The Cybersecurity Time Bomb

If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk.

The security industry, manufacturers, integrators and end customers have a massive problem treating security technology like static infrastructure. Unlike a door or a fence, security devices today are essentially networked computers and leaving them untouched for years is no different than running an old Windows XP box on the open internet, a hacker’s dream.

The "Install It and Forget It" Mentality
Most security deployments follow a familiar cycle:

Step 1. The sale is made. The customer chooses a security system based on features, cost, and brand reputation. Cybersecurity isn’t usually a significant factor in the buying decision.

Step 2. The system is installed. Integrators deploy cameras, access control, and other devices, get them up and running, and hand everything over to the end user.

Step 3. Nothing happens. No one thinks about firmware updates. No one checks for vulnerabilities. The system runs for years.

And then, one day, something happens. Maybe an attacker exploits an old vulnerability. Ransomware may lock down the entire network. Maybe an IP camera gets hijacked and used in a botnet attack. And suddenly, everyone is asking: “Why wasn’t this system secured?” The answer? Because no one took ownership of keeping it secure.

We Should Have Learned by Now
A perfect example of this problem is Mirai, the botnet that weaponized thousands of unpatched IoT devices to launch history's most significant DDoS attacks. When Mirai hit the news in 2016, it wasn’t exploiting some sophisticated zero-day (a software flaw that is unknown to the vendor or developers, meaning there is no patch or fix available).

The vulnerability had been patched years earlier. The problem was that most devices had never been updated.

Fast forward to today, and the same issue persists. Thousands of security cameras, NVRs, and access control systems are still unpatched on networks because no one prioritized updates. If Mirai wasn’t enough of a wake-up call, what would be?

A Three-way Blame Game
The problem is not just on one side. It is a perfect storm of bad habits from manufacturers, integrators, and end customers.

For their part, some manufacturers still design products with a ship-it-and-forget-it mentality. They build hardware, ship it and move on to the next model. Many devices still ship with default admin passwords that never get changed. Firmware updates are often buried on a website somewhere with no automated update process.

Worse, some manufacturers treat their products as obsolete within a few years, even if customers still use them. This leaves integrators and customers on their own to secure products never built with cybersecurity in mind.

Integrators are stuck in the middle, expected to be cybersecurity experts whether they want to be or not. If a vulnerability is discovered after deployment, customers often turn to the integrator first, even if the manufacturer has not provided an update or the system is beyond its supported lifecycle.

However, integrators are running a business, and patching is not a revenue-generating activity. Customers are reluctant to pay for ongoing cybersecurity maintenance, and many integrators do not have a built-in service model for regular updates. Making matters worse, many security devices do not have easy remote update mechanisms. If firmware updates require on-site visits or manual downloads, they often do not happen.

End customers, meanwhile, often do not think about cybersecurity until something goes wrong. IT and security teams do not always communicate, leading to security devices connected to the main corporate network without proper segmentation, running on outdated firmware, and still using default passwords years after installation. Many customers assume their security devices are secure out of the box, but that is rarely true.

Breaking the Cycle
Fixing this problem starts with recognizing that cybersecurity is not a one-time setting; it is an ongoing process. Manufacturers need to take responsibility for long-term security by supporting products for longer lifecycles and shipping products with cybersecurity features enabled.

Integrators need to shift their approach as well. Cybersecurity can no longer be an afterthought; it needs to be built into service contracts with ongoing maintenance plans that include regular firmware updates and security checks. Security technicians also need better training on cybersecurity best practices, so they are not just installing equipment but actively securing it. Instead of leaving security configurations up to the customer, integrators should ensure devices are adequately secured at installation.

End customers must stop assuming cybersecurity is someone else’s job and start demanding more transparency from manufacturers. If a vendor cannot tell you how they handle security updates, that’s a red flag. Security devices should also be segmented from the leading network to prevent a single compromised device from exposing an entire organization. Most importantly, cybersecurity maintenance needs to be budgeted for; treating it as a one-time cost is a recipe for disaster.

The solution is not a mystery; it is a matter of taking responsibility at every level. Whether you are a manufacturer, an integrator or a customer, it is time to stop passing the buck and start treating cybersecurity as the ongoing, critical process that it is.

This article originally appeared in the May / June 2025 issue of Security Today.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.