We’re Tracking the Future of Security

Tag: Access Control

  • Gallagher Security and ASSA ABLOY Integrate IP Locks With Command Centre

    Gallagher Security and ASSA ABLOY Integrate IP Locks With Command Centre

    Gallagher Security has launched an integration with ASSA ABLOY’s IP-connected locks, allowing the devices to be managed directly within Gallagher’s Command Centre access control platform, according to an announcement from the companies reported by Security Systems News and SecurityInfoWatch.

    How the Integration Works

    The integration connects ASSA ABLOY’s IN120 battery-powered Wi-Fi locks and IN220 Power over Ethernet (PoE) IP locks to Command Centre, letting operators centrally manage access permissions, credentials, schedules and overrides without running the extensive cabling or installing the door controllers that traditional wired systems require. Each lock retains local intelligence, allowing it to make access decisions independently if network connectivity is lost, while Command Centre still surfaces events, alarms, battery status, audit records and device health for connected doors.

    Target Applications

    Gallagher and ASSA ABLOY positioned the integration for environments where retrofitting wired hardware is costly or disruptive, including higher-education residence halls, classrooms and research spaces, as well as government facilities, enterprise campuses and healthcare sites with distributed buildings. Matt Butts, Gallagher Security’s EVP for the Americas, and Angelo Faenza, ASSA ABLOY’s head of digital access solutions, both described the integration as combining the two companies’ access control and door hardware expertise to simplify deployment. The companies said the integration is available now in the United States.

    Pricing details and a broader international rollout timeline were not disclosed in the companies’ announcements. More access control developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Access Control Lock Power: Voltage Drop, Inrush Current and Backup Design

    Access Control Lock Power: Voltage Drop, Inrush Current and Backup Design

    Access-control failures are often blamed on software, credentials or readers when the underlying problem is electrical. A lock that receives adequate voltage at the power supply can still behave unpredictably at the door because cable resistance, startup current and shared loads reduce the voltage available under real operating conditions.

    Reliable design begins with the lock manufacturer’s requirements, not a generic current allowance. The calculation must account for continuous load, momentary inrush, cable length, conductor size, relay and connector losses, ambient conditions and the behavior expected during a mains-power failure.

    Start with the Complete Door Load

    List every powered device on each circuit: magnetic locks, electric strikes, electrified panic hardware, request-to-exit devices, readers, sounders, door controllers and auxiliary relays. Record both nominal and peak current where the manufacturer provides them. Some locking devices draw a substantially higher current while moving or energizing than they require once settled.

    A supply selected only from steady-state totals may reset, current-limit or produce an incomplete unlock during simultaneous demand. Designers should apply the manufacturer’s sizing method and retain reasonable engineering margin rather than treating the nameplate capacity as continuously available under every condition.

    Voltage Drop Is a Circuit Calculation

    The relevant distance is the complete current path, including the outbound and return conductors. Longer runs, smaller conductors and higher current increase voltage drop. The correct test point is therefore the device terminals while the lock is operating, not the unloaded supply output.

    Moving from 12 VDC to 24 VDC can reduce current for an equivalent power requirement and make long runs easier to manage, but only when every connected device is approved for that voltage. Mixed-voltage peripherals require deliberate separation or regulated conversion; improvised sharing creates difficult faults and may invalidate a listing.

    Design for Inrush and Simultaneous Events

    Emergency release, scheduled unlocking and a fire-alarm interface can command many doors at once. The worst case is not necessarily one door opening during normal use. Commissioning should test the largest credible simultaneous event while monitoring supply voltage and fault outputs.

    Distributed power can reduce long cable runs and localize faults, but it adds batteries, enclosures and inspection points. Centralized power simplifies maintenance oversight but may require larger conductors and careful circuit segregation. The right architecture depends on building size, survivability goals and maintenance capability.

    Fail-Safe and Fail-Secure Are Operational Choices

    Power loss behavior must follow the approved life-safety and security design. Fail-safe hardware unlocks when power is removed; fail-secure hardware remains mechanically secure while normally allowing free egress from the protected side. The correct choice is governed by door function, code requirements, fire strategy and the authority having jurisdiction.

    A fire-alarm release circuit should be documented, supervised where required and tested end to end. It is not enough to confirm that an input changes state at the access controller; the test must verify the intended mechanical result at every affected opening.

    Battery Backup Needs a Defined Mission

    Backup duration should come from a stated operating objective: maintain normal access, keep selected secure doors powered, preserve controller communications, or support an orderly transition. Calculate battery capacity from the actual standby and alarm loads, then account for aging, temperature and allowable discharge according to the approved equipment instructions.

    Battery supervision and periodic load testing are as important as initial capacity. A system can report healthy mains power for years while degraded batteries remain invisible until an outage. Maintenance records should identify replacement dates and measured performance rather than relying solely on visual inspection.

    Commissioning Checklist

    • Measure voltage at each lock during its highest-current operating state.
    • Test simultaneous unlock and emergency-release scenarios.
    • Verify circuit protection, fault reporting and battery supervision.
    • Confirm fire-alarm interfaces and egress behavior with the approved sequence.
    • Record conductor sizes, distances, loads and supply settings in as-built documents.
    • Repeat critical tests after battery replacement or hardware changes.

    Power design is one layer of a complete access system. For the broader architecture, see SectechMedia’s access control and identity technologies guide.

    References

  • Genea Launches MCP Server to Connect AI Assistants with Cloud Access Control

    Genea Launches MCP Server to Connect AI Assistants with Cloud Access Control

    Genea has launched a Model Context Protocol server for its cloud-native access-control platform, giving approved artificial intelligence assistants a structured way to interact with building-security workflows. The company announced the release on September 29, describing it as an optional integration layer rather than an autonomous replacement for security operators.

    The server is designed to let administrators use natural-language requests for routine tasks such as reviewing access activity, checking configuration data or preparing changes. Genea says the service is disabled by default and must be activated by an authorized administrator.

    Permission Boundaries Remain Central

    The implementation inherits the permissions of the authenticated Genea user. That means an assistant should not receive broader access simply because it communicates through MCP. High-impact actions require confirmation, according to the product announcement, while organizations retain control over which roles can activate and use the integration.

    Those controls matter because physical-access systems contain sensitive identity, credential and door-event data. Connecting an AI assistant to that environment creates a new administrative interface, so deployment teams need to treat the assistant, its authentication path and its audit trail as part of the security boundary.

    What Security Teams Should Validate

    Before enabling an AI integration, operators should confirm least-privilege role assignments, approval requirements for changes, log retention, account revocation and incident-response procedures. They should also test ambiguous prompts and failed actions to understand what the assistant records and how it communicates uncertainty.

    The launch reflects a broader movement toward machine-readable interfaces in security operations. MCP can make access-control data easier to query from approved tools, but it does not remove the need for established change control, human review or a documented rollback path. Organizations evaluating the feature should begin with read-only use cases and a limited user group before allowing operational changes.

    For a wider view of credentials, controllers and identity workflows, see SectechMedia’s access control and identity technologies guide.

    Sources

  • Pye-Barker Fire & Safety Acquires Union AlarmTronic, Expanding Security Alarm Footprint in New Jersey

    Pye-Barker Fire & Safety Acquires Union AlarmTronic, Expanding Security Alarm Footprint in New Jersey

    Pye-Barker Fire & Safety, which bills itself as the largest fully integrated fire protection, life safety and security services provider in the United States, announced on September 29, 2026, that it has acquired Union AlarmTronic, LLC, a security alarm company based in Springfield, New Jersey. The deal deepens Pye-Barker’s operational footprint in the state, adding local service capacity and technical expertise to its existing Northeast operations.

    According to the company’s press release, Union AlarmTronic was founded in 1989 and has completed more than 20,000 security installations across New Jersey, providing access control, video surveillance, intercom, integrated security and traditional alarm monitoring services. The company is led by owner Fred Rosenfeld, who entered the security business through his father Len Rosenfeld’s family operation.

    “We have proudly protected people and property and provided high-caliber service to customers in New Jersey for decades,” Rosenfeld said in the announcement. “With Pye-Barker, we will continue our commitment to install and maintain security systems that protect customers while being able to offer expanded full-service fire protection.”

    Pye-Barker Fire & Safety CEO Bart Proctor framed the deal as both a talent and capability acquisition. “When we met with team members at Union AlarmTronic, their passion for customers and their community stood out,” Proctor said. “Incorporating their expertise, service and team approach into the Pye-Barker family enables us to protect even more people in the state.”

    Per the release, Union AlarmTronic’s trained technicians will remain in place to continue serving existing New Jersey customers under the Pye-Barker umbrella, a common integration approach the company has used across its string of regional acquisitions. Nelson Mullins Riley & Scarborough, LLP represented Pye-Barker in the transaction, while Mesirow Investment Banking served as exclusive financial advisor to Union AlarmTronic. Financial terms were not disclosed.

    Part of a broader consolidation push

    The Union AlarmTronic deal is the latest in a long run of regional roll-ups for Pye-Barker, which has been aggressively acquiring independent fire-protection, suppression and security-alarm companies across the country throughout 2025 and 2026 — including recent deals for Suppression Systems, Inc. in the Pacific Northwest and FSD Protection in Texas. The strategy mirrors a wider wave of consolidation across the physical security and fire-safety services sector, where private-equity-backed platforms and large integrated providers are absorbing independent regional operators to broaden geographic coverage and cross-sell fire, life-safety and security-alarm services to the same commercial customer base.

    For end users in New Jersey, the acquisition means Union AlarmTronic’s existing access control, video surveillance and alarm monitoring customers gain access to Pye-Barker’s broader fire-protection and life-safety service lines, while the local technician base and customer relationships are expected to remain intact through the transition.

    Source: Pye-Barker Fire & Safety press release, PR Newswire, September 29, 2026. Confidence rating: DIRECT (primary company press release with named executive quotes).

    Sources and Further Reading

  • Securitas Technology Acquires Sonitrol of El Paso, Expanding Texas Footprint

    Securitas Technology Acquires Sonitrol of El Paso, Expanding Texas Footprint

    Securitas Technology has acquired Sonitrol of El Paso, Texas, adding the integrator’s local expertise and cloud-based security offering to the global electronic security provider’s portfolio. The deal, announced October 1, expands Securitas Technology’s service coverage across Texas and the broader Southwest.

    A regional deal with a familiar brand

    Sonitrol has built its reputation over more than six decades around audio-based intrusion verification technology designed to reduce false alarms and speed confirmed-response times, a capability Securitas Technology says will strengthen its combined offering for clients in the region. “This acquisition aligns with our focus and commitment to deliver best-in-class security solutions while further strengthening our role as a trusted advisor to our clients,” said Tony Byerly, global president and CEO of Securitas Technology.

    Part of a broader consolidation pattern

    The El Paso deal is the latest in a series of Sonitrol-franchise acquisitions by Securitas Technology over the past year, reflecting continued consolidation among regional alarm-monitoring and security integrators as larger providers look to pair local market knowledge with centralized cloud and AI monitoring capabilities. Terms of the transaction were not disclosed.

    Sources and further reading

  • Germany’s BSI Opens Call for Background-Removal Technology in New Biometric Benchmark

    Germany’s BSI Opens Call for Background-Removal Technology in New Biometric Benchmark

    Germany’s Federal Office for Information Security (BSI) is calling on developers to submit background-removal software and device-based solutions for a new benchmark focused on facial images. The BGR-PROJECT, short for Background Removal Benchmark, aims to assemble what BSI calls a “representative and technically sound selection” of current background-removal algorithms for standardized evaluation, with submissions open until November 27, 2026.

    Why background removal matters for passport photos

    Background removal separates a person from their surroundings in a photograph so the subject can be recomposited onto a plain, uniform background, as required by identity-document standards including ISO/IEC 39794-5 and ICAO Doc 9303 for machine-readable travel documents. Those specifications are designed to prevent distracting shadows, patterns or objects behind a subject’s head from degrading image quality used for biometric identity verification. BSI notes that the task sounds simple but is technically difficult: isolating exactly where a person ends and the background begins without introducing artifacts that reduce facial image quality.

    What the benchmark will measure

    Once BSI collects submissions, the agency plans to use them to build a benchmark that scores background-removal tools on accuracy and consistency, giving passport and ID-document issuers and biometric vendors a standardized way to compare implementations rather than relying on vendor claims alone.

    Sources and further reading

  • DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD disclosed on September 30 that two Zammad zero-days were used in a September 21 breach. Its investigation remains ongoing, so the account should be treated as preliminary. DIVD said an AI agent chained the flaws within seconds, while network segmentation limited further movement inside the affected environment.

    Two vulnerabilities with different roles

    CVE-2026-102489 can allow session hijacking followed by remote code execution as the zammad service user. It affects versions 6.3.0 through 6.5.4. The issue is also present in 7.0.0 through 7.1.3, but the supplied record says it is not exploitable there under the stated environmental conditions. Its reported CVSS score is 9.4.

    CVE-2026-102490 can allow a local zammad user to escalate privileges to root. It affects releases from 1.5.0 to before 7.1.0-alpha, and reporting described all released versions at disclosure as affected. Its reported CVSS score is also 9.4. Together, the issues illustrate why application-layer weaknesses can matter to the wider cyber-physical security landscape.

    Response while guidance develops

    Operators should follow current Zammad and DIVD guidance and apply a fixed release when one becomes available. While the investigation and remediation advice continue to evolve, isolating vulnerable systems can reduce exposure. The reported use of an AI agent is based on DIVD’s preliminary incident account; it should not be generalized into a broader claim about attacker capability or automation. Defenders should focus on the verified vulnerability boundaries, access paths, segmentation, and observable evidence in their own environments.

    Sources and further reading

  • Researchers Find 543,699 Live Credentials in Public GitHub Data

    Researchers Find 543,699 Live Credentials in Public GitHub Data

    Truffle Security reports that 543,699 credentials discovered in public GitHub data still authenticated when tested. The finding comes from the company’s analysis of The Stack v3, a dataset containing 224.6 million public repositories and 58.47 billion files, and points to a long-lived operational problem rather than only recent accidental disclosure.

    Scale and age of the exposure

    The researchers identified 1,103,438 exposed credential candidates and tested them on July 27 and 28, 2026. They said 543,699 remained live. The median exposure age was 784 days, while the oldest valid credential dated to 2009. These figures are research findings reported by Truffle Security and should be understood within the methodology described in its primary report.

    The study also found 199,843 live credentials exposed after GitHub enabled default push protection in February 2024. According to the report, 51.8 percent of live credentials used formats that default push protection did not block. For teams managing broader cyber-physical security risks, the result illustrates how software supply-chain weaknesses can create access paths into operational environments.

    Control implications for security teams

    The research indicates that preventive scanning alone does not close the exposure window. Organizations need detection across repositories and development workflows, but they also need a reliable process to revoke and replace discovered secrets. Historical repositories and older commits deserve attention because a credential’s age does not establish that it has expired. Asset owners should treat a confirmed live credential as an incident requiring containment, scope assessment, rotation, and a review of associated access rather than merely removing the visible string from a repository.

    Sources and further reading

  • CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA has added CVE-2026-104286, a critical FortiMail vulnerability, to its Known Exploited Vulnerabilities catalog. The October 1 action gives covered organizations an October 4 due date and calls for forensic triage alongside mitigation, reflecting confirmed exploitation rather than a theoretical risk.

    Affected FortiMail releases and exposure

    Fortinet assigns the flaw a CVSS score of 9.8 and describes it as an unauthenticated path-traversal and null-byte handling issue. According to its advisory, an attacker can use HTTP or HTTPS to write arbitrary files. The affected ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

    Fixed builds were listed as upcoming when the advisory was issued. This creates an immediate operational decision for teams responsible for internet-facing mail infrastructure and the wider cyber-physical security environment: reduce reachable attack surface while also checking systems for evidence of compromise.

    Immediate defensive priorities

    Fortinet’s stated workaround is to disable IBE or restrict management access to a trusted private network. Administrators should follow the vendor’s current guidance, preserve relevant evidence from mail and management interfaces before making changes, and conduct the forensic triage requested by CISA. Because fixed builds had not yet been listed in the supplied advisory facts, teams should verify the latest vendor notice before making assumptions about patch availability. The watchTowr analysis offers additional technical context, but remediation decisions should remain anchored to current Fortinet and CISA instructions.

    Sources and further reading

  • CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    The US Cybersecurity and Infrastructure Security Agency has published an advisory covering several vulnerabilities in Armatura One, a platform used to administer physical access-control systems. CISA says successful exploitation could expose database information, enable code execution or allow an attacker to take control of access-control functions.

    Affected versions and security impact

    The advisory covers Armatura One versions earlier than 4.7.2 and the US edition earlier than 4.6.1. The reported issues include embedded ActiveMQ vulnerability CVE-2023-46604 as well as four newly assigned CVEs affecting the platform. CISA lists a maximum CVSS v3 base score of 9.8.

    The agency notes that CVE-2023-46604 appears in its Known Exploited Vulnerabilities catalog because it has been used against other products. CISA says it is not aware of public exploitation specifically targeting Armatura One. That distinction matters: operators should treat the exposure seriously without assuming that every installation has already been compromised.

    What access-control operators should do

    Armatura recommends upgrading to version 4.7.2, or 4.6.1_USA for the US edition. Owners should first inventory management servers, restrict administrative interfaces to trusted networks and preserve configuration backups before changing production systems.

    Because the platform can influence doors and credentials, remediation should be coordinated with physical-security teams, not handled as an isolated IT patch. Administrators should also review service accounts, database access and logs for unexpected changes. SectechMedia’s access-control and identity coverage provides additional context for securing controller and credential-management environments.

    Sources