/1744 (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744

HID 2026 State of Security and Identity Report: https://newsroom.hidglobal.com/hids-2026-state-security-and-identity-report-identity-convergence-drives-new-focus-trust-protection

NYC Health + Hospitals breach (TechCrunch): https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/

This episode is not legal advice. Talk to counsel about your specific deployment.

#BiometricAccessControl #PhysicalSecurity #SecuriTea

Your employees want to be safe. They just don't want to be watched.

Bert Williams, president of the International Organization of Black Security Executives (IOBSE), joins SecuriTea live from the IOBSE annual conference in Dallas to explain why more cameras does not mean more safety, and what actually works instead.

We dig into how a Fortune 500 security program cut access violations by 75% by pairing technology with communication, training, and trust.

In this episode:

- Why the "surveillance gap" is opening inside our buildings

- How to message a violation so it never feels like a speeding ticket

- Bringing HR, legal, and communications into security rollouts early

- Designing security into construction projects and tenant/property-manager handoffs

- How bias gets built into systems, and why diverse leadership catches it

- One training shift any leader can make this Monday

- Why security is a relationship industry, not a regulation industry

About Bert Williams: President of IOBSE, founded in 1982 to support Black professionals in security, and a corporate security executive who has led access control, site consolidation, and pandemic re-entry planning at a Fortune 500 company.

Have a headline you want unpacked? DM it to me and I'll bring the receipts.

0:00 Cold open: Employees want safety, not surveillance

0:04 Safety, trust, and the 75% drop in violations

1:35 Welcome and IOBSE's history

2:40 Bert's path into IOBSE and the student program

5:30 Making security proactive, not invasive

6:50 What drove the 75% reduction: tech vs. people

10:30 Consolidating four sites and designing security in

13:00 Property management handoffs

15:30 Diverse leadership and bias in systems

17:45 One training shift to make this Monday

19:40 Better communication for security teams

21:00 Security is a relationship industry

#Security #PhysicalSecurity #WorkplaceSafety #IOBSE #CorporateSecurity #SecurityLeadership

Alert Enterprise's EVP of Sales & Marketing, Will, explains why physical security and cybersecurity are still treated as separate budgets, and what that gap actually costs.

Recorded live on the show floor at GSX (Global Security Exchange), episode 18 of the SecuriTea podcast.

TIMESTAMPS

00:00 Cold open at GSX

01:05 Back-door vs front-door analogy

03:30 What the platform won't do

05:12 Robot dog break

06:30 The $90M badge-data story

What is physical-cyber security convergence? Convergence means treating physical access control (badges, doors, visitors, contractors) and cybersecurity (identity, network, IT governance) as one connected risk picture instead of two separate teams and two separate budgets.

Why does this matter to a board member? Most companies spend heavily to lock their cyber back door but leave the physical front door open, meaning badge and access-control data goes unmonitored even though it can reveal real financial risk.

What is the $90M badge-data example? According to Alert Enterprise, one customer used badge-swipe data to discover contractors were billing 80 hours while only on-site for 40, a gap that led to $90M in savings. This is Alert Enterprise's own reported case, not independently verified.

What does Alert Enterprise not do? Despite being an identity-focused platform, Alert Enterprise is not a cybersecurity intelligence tool. It does not manage cyber identity and access management (IAM) directly. It connects physical access governance to the IT systems already in place.

Physical security vendors have spent decades selling software platforms that failed their users.

Live from IOBSE in Dallas, 30-year security veteran Holly Hunt pulls back the curtain on the industry's historical mistakes, from the early collapse of premature PSIM deployments to the systemic trap of the traditional "pipe economy".

Holley and Xander break down why command-and-control culture cripples data sharing, how enterprise teams at Slack and SentinelOne automated compliance without human conflict, and why 360-degree mentorship is the only defense against industry stagnation.

Chapters

00:00 - Wire-Puller to Earning Respect in 2000
02:40 - The "Pipe Economy" vs. The Customer
04:35 - Why Early PSIM Deployments Hurt Clients
06:38 - The Real Reason Security Silos Exist
10:15 - Why Your Career Isn't a Journey—It’s an Odyssey
13:40 - Turning Slack Into a Corporate SOC
15:45 - Using Ambient AI as the "Bad Cop" for Zero Trust
17:15 - Breaking Past the Gatekeepers: Allyship at IOBSE
22:15 - "Growth Is a Personal Decision"
23:55 - The 360-Degree Mentorship Rule

Connect with SecuriTea: Signal over noise. Integration over silos. Action over outrage.

Holley Hunt: https://www.linkedin.com/in/happyhunting/
Xander Alexander: https://www.linkedin.com/in/xanderalexander

Are low-bid private security contracts saving your enterprise money, or are they creating an indefensible negligence claim in civil court?

In this episode, licensed attorney, 35-year industry veteran, and ASIS International President Eddie Sorrells breaks down the legal and operational realities of modern security procurement. We examine surging 2026 labor market wage trends, the risks of replacing human personnel with unintegrated AI, and the single cultural metric that proves real security ROI.

Key Questions Answered:

• Why are lowest-bid security contracts treated as evidence of negligence in court?

• How does guard turnover and lack of training impact corporate liability?

• What is the operational difference between threat prevention and cyber-physical resilience?

• How do ASIS certifications (CPP, PSP, PCI) establish legal defensibility?

• What core question must leadership ask security providers before signing an RFP?

• How does frontline officer culture directly impact enterprise brand reputation?

Featured Guest:

Eddie Sorrells, Esq., CPP, PSP, PCI: President of ASIS International, Chief Operating Officer and General Counsel at DSI Security Services, and author of "Lead Where You Stand: Building a Career in Private Security Leadership."

Chapters & Timestamps:

00:00 - The Legal Time Bomb of Cheap Security

01:40 - Signal Over Noise: Setting the Security Baseline

02:21 - From Frontline Guard to 35-Year Executive: Eddie Sorrells

05:04 - ASIS International and Developing Next-Gen Talent

08:45 - Threat Protection vs. True Operational Resilience

11:26 - The 2026 Labor Shift: Why Security Wages Are Surging

14:44 - Cyber-Physical Convergence: Guards on Corporate Networks

17:35 - Human Guards vs. AI Tech: Deploying the Right Tool

21:20 - The Courtroom Lens: Defending Your Procurement Decisions

24:45 - Demystifying the Triple Crown: CPP, PSP, and PCI Value

28:56 - The #1 Leadership Question to Ask Security Providers

31:38 - The Forgotten KPI: Voice of the Customer and Safety Culture

36:04 - "Lead Where You Stand": Real-World Leadership Lessons

40:05 - The Plateau Fallacy: Career Longevity in Security

Resources Mentioned:

• ASIS International: https://www.asisonline.org
• Book: "Lead Where You Stand" by Eddie Sorrells

#CorporateSecurity #RiskManagement #PhysicalSecurity #ASISInternational #GeneralCounsel #PremisesLiability #SecurityROI

Are physical security integrators ready for forced IT and AI network convergence? In this episode of SecuriTea live from the PSA Conference in Denver, host Xander Alexander sits down with Wayne Smith, CEO of Tech Systems, Inc.

Wayne breaks down why Tech Systems became one of the first physical security integrators to achieve both ISO 27001 (Information Security) and ISO 42001 (AI Management Systems). We discuss how integrators can build 40%+ recurring monthly revenue (RMR), the truth about hiring IT talent over legacy physical installers, and why keeping manufacturers at arm's length is killing your growth.


TIMESTAMPS:
00:00 - Cold Open: Forced Network Adoption & ISO Standards
01:00 - Introduction & Live from PSA Denver
02:24 - Why Tech Systems Pursued ISO 27001 & ISO 42001
03:30 - Demystifying AI Hype vs True Governance in Physical Security
06:28 - Why Physical Security Adoption Has Been So Slow
07:36 - Forced Adoption: No One Is Buying Analog Cameras
09:28 - How Integrators Build 40%+ Recurring Revenue (RMR)
11:08 - Stop Teaching Old Techs IT: How to Bring in True IT Talent
13:44 - The Death of Arm's-Length Manufacturer Relationships
16:29 - Why Education and Standards Elevation Lift the Whole Industry


GUEST INFO:
Wayne Smith is the CEO of Tech Systems, Inc. (TSi), an employee-owned leader in converged security solutions and systems integration.
TSi: https://techsystemsinc.com/
CEO: Wayne Smith (https://www.linkedin.com/in/wayne-smith-3192944/)

CONNECT WITH SECURITEA AND IT'S HOST:
Host: Xander Alexander (@xanderonstage)
YouTube: https://youtube/@xanderonstage
Linkedin: https://linkedin.com/in/xanderalexander

#PhysicalSecurity #Cybersecurity #ISO42001 #ISO27001 #SystemsIntegration #RMR #SecuriTea #TechSystems #AI

No Affiliation with Motorola Solutions or its subsidiaries.

Your security system may become obsolete before it stops working.

The camera may still produce a clear image.
The access-control panel may still open doors.
The sensor may still transmit data.

But the cryptography protecting the system could reach the end of its useful life long before the hardware fails.

President Trump’s post-quantum cryptography mandate is often discussed as a federal cybersecurity issue. This episode explores the part of the conversation many security leaders are overlooking: physical security.

Xander Alexander examines what post-quantum migration could mean for:

- Security cameras and access-control systems
- AI-enabled edge devices
- Physical-security manufacturers
- Security integrators and consultants
- Device identities and digital certificates
- Firmware and AI-model updates
- Cybersecurity and IT infrastructure
- IoT and operational technology
- Critical-infrastructure environments
- Long-term technology procurement

The episode also explains why AI multiplies the number of trust decisions happening at machine speed and how integrators may become advisors who help customers manage the lifecycle of trust.

The central question:

Will the trust protecting your security system last as long as the system itself?

Subscribe to  @XanderOnStage  for independent thought leadership on the forces reshaping AI, cybersecurity, physical security, IT, IoT, and OT.

YouTube Chapters

0:00 The trust question no one is asking
1:52 Welcome to SecuriTea
3:04 What President Trump’s mandate requires
5:21 Why physical security should pay attention
6:51 Harvest now, decrypt later
8:15 The new cryptographic end of life
10:28 What manufacturers must prepare for
13:04 Why AI multiplies trust decisions
15:16 The integrator’s new opportunity
17:14 Five actions security leaders can take
19:22 The future of trust and convergence
21:03 The question to ask before your next deployment

The line between cyber attacks and kinetic, physical damage has completely dissolved. Hackers are utilizing network-connected cameras and access control systems to monitor executive behaviors and manipulate facility locks. Physical security is officially a cybersecurity battlefield.

Xander Alexander and security expert Antoinette King expose the massive vulnerabilities in legacy integration mindsets and map out the operational mechanics of Convergence 2.0.

Learn how to build recurring monthly revenue (RMR) around device hardening, close the skilled labor gap, and apply strict data governance to school districts and enterprise ecosystems alike[cite: 1].

👇 Connect with Antoinette King, CISSP, PSP:
LinkedIn: https://www.linkedin.com/in/antoinette-king-cissp-psp
https://credocyber.com/

👇 Connect with Xander Alexander:
LinkedIn: https://www.linkedin.com/in/xanderalexander

If you found value in this episode, like, subscribe, and hit the notification bell to stay ahead of modern security threats.

#Cybersecurity #PhysicalSecurity #Convergence #Infosec #NetworkHardening #DataPrivacy #SecuriTea

Is the traditional B2B sales model officially dead? In this episode of SecuriTea, host Xander Alexander sits down with physical security powerhouse tech evangelists Phil Coppola ( @theinsidetrack  ) and Jeremy Fromm ( @TheMercuryMinute  ) at PSA TEC 2026 to unpack why "evangelism" is the ultimate evolution of modern sales, influence, and personal branding in 2026.

From pulling hours of high-converting content directly out of a standard PowerPoint slide deck to the exact technical metrics that matter on YouTube versus LinkedIn, this roundtable lays out the raw, unpolished blueprint for breaking through the noise. Plus, they dive deep into the technical convergence of physical security (OSDP, AES-128, TLS) and AI threat vectors, and why your audio quality will make or break your content strategy.

🚨 Smash that subscribe button for more exclusive tactical insights from the convergence of security industry leaders!

Physical security and cybersecurity converged years ago, yet countless enterprises continue to play a dangerous game of "hot potato" with their network infrastructure.

In this episode of SecuriTea, host Xander Alexander sits down with Stacy Steiger, VP of Product and Marketing at  @SalientSystems , to expose why modern video management platforms are the new frontier of the enterprise attack surface.

If your organization treats security cameras as simple isolated devices rather than complex network endpoints, you are operating at your own peril.

Discover what "Secure by Design" truly requires at the architectural phase, why your IP cameras must be partitioned from the primary business network, and the exact step-by-step active asset management framework required to eliminate critical firmware and credential blind spots before hackers exploit them.

Chapters
00:00 - The New Video Surveillance Imperative
01:01 - The IT vs. SecOps Tug-of-War
01:40 - Designing a "Secure by Design" Architecture
02:25 - Why Cameras Are Actually Mini-Servers
03:48 - The 1 Actionable Step: Camera Attack Surface Audit
04:31 - Executing an Active Credential & Firmware Policy
04:46 - Breaking Silos for Absolute Operational Awareness