Topic starter
22/07/2026 4:36 pm
TL;DR: Enterprises are increasingly treating physical access, badges, and facility rights as part of the same governance problem as applications and cloud roles, and the market opportunity tied to unified digital and physical identity control exceeds $25 billion worldwide, according to AlertEnterprise. The real shift is not a new control layer, but extending lifecycle, certification, and audit discipline to the identities people carry into buildings as well as systems.
Editorial analysis by NHI Mgmt Group, based on content published by AlertEnterprise: “The $25B Opportunity in Cyber Physical Security: Governing Digital and Physical Access Through One Identity”.
Key questions
Q: How should organisations govern physical access as part of IAM?
A: Organisations should treat badge and door access as governed identity data, not a separate facilities record.
Q: Why do separate IAM and badge systems create governance gaps?
A: Because the same person can be fully certified in one system and still retain active access in the other.
Q: What are the warning signs that physical access is outside IAM governance?
A: Common signs include badge renewals that follow a different cadence from access reviews, contractor exits that remove VPN rights but not facility entry, and audit requests that require separate evidence from security and facilities.
Practitioner guidance
- Define a converged identity record Create one authoritative identity profile that links application entitlements, privileged access, badges, mobile credentials, and restricted-area rights so lifecycle decisions are made once and applied across both domains.
- Extend access reviews to physical rights Add facility access, badge status, and site-specific entitlements to recurring certification cycles so reviewers see whether physical access still matches role, location, and employment status.
- Align offboarding across IAM and facilities Synchronise termination, contractor end dates, and mover events so physical credentials are revoked through the same workflow that removes digital access.
Bottom line: The article argues that identity governance remains incomplete when it covers digital access but not the physical access held by the same people.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:41 pm
Cyber physical identity governance is not a niche extension of IAM, it is the next logical boundary of identity control. The article shows that enterprises already govern digital entitlements with lifecycle, certification, and audit discipline, yet often leave physical access outside the same control plane. That creates two versions of the same identity, one visible to IAM and one visible to facilities. The practitioner conclusion is simple: if the identity is the control plane, the control plane must include the door.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when an employee's digital access is revoked but badge access remains active?
A: Treat it as a lifecycle failure, not a narrow facilities issue. The identity has not been fully offboarded until both digital and physical rights are removed, exceptions are documented, and the remaining access path is reviewed for whether it reflects a valid business need or a control breakdown.
👉 Read our full editorial: Cyber physical identity governance is the next IAM frontier