Converged Security: Where Physical Meets Cyber in KSA

There is a question that produces the same uncomfortable pause in almost every organisation. Who patches the video recorder?

Facilities bought it, because cameras are a facilities matter. IT never saw the purchase order, so it is not in the asset inventory, not in the patching cycle and not in the monitoring scope. The installer configured it during commissioning three years ago and has not been back. It holds ninety days of footage, sits on the network, and answers to nobody.

That recorder is a server. So is the access control panel, the building management gateway, the intercom controller and the signage player. Every one of them runs software, holds credentials and has an IP address, and in most organisations every one of them belongs to a department with no cybersecurity mandate.

This guide covers why the two disciplines already converged whether anyone planned it, the attack paths that cross the boundary in both directions, the detections that convergence makes possible, and what a Saudi organisation should actually change.

What Is Converged Security?

Converged security is the practice of managing physical security and cybersecurity as a single risk domain, with shared asset visibility, shared identity, shared monitoring and a single owner for the combined risk.

The word convergence is often used to mean two teams meeting quarterly. That is coordination, and it is better than nothing. Convergence means something stronger: the two domains are treated as one because the systems, the identities, the data and the attack paths are already one.

The technical merger is complete and not optional. Twenty years ago a camera produced an analog signal on coaxial cable and a lock was a mechanical device with a key. Today a camera is a networked computer running an embedded operating system, and a lock is controlled by a networked panel that authenticates a credential against a directory. Nothing about that architecture is physical-only.

What remains separate is the organisation chart. Physical security typically reports through facilities, administration or health and safety. Cybersecurity reports through IT. They hold different budgets, run different procurement processes, work with different vendors and use different vocabulary for the same risk. The gap between them is not a policy failure. It is where the unowned equipment lives.

Why Have the Two Already Converged?

Five forces did this, and none of them required a decision from anyone.

Physical security systems became network systems. Cameras, recorders, door controllers, readers, intercoms, elevator controls, building management gateways and digital signage players are all computers with network interfaces, embedded operating systems and administrative credentials. The relevant comparison is set out in IoT device lifecycle management: a device that receives no firmware updates after commissioning ages into a liability.

Cyber incidents now produce physical consequences. Ransomware that reaches a building management system affects cooling, lighting and ventilation. An attack on an access control server can lock people out or let them in. A manipulated fire signal releases every fail-safe door in the building simultaneously, which is a security event created entirely from a keyboard.

Physical access remains the most reliable path to a network. An attacker inside the building can plug into a live network port in a meeting room, attach a device to an unattended workstation, or walk out with hardware. No firewall addresses any of that.

Identity converged. The same person, in the same directory, holds a badge and a login. When those are managed by different systems with different processes, a leaver keeps one of them. Usually the badge.

The data converged. Video, access logs and biometric templates are personal data governed by the same law as IT logs, which means the facilities-owned camera system carries obligations the facilities team was never briefed on.

Siloed, Coordinated or Converged: Which Model Are You Running?

The table below describes the three operating models honestly, including what each one fails at.

Criterion	Siloed	Coordinated	Converged
Who owns cameras, locks and building systems	Facilities, with no IT involvement	Facilities, with IT consulted	Jointly, with one named risk owner
Asset inventory	Two lists, or one list missing the building systems	Two lists, reconciled occasionally	One inventory covering every connected device
Patching and firmware	Nobody, after commissioning	Ad hoc, when someone raises it	In the standard lifecycle
Procurement	Physical tenders have no security clauses	Security reviews tenders sometimes	Security requirements written into every tender
Identity	Separate badge and account systems	Manually reconciled	One identity source for both
Incident response	Separate plans, separate exercises	Informed of each other	One plan, joint exercises
Detection capability	Each sees half the picture	Correlation after the fact	Cross-domain detection in near real time
Typical failure	An internet-exposed recorder nobody knew about	A leaver retains badge access for months	Slower decisions until governance settles

What Attack Paths Cross the Boundary?

The paths run in both directions, and both are used.

From the network to the physical world:

• An internet-exposed recorder or camera with default or unchanged credentials, giving an attacker a foothold inside the network and a live view of the premises
• A building management gateway on the flat corporate network, providing lateral movement into a segment nobody monitors
• An unpatched access control server, frequently joined to the domain and running an operating system version long out of support
• Manipulation of a fire or life safety signal, releasing fail-safe doors across a building, which is why the arrangement described in fire safety integration has to be designed with attack scenarios in mind, not only failure scenarios
• Compromise of the credential management system, allowing an attacker to issue themselves a valid badge rather than defeating a door

From the physical world to the network:

• A live network port in a lobby, meeting room or unoccupied desk, providing direct access to the internal network
• Tailgating into a communications or server room, where physical access to equipment defeats most remote controls
• A contractor connecting a laptop to the building network to commission a system, with no assessment of that laptop
• Devices left in accessible locations, including recorders and controllers mounted in unlocked cupboards
• Theft of hardware holding data or credentials

The pattern common to almost all of these is not sophistication. It is ownership. Each one exists because a device or a doorway sits in a gap between two functions, and the control that would have caught it belongs to neither.

What Can You Detect Only by Converging?

This is the part that justifies the effort, because convergence produces detections that neither function can generate alone.

Impossible presence. A badge records an employee entering the Dammam office at 08:40. At 09:15 the same identity authenticates to a corporate application from an address in another country. Neither event is suspicious on its own. Together they mean a credential is compromised, or a badge is being used by someone else. Physical security sees the first event, IT sees the second, and only a converged view sees the contradiction.

Logical access without physical presence. An administrator account is used from an office workstation at a time when no badge event places that person in the building. On a system that requires on-site access, that is a strong signal rather than an anomaly to be explained away.

Access without exit. Repeated entries with no corresponding exits indicate tailgating, propped doors or a badge in circulation that should not be.

Credential issuance anomalies. A new badge issued outside the joiner process, or issued to an identity that has no active account, is exactly what an attacker who has social-engineered the service desk produces.

Video verification of a critical access event. A door event at 02:14 in a server room becomes evidence only when the associated footage identifies who was holding the card. Linking the two systems converts a log line into an answer, which is the reasoning behind pairing access control with video as described in smart access control integration.

None of these require new hardware. They require the two event streams to reach the same place, which is usually an achievable project rather than a transformation programme.

How Do You Actually Converge?

Seven steps, in an order that produces value early.

Build one asset inventory. Add every connected device that facilities, operations or a contractor installed: cameras, recorders, controllers, readers, intercoms, gateways, sensors, signage players and irrigation controllers. Walk the building if the records do not exist. This step alone usually surprises everyone involved.

Segment the building systems. Put physical security and building systems on their own VLANs with explicit rules, never on the flat corporate network and never reachable from guest wireless. The reasoning is set out in network segmentation and applies here exactly as it does to operational technology security.

Bring the devices into lifecycle management. Firmware updates, credential rotation, end-of-support tracking and replacement budgeting. A device that no longer receives firmware updates has a retirement date whether or not anyone has written it down.

Write security clauses into physical security tenders. This is the highest-leverage change available, because it prevents the problem rather than remediating it. Require, at minimum: no default or shared credentials at handover, encrypted credential technology and OSDP reader wiring, a documented firmware update commitment with a stated support period, a vendor vulnerability disclosure process, a complete asset list as a contractual deliverable, and named individual accounts for the installer with revocation at practical completion.

Unify identity. One authoritative source for people, feeding both the badge system and the account directory, so joiners, movers and leavers are processed once. A leaver retaining building access after their account is disabled is the most common single finding in a converged review.

Run joint incident response. Facilities belongs in the tabletop exercise, because a scenario involving a compromised access control system is not resolvable by IT alone. The exercise design is covered in tabletop exercises, and adding a facilities scenario is a small change with disproportionate value.

Name an owner. Convergence fails on governance rather than technology. Someone must be accountable for the combined risk, with authority over both domains or a direct line to whoever holds each. Without that, every cross-boundary issue becomes a discussion between two departments that each believe it belongs to the other.

What Do Saudi Organisations Need to Address?

Four points apply specifically in the Kingdom, and the first is widely misunderstood.

Ministry of Interior approval is not a cybersecurity assurance. Camera systems at covered facilities fall under the Law of the Use of Security Surveillance Cameras, issued under Royal Decree No. M/34 of 1444H, which requires Ministry of Interior approval covering the sale, installation, operation and maintenance of the equipment. That approval addresses the surveillance function: who may install, where cameras may and may not be placed, signage and retention. It says nothing about whether the recorder runs current firmware, whether default credentials were changed, or whether the device is reachable from the internet. Organisations routinely treat the approval as an assurance covering the whole system. Ask for the cybersecurity evidence separately, in the tender.

Regulatory frameworks already expect both. Physical security is a control domain within the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) alongside asset management and network security, and the Authority has issued separate Operational Technology Cybersecurity Controls addressing industrial and building control environments. Financial institutions carry the additional obligations of the SAMA Cybersecurity Framework. The regulatory expectation is already converged even where the organisation is not.

Life safety sets a hard boundary. Locked doors on escape routes fall under the General Directorate of Civil Defence, and any converged design has to respect that fail-safe behaviour is not negotiable against a security preference. This cuts both ways: a cyber attack that drops power or spoofs a fire signal releases those doors, so the security architecture must account for an adversary deliberately triggering the life safety response.

Video, access logs and biometrics are personal data. All three fall within the Personal Data Protection Law (PDPL) administered by the Saudi Data and Artificial Intelligence Authority, which means the facilities-owned camera system carries retention, access and cross-border transfer obligations. Where a cloud video platform stores footage abroad, that is a transfer regardless of which department signed the contract.

One structural factor amplifies all of this. Saudi projects are delivered heavily through system integrators, and the same integrator frequently supplies the cameras, the access control, the building management system and the network they all sit on. That is efficient during delivery and creates a single point of concentrated knowledge afterwards, which belongs in third-party risk assessment and in the handover asset list.

Blue Edge, a technology distributor based in Dammam, Saudi Arabia, supplies Akuvox IP intercom and door entry and Akubela smart building systems on the physical side, and distributes NinjaOne endpoint and patch management and KnowBe4 security awareness training on the cyber side, along with the structured cabling and networking both depend on.

What Are the Most Common Convergence Mistakes?

Six mistakes account for most organisations that remain siloed while believing otherwise.

Nobody owns the building systems. Facilities bought them, IT never saw them, and the accountability gap is exactly where the unpatched recorder lives.

Physical security tenders contain no cybersecurity requirements. A camera system is evaluated on coverage and price, and the security of the device never appears in the specification.

Building systems sit on the flat corporate network. A camera or a controller with weak credentials becomes a route into finance and HR systems.

Two identity systems. A leaver loses their account on their last day and keeps their badge for months, because the two processes were never joined.

Facilities is absent from incident response. A scenario involving access control or building systems cannot be resolved by a team with no authority over either.

Treating installer approval as security assurance. Ministry of Interior approval covers the surveillance function of the system, not the firmware, credentials or network exposure of the devices.

Start With the Inventory, Then the Tender

Converged security sounds like a governance programme, which is why it stalls. Two concrete actions deliver most of the value and neither needs a restructure.

First, build one asset inventory that includes every connected device installed by facilities, operations or a contractor. Walk the building if necessary. The list will contain equipment nobody has thought about since commissioning, and that list is the actual exposure.

Second, put cybersecurity clauses into the next physical security tender. No default credentials at handover, encrypted credentials and OSDP wiring, a stated firmware support period, a vulnerability disclosure process, named installer accounts revoked at completion, and an asset list as a deliverable. Every future system then arrives in a supportable state rather than needing to be retrofitted into one.

After that, the sequencing is straightforward: segment the building systems, join the identity processes, add a facilities scenario to the incident response exercise, and name someone accountable for the combined risk.

The organisations that handle this well are rarely the ones with the largest security teams. They are the ones where somebody can answer, without hesitating, who patches the video recorder.

Frequently Asked Questions

• Are CCTV cameras and recorders a cybersecurity risk?

  Yes. A modern camera is a networked computer running an embedded operating system, and a recorder is a server holding data and credentials. Both routinely run firmware that has not been updated since commissioning, and both are frequently installed with default or shared credentials. An internet-exposed recorder gives an attacker a foothold on the network and a live view of the premises at the same time, which is why they belong in the IT asset inventory.

• Should IT or facilities own building security systems?

  Ownership should be joint, with one named person accountable for the combined risk. Facilities understands the operational requirement and holds the vendor relationships. IT understands network exposure, patching and identity. Splitting the systems entirely to either function produces a predictable failure: facilities alone means nobody patches, and IT alone means decisions get made without the operational context. Name the accountable owner explicitly rather than assuming shared responsibility.

• What can you detect by combining badge data with login data?

  Contradictions that neither system sees alone. A badge entry in one city and a remote login from another country minutes later indicates a compromised credential. An administrator login from an office workstation with no badge event placing that person in the building is a strong signal. Repeated entries with no matching exits indicate tailgating or propped doors. None of these require new hardware, only both event streams reaching the same place.

• What cybersecurity requirements belong in a CCTV or access control tender?

  At minimum: no default or shared credentials at handover, encrypted credential technology and OSDP reader wiring rather than Wiegand, a documented firmware update commitment with a stated support period, a vendor vulnerability disclosure process, named individual installer accounts revoked at practical completion, and a complete asset list as a contractual deliverable. These clauses cost nothing at tender stage and are expensive to retrofit afterwards.

• Does Ministry of Interior approval mean a camera system is secure?

  No, and this is a common misunderstanding. Approval under the Law of the Use of Security Surveillance Cameras addresses the surveillance function: who may install and operate the system, where cameras may be placed, signage and retention obligations. It does not assess firmware currency, credential handling or network exposure of the devices. Request cybersecurity evidence separately and write it into the tender alongside the regulatory approval.

---

Published 9 September 2026 • Last updated 3 October 2026 • This article is reviewed when standards, regulations or product guidance change.