We’re Tracking the Future of Security

Category: Command & Control

VMS, PSIM and unified command-and-control platforms that bring multiple security systems into a single operational view.

  • Two-Way Radio and Communication Systems for Security Teams

    Two-Way Radio and Communication Systems for Security Teams

    When a security operations center needs to reach every guard on a property at once, or a guard needs to call for help without dialing a number and waiting for someone to answer, two-way radio still outperforms cellular communication — which is why it remains standard equipment for security teams even in facilities otherwise saturated with smartphones and networked devices. The technology has changed substantially from the analog handhelds of a generation ago, but the core advantage, instant one-to-many communication independent of a carrier network, has not.

    Analog vs. Digital Radio

    Analog radios remain in use for their simplicity and low cost, but digital radio systems, built on standards like P25 (common in North American public safety) or DMR (widely used commercially), offer clearer audio at the edge of range, encryption options, and the ability to carry data alongside voice, such as GPS location or status updates. Digital systems also support trunking, where a pool of radio channels is shared dynamically across many users and talkgroups rather than each group being locked to a single dedicated frequency.

    Talkgroups and Channel Discipline

    Larger security operations organize radio traffic into talkgroups, separate channels for different teams, shifts, or functions, such as patrol, dispatch, and emergency, so that routine chatter does not bury a genuine emergency call. Effective radio discipline (clear callsigns, brief transmissions, a defined process for emergency traffic to interrupt routine use) matters as much as the hardware, since a radio system is only as useful as the protocol governing how people use it under stress.

    Coverage: DAS and Repeaters

    Radio range is limited by building materials, terrain, and radio-frequency interference, which is why large or below-grade facilities often deploy a distributed antenna system (DAS) or repeaters to extend coverage into stairwells, parking structures, and basement levels where a direct radio signal would not reach. Many jurisdictions now require in-building radio coverage systems for first-responder communication as a life-safety code requirement, separate from and in addition to whatever radio system a security team uses day to day.

    Integration With Duress and Dispatch Systems

    Modern radio systems increasingly integrate with software dispatch platforms, letting a control room see which radio units are active, log call history automatically, and trigger a radio-based duress alert that surfaces on a dispatcher’s screen with the reporting unit’s identity and location rather than requiring a verbal report during an active incident. This integration turns the radio network from a simple voice channel into a data source that feeds incident logging and after-action review.

    Interoperability With Public Safety

    Facilities that regularly coordinate with police or fire, such as stadiums, hospitals, and large campuses, often need their radio systems to interoperate with public-safety agencies during a major incident, which typically means supporting shared frequencies, mutual-aid talkgroups, or gateway devices that bridge a private security radio system with a public-safety network without requiring every private-security radio to be reprogrammed on the spot.

    Reference sources

  • Axoflow Launches AxoDetect to Run Threat Detection Inside the Security Data Pipeline

    Axoflow Launches AxoDetect to Run Threat Detection Inside the Security Data Pipeline

    Axoflow has launched AxoDetect, a new capability that runs Sigma detection rules directly in its data pipeline rather than after logs land in a customer’s security information and event management (SIEM) platform. The feature, now in early access, sends triggered alerts on to the customer’s SIEM while routing full-fidelity logs to AxoLake, the company’s own storage layer, which Axoflow says lets organizations retain complete audit trails at lower cost than storing everything in a traditional SIEM.

    Axoflow, founded by Balazs Scheidler, creator of the open-source syslog-ng project, markets its platform as a security data layer that discovers, classifies, parses, normalizes and reduces security telemetry before it reaches downstream analytics tools. AxoDetect extends that existing pipeline to include in-stream detection logic ahead of the SIEM.

    The company is demonstrating AxoDetect this week at Splunk’s .conf26 conference in Denver, running September 14-17, at booth P1, and plans to show the capability again at the Gartner Security & Risk Management Summit in London later this month.

    Why it matters

    In-stream detection is a direct response to SIEM cost pressure: if triage logic can run before ingestion, organizations can route only actionable alerts to their most expensive analytics tier while still retaining full logs elsewhere for investigation.

    Sources

  • Dataminr Launches Agentic AI Tools for Corporate Security Threat Assessment

    Dataminr Launches Agentic AI Tools for Corporate Security Threat Assessment

    Dataminr launched Dataminr Advanced for Corporate Security at GSX 2026 in Atlanta, adding three artificial intelligence capabilities intended to help security teams assess threats to personnel, facilities and operations, according to Security Today. The company is demonstrating the platform at booth 1560 during the September 14-16 event at the Georgia World Congress Center.

    The release includes Agentic Corroboration, which gathers information to help verify developing events, and Agentic Context, which searches publicly available information and Dataminr’s event archive for material related to an incident. A third capability, Near-Term Predictive Intelligence, analyzes the company’s historical event archive to forecast how an emerging threat could develop.

    Dataminr said all three capabilities are now generally available and integrate with its existing real-time alerting system and ReGenAI Live Briefs feature. The company said the system draws on more than 60 task-specific large language models trained on an event archive spanning more than a decade, with multimodal technology capable of processing text, images, video and audio.

    Why it matters

    Corporate security operations centers are increasingly judged on how fast they can verify a developing event, not just detect it; agentic corroboration tools aim at that verification bottleneck specifically, though outcomes will depend on false-positive rates in real deployments.

    Sources

  • Network Redundancy for IP Security Systems: Failover Without Blind Spots

    Network Redundancy for IP Security Systems: Failover Without Blind Spots

    IP cameras, access controllers, intercoms and analytics depend on the network as a shared transport layer. Redundancy can reduce a single point of failure, but duplicated hardware alone does not guarantee continuity. The design must define what service survives, how quickly it returns and what evidence exists after the switchover.

    Define the Required Service

    A camera may continue recording to local storage while live viewing is unavailable. A door controller may enforce cached permissions even when the central server is offline. Write resilience requirements in operational terms: recording continuity, alarm delivery, credential decisions, voice communication and investigation access.

    Map Failure Domains

    Two links routed through the same conduit are vulnerable to one cable cut. Two switches powered by the same unprotected circuit share an electrical failure. Trace power, fiber, copper, wireless backhaul, server, storage, DNS and identity dependencies to find common points that a simple network diagram may hide.

    Path and Device Redundancy

    Critical aggregation points may use diverse paths, resilient switching and redundant power. Servers and storage can use clustering or replicated services, but compatibility with the VMS or access-control platform must be tested. Avoid assuming that generic network failover automatically preserves application sessions or video streams.

    Edge Continuity

    Local camera recording and controller decision caches can bridge a central outage. Recovery behavior matters: the system should reconcile events and recordings without overwriting evidence or creating duplicate alarms. Monitor synchronization queues and storage capacity before an outage occurs.

    Test Degraded Modes

    Commissioning should disconnect links, stop services and remove power in controlled scenarios. Confirm what operators see, which alarms arrive and how recovery is logged. Planned tests often reveal slow routing convergence, missing licenses, certificate dependencies or manual steps that were absent from design documents.

    Practical Checklist

    • State which security functions must survive each failure.
    • Separate physical routes and power sources where required.
    • Verify edge recording and cached access decisions.
    • Monitor failover state and reconciliation queues.
    • Repeat tests after firmware, topology or platform changes.

    Conclusion

    Useful redundancy is measured by preserved security outcomes, not duplicated boxes. Mapping shared dependencies and testing real failure modes produces a system that degrades predictably instead of creating silent blind spots.

    Reference sources

  • Security Control Room Ergonomics: Designing for Operator Attention

    Security Control Room Ergonomics: Designing for Operator Attention

    A security control room can contain excellent cameras and analytics yet still perform poorly if operators cannot interpret alarms, reach controls or maintain attention across a shift. Ergonomics connects technology, workplace design and operating procedure so that information arrives in a form people can act on.

    Design Around Tasks, Not Displays

    Begin with the decisions operators make: verifying an alarm, dispatching a response, controlling a door or preserving evidence. Place frequently used information and controls within comfortable sight and reach. A large video wall can support shared awareness, but it should not become a decorative surface filled with feeds no one can meaningfully monitor.

    Alarm Presentation and Workload

    Prioritize alarms by consequence and required response. Repeated nuisance alerts create habituation, while too many simultaneous sounds and pop-ups compete for attention. Alarm rationalization should remove duplicates, define ownership and give the operator enough context to choose the next action.

    Lighting and Acoustics

    Control reflections on screens and avoid extreme contrast between displays and the room. Provide adjustable task lighting for written work. Acoustic design should keep radio, telephone and alarm audio intelligible without making the space continuously noisy.

    Workstation Layout

    Adjustable seating, monitor height and input-device placement reduce fatigue and allow different operators to use the same position. Critical controls should be identifiable and protected against accidental activation. Shared work should have clear handover points and unobstructed communication between roles.

    Resilience and Emergency Use

    The UK Health and Safety Executive notes that control-room design should address both ergonomic operation and the room’s ability to support control during foreseeable hazardous events. Security facilities likewise need backup power, communications, evacuation arrangements and an alternate operating position where risk requires one.

    Commissioning With People

    • Run realistic alarm scenarios with actual operators.
    • Measure acknowledgement and decision time, not only system response.
    • Review nuisance alarms and workload by shift.
    • Test handovers, escalation and degraded-mode procedures.
    • Reassess layout when systems or responsibilities change.

    Conclusion

    Control-room ergonomics is operational engineering. A task-led layout, disciplined alarm strategy and realistic human testing help operators notice the right event, understand it and act before technology-generated information becomes noise.

    Reference sources

  • Time Synchronization in Physical Security Systems: Why NTP Matters

    Time Synchronization in Physical Security Systems: Why NTP Matters

    A camera records motion at 14:03, an access-control panel logs a door opening at 14:01, and an intrusion sensor reports an alarm at 14:05. If those clocks are drifting, investigators cannot reliably determine whether the events belong to one incident. Time synchronization is therefore a security control, not a cosmetic system setting.

    Why a Common Clock Matters

    Video, access, intrusion, intercom and building systems create separate event streams. A common time source allows a management platform to reconstruct sequence, correlate alarms and support an audit trail. NIST guidance on log management treats consistent timestamps as part of useful event records, while NTP is the widely deployed protocol for synchronizing networked clocks.

    Designing the Time Architecture

    Define approved time sources, then make intermediate servers or controllers distribute time to field devices. Avoid letting every camera or panel reach arbitrary internet servers. Critical sites may use redundant internal sources backed by a trusted external reference. Network rules should allow only the required protocol paths.

    Time Zones and Daylight Saving

    Store or correlate events in a stable reference such as UTC, while displaying local time to operators. Document how daylight-saving changes are handled. Otherwise, repeated or skipped local times can make exported evidence ambiguous.

    Drift and Failure Monitoring

    Synchronization can fail silently because of blocked traffic, configuration errors, expired credentials or a device reset. Monitor offset, source reachability and last successful synchronization. An alarm threshold should reflect the investigative needs of the site rather than an arbitrary universal value.

    Security Considerations

    A false time source can disrupt logs and certificate checks. Use authenticated mechanisms where supported, restrict management access and protect the authoritative servers. Record configuration changes so an investigator can establish whether a clock was trustworthy during an incident.

    Operational Checklist

    • Maintain an inventory of devices and their configured source.
    • Use redundant, monitored time servers for critical systems.
    • Test exported video and access reports for consistent timestamps.
    • Document UTC, local-time and daylight-saving behavior.
    • Include clock health in commissioning and maintenance.

    Conclusion

    Time synchronization turns isolated records into a defensible event sequence. Treating NTP architecture, clock monitoring and timezone handling as part of commissioning prevents avoidable uncertainty when operators and investigators need the record most.

    Reference sources

  • HiveWatch Adds Dinesh Coca as GM and SVP of Product as Company Unveils New Capabilities at GSX 2026

    HiveWatch Adds Dinesh Coca as GM and SVP of Product as Company Unveils New Capabilities at GSX 2026

    HiveWatch, a physical security software company focused on unifying security operations, announced that Dinesh Coca has joined the company as General Manager and Senior Vice President of Product and Engineering, alongside a set of new platform capabilities the company will showcase at Global Security Exchange (GSX) 2026 in Atlanta, running September 14–16 at booth #4459.

    Coca brings more than two decades of technology product development and scaling experience to the role, having started as a software engineer before moving into product and engineering leadership. “HiveWatch stood out because the problem is so clear,” Coca said. “Security teams already feel the pain of working across a dozen systems just to understand and respond to one incident. There’s a huge opportunity to make that experience dramatically simpler.”

    The leadership addition accompanies a wave of new integrations and capabilities aimed at reducing the number of disparate systems operators must check during an incident response, part of a broader push by physical security software vendors to consolidate alarm, video, and access control data into a single operating picture for security operations centers.

    HiveWatch’s GSX 2026 presence comes as the show, powered by ASIS International, opens its exhibit hall to more than 500 exhibitors and an expected 14,000-plus security professionals at the Georgia World Congress Center.

    Sources: SecurityInformed.com, SDM Magazine, HiveWatch.

  • Lockheed Martin Demonstrates AI-Driven Battle Management Prototype for Guam Missile Defense

    Lockheed Martin Demonstrates AI-Driven Battle Management Prototype for Guam Missile Defense

    Lockheed Martin demonstrated a prototype AI-driven battle management system for the Guam Defense System (GDS) on August 26, 2026, showing how artificial intelligence analytics can compress the time it takes to detect, evaluate, and respond to air and missile threats in a simulated Guam operational environment.

    The prototype, called the GDS Battle Manager Suite, networks data from multiple Integrated Air and Missile Defense (IAMD) systems slated for deployment to Guam, including Aegis Guam and the Integrated Battle Command System (IBCS), into a single tactical picture. Powered by Lockheed Martin’s CommandIQ software, the system applies AI analytics to assess incoming tracks and generate fire-direction recommendations for human operators.

    From Request to Demonstration in Under Two Months

    The U.S. Army issued a call for a GDS Battle Manager Suite solution in June 2026. Lockheed Martin was invited to a Phase 2 evaluation at the Army Tactical Systems Integration Laboratory at Fort Bliss, Texas, where the company said its prototype was integrated and met demonstration requirements within 24 hours of arrival on site.

    Traditional IAMD battle management has relied on operators manually correlating information across documents, voice channels, and text messages — a process that is time-consuming and prone to error under the compressed timelines of a missile engagement. By automating that correlation and applying algorithmic shot selection informed by extensive simulation data, Lockheed Martin says the system is designed to give operators machine-speed decision support while helping preserve high-cost interceptor inventories.

    Part of a Broader Command-and-Control Push

    The Guam prototype follows related software-based command-and-control integration work Lockheed Martin performed during the Valiant Shield 2026 exercise, which the company has cited as evidence that capabilities developed across different programs and vendors can be connected rapidly to meet emerging operational requirements — a recurring theme as the Pentagon pushes for faster, more interoperable air and missile defense architectures across the Indo-Pacific.

    Guam’s defense architecture has been a focus of U.S. missile defense investment for several years given the island’s strategic role as a forward operating location. Layering AI-assisted battle management on top of existing sensor and interceptor networks is intended to help defenders manage a more complex and saturated threat picture without proportionally increasing the number of personnel required to operate it.

  • Global Security Operations Center (GSOC) Design: People, Process and Technology

    Global Security Operations Center (GSOC) Design: People, Process and Technology

    A Global Security Operations Center, or GSOC, centralizes monitoring and incident response for organizations with security operations spread across multiple facilities, regions or time zones. Unlike a single-site guard station monitoring local cameras and alarms, a GSOC is built to aggregate video, access control, intrusion detection, travel risk intelligence and often cybersecurity alerting from dozens or hundreds of locations into a unified operating picture, with staff trained to triage and coordinate response regardless of where an incident originates.

    The technology layer that makes this possible is a physical security information management (PSIM) platform, or increasingly a unified security platform that combines video management, access control and analytics natively rather than through a separate integration layer. The core function of this software is normalization: translating alerts and video feeds from potentially dozens of different camera manufacturers, access control panels and alarm systems, often installed at different times by different integrators, into a consistent interface that a GSOC operator can act on without needing to learn each underlying vendor system individually.

    Staffing model and shift structure are as important to GSOC effectiveness as the underlying software. A GSOC covering global operations typically requires 24/7 staffing organized around a “follow the sun” model, with regional teams handing off situational awareness at shift boundaries, or a single centralized team working rotating shifts. The choice affects language coverage, familiarity with regional regulatory and cultural context, and response time to incidents occurring outside a centralized team’s typical working hours; organizations with major operations concentrated in a small number of regions often favor a hybrid model with a smaller follow-the-sun core team supplemented by on-call regional specialists.

    Alert prioritization and workflow design determine whether a GSOC scales effectively as the number of monitored sites grows. Without a structured triage process, a GSOC ingesting alerts from hundreds of facilities can quickly become overwhelmed by nuisance alarms, such as motion-triggered alerts from wildlife or weather rather than genuine intrusions. Mature GSOCs implement tiered alert classification, often informed by analytics that pre-filter video-based alerts before they reach a human operator, and maintain documented standard operating procedures that specify escalation paths, notification requirements and decision authority for different incident categories, from a minor access control malfunction to an active threat requiring law enforcement coordination.

    Integration with business continuity and crisis management functions is increasingly a defining feature of higher-maturity GSOCs. Rather than operating purely as a security monitoring function, many organizations now position their GSOC as the initial point of situational awareness for a broader range of business-impacting events, including severe weather affecting a facility, civil unrest near a location with traveling employees, or a supply chain disruption at a manufacturing site, feeding that awareness into the organization’s broader crisis management and business continuity processes rather than treating physical security monitoring as an isolated function.

    Facility design for a physical GSOC space itself follows established principles: redundant power and network connectivity, video walls sized and positioned for extended-shift ergonomics, and physical security controls for the GSOC space that reflect its role as a high-value target in its own right, since an incident that disables or compromises the GSOC’s own operations removes situational awareness across the entire organization at the moment it may be needed most. Organizations building or upgrading a GSOC increasingly plan for a geographically redundant backup facility or cloud-hosted failover capability, so that a single site outage, whether from a power failure, natural disaster or targeted attack, does not eliminate centralized monitoring capability entirely.

  • Johnson Controls Metasys Building Automation Platform Patches Persistent XSS Vulnerability

    Johnson Controls Metasys Building Automation Platform Patches Persistent XSS Vulnerability

    Crafted URL Can Hijack Administrator Sessions

    CISA published ICS advisory ICSA-26-225-14 on August 13, 2026, disclosing a cross-site scripting vulnerability in Johnson Controls Metasys, a building automation and management platform used across critical manufacturing, commercial facilities, government facilities, transportation systems and energy sites worldwide. Tracked as CVE-2026-34491 and rated CWE-79, the flaw carries a CVSS v3 base score of 8.0.

    According to CISA, a low-privilege user can inject a malicious payload into the Metasys web interface through a crafted URL. The payload persists across logins and executes in the browser context of other users who view the affected page, including administrators, which could lead to session hijacking and unauthorized access to building systems. The advisory lists Metasys 12 and 13 as affected in all versions, and Metasys 14 before v14.1.5 and Metasys 15 before v15.0.1.

    Mitigation

    Johnson Controls has released patched versions for the affected Metasys 14 and 15 branches and published mitigation guidance for the platform. CISA recommends operators apply the available updates, restrict Metasys web interface access to trusted networks, and follow standard input-validation and session-management hardening for building management system deployments.

    Sources