We’re Tracking the Future of Security

Author: Osiris

  • Data Center Physical Security Tiers: What Uptime Institute Standards Actually Require

    Data Center Physical Security Tiers: What Uptime Institute Standards Actually Require

    Data center operators and vendors frequently reference “Tier III” or “Tier IV” certification when describing physical security posture, but the Uptime Institute’s Tier Classification System is fundamentally a redundancy and uptime standard for electrical, mechanical and cooling infrastructure — not a prescriptive physical security checklist. Understanding what Tier ratings actually certify, and what they don’t, matters for anyone evaluating a data center’s real security posture.

    What Tier Ratings Measure

    The four Tier levels (I through IV) describe increasing redundancy in power and cooling infrastructure, from Tier I’s single, non-redundant delivery path to Tier IV’s fully fault-tolerant design with multiple independent, physically isolated distribution paths that can sustain a single equipment failure or planned maintenance event without disrupting operations. Higher Tiers correlate with higher available uptime, but the certification itself is an engineering-infrastructure standard, not a security-controls audit.

    Where Physical Security Fits

    Physical security controls — perimeter fencing, mantrap entries, biometric access control, video surveillance coverage, security staffing models — are typically evaluated separately, through frameworks like SOC 2 Type II audits, ISO 27001 certification, or customer-specific due diligence questionnaires, rather than through the Tier system itself. A facility can hold a high Tier rating for its infrastructure redundancy while having comparatively modest physical security controls, and vice versa; the two certifications answer different questions.

    Layered Physical Security in Practice

    In practice, most colocation and hyperscale data centers implement a layered physical security model regardless of Tier rating: perimeter fencing and vehicle barriers, a staffed and monitored entry point, mantrap or interlocking doors preventing tailgating into the data hall, cabinet-level locking for individual customer environments, and comprehensive video coverage of all these layers with defined retention periods. The specific combination and rigor of these layers varies significantly by operator and customer tier of service, independent of the facility’s Uptime Institute rating.

    Reading Vendor Claims Correctly

    When evaluating a data center provider, treating “Tier III” or “Tier IV” as a proxy for security maturity is a common but mistaken shortcut. The more relevant questions for security due diligence are what specific physical security controls are documented and independently audited, what the incident history looks like, and whether the facility’s actual physical security implementation has been validated by a third party — none of which the Tier rating itself certifies.

    Conclusion

    Tier ratings remain a useful, standardized way to compare infrastructure redundancy and expected uptime across data center providers, but they should not be treated as a substitute for evaluating physical security controls directly. Organizations selecting a data center for security-sensitive workloads need to request and review security-specific certifications and documentation separately from whatever Tier rating the facility advertises.

  • Exit Devices and Delayed Egress: Balancing Life Safety and Security at Emergency Doors

    Exit Devices and Delayed Egress: Balancing Life Safety and Security at Emergency Doors

    Every secured door creates a quiet tension: the same barrier designed to keep unauthorized people out is also a door that occupants may need to pass through quickly in an emergency. Exit devices and delayed-egress hardware exist specifically to manage that tension, and getting the configuration wrong is both a security gap and a life-safety liability.

    Panic Hardware and Life Safety Codes

    Panic hardware — the horizontal crash bars found on many commercial exit doors — is designed so that a single motion, pushing against the bar, releases the latch regardless of how the door is otherwise secured from the outside. Life safety codes in most jurisdictions require unobstructed, immediate egress from assembly and high-occupancy spaces, which generally means panic hardware cannot be paired with any locking mechanism that could delay a building occupant’s exit during an emergency.

    Delayed Egress as a Controlled Exception

    Delayed-egress locking is a specific, code-recognized exception to immediate-egress requirements, used where a facility has a legitimate security reason to briefly deter unauthorized exit — retail loss prevention, infant-abduction prevention in maternity wards, or controlling movement in a secure facility. A delayed-egress device allows the door to remain locked for a defined period, typically up to 15 seconds, after someone pushes against the exit hardware, accompanied by a local alarm, after which the door releases automatically whether or not the person is still pushing.

    Codes governing delayed egress are specific about what triggers immediate release: an active fire alarm or sprinkler activation must override the delay entirely, since the exception exists for security deterrence, not for overriding actual emergency egress needs.

    Access-Controlled Egress vs. Delayed Egress

    Access-controlled egress hardware is a related but distinct category, used on doors where free egress is required but the facility wants to log or monitor who is leaving. Unlike delayed egress, these doors release immediately on request-to-exit motion detection or a push, without an enforced delay, while still generating a monitored event for the security system.

    Fail-Safe vs. Fail-Secure at Exit Doors

    Whether a given exit door should fail safe (unlock on power loss) or fail secure (remain locked on power loss) depends on the specific occupancy and code requirements at that opening — a decision that has to be made door-by-door rather than as a blanket facility policy, since a single building often has doors serving genuinely different life-safety and security roles.

    Conclusion

    Exit hardware sits at the exact intersection of security and life safety, which is why its configuration is more heavily code-regulated than almost any other access control component. Facility and security teams designing or auditing exit-door hardware should treat local fire and building code requirements as the binding constraint, with security objectives implemented within whatever margin those codes actually allow.

  • CCTV Lens Optics: Focal Length, Varifocal and Fixed Lenses Explained

    CCTV Lens Optics: Focal Length, Varifocal and Fixed Lenses Explained

    Surveillance system discussions tend to focus on sensor resolution and AI analytics, but the lens sitting in front of that sensor determines what the camera can physically see before any of that processing happens. A high-resolution sensor paired with the wrong lens for its mounting distance and coverage goal will underperform a lower-resolution camera with correctly specified optics.

    Focal Length and Field of View

    Focal length, measured in millimeters, determines a lens’s field of view and magnification: shorter focal lengths (wide-angle) capture a broader scene at lower magnification, while longer focal lengths narrow the field of view and magnify distant subjects. The tradeoff is fundamental — a lens cannot simultaneously deliver a wide field of view and high magnification of distant detail, which is why sites often deploy a mix of wide-coverage and narrow-focus cameras rather than relying on one lens type throughout.

    Fixed vs. Varifocal Lenses

    Fixed lenses have a single, unchangeable focal length, set at manufacture or installation. They are simpler, generally cheaper, and often produce sharper images since there are fewer moving optical elements, but they lock in a specific field of view that cannot be adjusted after mounting without physically swapping the lens.

    Varifocal lenses allow the focal length to be adjusted within a range, either manually at installation or, on motorized varifocal models, remotely after the camera is mounted. This flexibility is valuable when the exact mounting distance and required coverage area aren’t known until the camera is physically installed, or when coverage requirements might change over the life of the deployment.

    Aperture and Low-Light Performance

    A lens’s maximum aperture, expressed as an f-number, determines how much light it can gather, which directly affects low-light image quality independent of sensor sensitivity. A lower f-number (a “faster” lens) admits more light, generally producing a brighter, less noisy image in low-light conditions, though very wide apertures can reduce depth of field, narrowing the range of distances that remain in sharp focus simultaneously.

    Matching Lens to Application

    Wide-angle lenses suit broad-area overview coverage — parking lots, open yards, retail floor overview — where identifying individual faces at distance is less important than tracking overall activity. Narrower, longer-focal-length lenses suit identification-critical points like entrances, cash registers, or license plate capture zones, where enough pixels-on-target are needed to resolve fine detail rather than broad context.

    Conclusion

    Lens selection is a design decision that has to happen alongside camera placement planning, not after it — a camera mounted at the wrong height or distance for its lens’s focal length will underperform regardless of sensor quality. Getting the pairing right, informed by the actual mounting distance and the specific identification-versus-overview goal of each camera position, is what turns a high-resolution sensor into genuinely useful footage.

  • Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    In most building fires, smoke inhalation rather than direct burns is the primary life-safety threat, which is why modern fire protection engineering treats smoke control as a distinct discipline from fire suppression. Sprinklers and fire-rated construction address the fire itself; smoke control systems address keeping escape routes usable while that fire is being dealt with.

    Why Smoke Is the Primary Threat

    Smoke spreads faster than fire, traveling through stairwells, elevator shafts, and HVAC ductwork well beyond the room of origin, and can rapidly make normally survivable spaces impassable due to reduced visibility and toxic combustion products. In high-rise buildings, where full evacuation to ground level can take significant time, keeping stairwells and refuge areas smoke-free during that evacuation window is often more operationally critical than the fire suppression response itself.

    Stairwell Pressurization

    Stairwell pressurization systems use dedicated fans to maintain the stairwell at a higher air pressure than the adjacent floor spaces, so that when a stairwell door opens during an evacuation, air flows outward from the stairwell into the fire floor rather than allowing smoke to flow into the stairwell. This positive-pressure design is what keeps a high-rise egress stairwell usable even on a floor where a fire is actively burning nearby.

    Getting pressurization right is a balancing act: too little pressure fails to keep smoke out, while excessive pressure can make stairwell doors difficult for occupants, particularly those with limited mobility, to physically open against the pressure differential during an evacuation.

    Smoke Zones and Compartmentation

    Large-footprint and high-rise buildings are typically divided into smoke zones, with smoke barriers, dampers and dedicated exhaust systems designed to contain smoke within the zone of origin rather than letting it spread building-wide. On fire alarm activation, building automation systems can trigger dedicated smoke-zone exhaust fans to actively remove smoke from the affected zone while supply fans elsewhere maintain pressure differentials that keep smoke from migrating into unaffected areas.

    Elevator Smoke Control

    Elevator shafts present a particular smoke-control challenge, since they can act as a chimney, rapidly drawing smoke through the building via stack effect. Elevator lobbies in modern high-rises are frequently designed with their own pressurization or smoke-purge systems, both to keep elevators usable for firefighter access during an incident and to prevent the shaft itself from becoming a smoke-distribution pathway to upper floors.

    Conclusion

    Smoke control engineering rarely gets the visibility that fire suppression systems do, but it is frequently the difference between a stairwell that remains usable throughout an evacuation and one that becomes impassable within minutes. Building code requirements for smoke control scale with building height and occupancy specifically because the failure mode — a filled, unusable egress route — is one of the most consequential outcomes a fire protection system is designed to prevent.

  • Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    For most secured spaces, the security question is simply who should be allowed in. For a narrower category of high-consequence areas — pharmaceutical controlled-substance vaults, cash-handling rooms, weapons storage, sensitive server rooms, certain industrial control rooms — the more important question is whether any single individual should ever be able to gain access alone at all. Two-person integrity (2PI) access control exists to enforce that no single person can act unilaterally in these spaces.

    The Core Principle

    Two-person integrity requires two separately authorized, distinct individuals to be simultaneously present to gain and maintain access to a controlled area, rather than one person’s credential being sufficient on its own. The underlying goal isn’t distrust of any specific individual; it’s structural risk reduction — removing the possibility that a single compromised credential, a single coerced employee, or a single person acting alone can result in unauthorized access to the most consequence-sensitive spaces in a facility.

    How It’s Implemented

    The most common implementation requires two independent, valid credential presentations within a defined time window before an access control system will unlock a controlled door, with the system explicitly rejecting a second scan from the same credential to prevent a single person defeating the control by badging twice. More rigorous implementations pair this with biometric verification for each individual, video confirmation that two distinct people are actually present, and logging that records both individuals’ identities against the access event, not just the fact that “two-person” access occurred.

    Handling the Exit Side

    Two-person integrity is often designed asymmetrically: exit typically doesn’t require the same dual authorization as entry, both because life-safety egress requirements generally take precedence and because the security concern is usually about who can initiate access to the controlled area, not who can leave it. Facilities implementing 2PI need to explicitly define this asymmetry rather than assuming it, since an overly rigid two-person requirement on egress can itself become a life-safety problem during an emergency.

    Where It Breaks Down in Practice

    The most common practical failure of two-person integrity isn’t a technology gap but a workflow one: when staffing is tight, employees under pressure to get a task done sometimes badge a colleague in and then leave, defeating the “simultaneous presence” requirement the control depends on. Facilities that rely on 2PI for genuinely high-consequence areas need staffing models and monitoring that make the control practically sustainable, not just technically correct on paper.

    Conclusion

    Two-person integrity is one of the more demanding access control patterns to implement well, because it depends as much on staffing discipline and monitoring as on the underlying credential technology. For the narrow set of areas where the consequence of a single unauthorized entry is severe enough to justify the operational overhead, it remains one of the more effective structural controls available — but only when the workflow around it is designed as carefully as the access control logic itself.

  • Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic’s newest threat-intelligence report, covered by the Associated Press and SecurityWeek, says accounts operating from Houthi-controlled northern Yemen used its Claude Code tool to pursue three separate weapons-development programs, including work toward a hypersonic-glide multi-variant missile design. A field test of a guided rocket associated with the effort reportedly failed.

    Anthropic said the accounts involved have been banned and that, per its assessment, no operational weapon was fielded as a result of this activity.

    Why it matters: The disclosure is one of the more concrete public examples yet of state or non-state actors attempting to use general-purpose AI coding tools to accelerate weapons development, and underscores why AI providers’ own threat-intelligence and account-enforcement programs are increasingly functioning as a frontline layer of defense-relevant security — alongside, not instead of, traditional export-control and nonproliferation controls.

    Source: Associated Press via SecurityWeek, September 11, 2026.

  • AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    SpyCloud’s 2026 Identity Threat Report, based on a survey of 750 organizations and covered by SecurityInfoWatch, found that non-human identities — AI agents, service accounts, and API keys — were the leading initial-access vector in 31% of identity-related security incidents.

    The report found a significant confidence gap: 95% of surveyed organizations believe they have adequate visibility into their AI agents and non-human identities, but only 36% actually monitor those identities in practice.

    Why it matters: As enterprises deploy AI agents with their own credentials and permissions across more systems, the attack surface represented by non-human identities is growing faster than most organizations’ identity-governance programs, creating a widening gap between perceived and actual security posture — a pattern directly relevant to any critical-infrastructure operator now integrating AI agents into operational workflows.

    Source: SecurityInfoWatch.com, September 11, 2026, citing SpyCloud’s 2026 Identity Threat Report.

  • Defense Manufacturer Mach Industries Raises $600 Million Series C

    Defense Manufacturer Mach Industries Raises $600 Million Series C

    Huntington Beach, California-based defense manufacturer Mach Industries raised a $600 million Series C funding round led by Ribbit Capital and Sequoia, valuing the company at $3.7 billion, Crunchbase News reported. Mach develops unmanned aircraft, long-range weapons systems and propulsion technology.

    The company said the funding will go toward building infrastructure to produce defense systems at scale, part of a broader wave of venture capital flowing into defense-technology manufacturing in 2026.

    Why it matters: The scale of the round — among the largest for a pure defense-hardware manufacturer this year — reflects a broader shift in venture investment toward physical defense manufacturing capacity rather than purely software-based defense-tech, a trend with downstream implications for the unmanned-systems and counter-UAS markets this publication tracks closely.

    Source: Crunchbase News, September 11, 2026.

  • GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    Security firm WatchTowr observed in-the-wild exploitation of CVE-2026-85706, a maximum-severity (CVSS 10) path-traversal vulnerability in GitLab Community and Enterprise Edition, just one day after GitLab released a patch, SecurityWeek reported. The flaw allows unauthenticated attackers to read arbitrary files from an affected server.

    The same GitLab release also patched a second critical vulnerability, CVE-2026-87719, an insecure-deserialization flaw in GitLab’s GraphQL implementation.

    Why it matters: A one-day gap between patch release and confirmed exploitation leaves almost no window for organizations to apply updates before attackers act, underscoring why source-code and DevOps infrastructure — not just perimeter network gear — needs to be included in any organization’s emergency-patching runbook.

    Source: SecurityWeek, September 11, 2026.

  • DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    The Department of Homeland Security has opened bidding on a five-year, $440.7 million multiple-award IDIQ contract (solicitation 70RDA126R00000001) to standardize procurement of biometric capture devices — fingerprint, facial, iris, palmprint and multimodal systems — across DHS components and other federal agencies including the Departments of State and Justice, Washington Technology reported.

    The contract vehicle is intended to replace fragmented, one-off purchasing historically used by DHS’s Office of Biometric Identity Management. Proposals are due September 18, 2026.

    Why it matters: A single large, standardized federal contract vehicle for biometric hardware procurement gives vendors a much larger and more predictable addressable market than the agency-by-agency purchasing it replaces, and is likely to influence which biometric hardware standards and interoperability requirements become de facto norms across other government biometric deployments.

    Source: Washington Technology, September 11, 2026, corroborated by FedScoop and ID Tech Wire.