SecuriTea

Biometric access control is ready for your door. Can you prove it to your board, your lawyers, and the people walking through it?Biometric testing is moving from vendor claims to independent, recurring, public results. In this solo episode of SecuriTea, I break down what that means for physical access control (PACS) and for security leaders deciding whether to put face and fingerprint readers on their doors.What we cover:- What DHS's remote identity testing (RIVR) found, and why it covers remote selfies, not door readers- Europe's end-of-2026 testing deadline and the AI Act's December 2027 date- Why a door reader and a phone selfie are different attack surfaces- Why you can't reset a fingerprint, and where the template should live- One-to-one vs one-to-many, and the three objections you'll hear- The Three Tests Before a Reader Goes on the Wall: Attack, Template, PermissionMonday morning: email your vendor the three questions, map where biometric templates already live, and book 20 minutes with counsel and staff reps before any rollout.Drop a headline, a security headline you want me to check out, and I'll bring the receipts.Subscribe to the SecuriTea Substack: [Substack link]CHAPTERS0:00 Cold open0:31 Episode 201:09 What DHS just changed3:51 Europe's testing clock5:15 It's about proof and permission5:53 Why biometrics wins at the door7:34 A door reader vs a phone selfie9:43 The weak spot: thin test data11:01 Permission and the 67%11:43 "Fingerprints can't be stolen"13:29 You can't reset a fingerprint14:52 Three objections you'll hear17:36 The Three Tests20:36 A hospital example22:00 Monday morning actions23:05 The testing clock23:52 Where I landSOURCESDHS RIVR-2 (Maryland Test Facility): https://mdtf.org/Rivr2DHS puts numbers behind RIVR-2 (Biometric Update): https://www.biometricupdate.com/202610/dhs-puts-numbers-behind-rivr-2-details-new-deepfake-testingEU identity providers' end-2026 testing deadline (Biometric Update): https://www.biometricupdate.com/202610/qtsps-face-end-2026-deadline-for-biometric-attack-testing-under-eidasRegulation (EU) 2026/1744 (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744HID 2026 State of Security and Identity Report: https://newsroom.hidglobal.com/hids-2026-state-security-and-identity-report-identity-convergence-drives-new-focus-trust-protectionNYC Health + Hospitals breach (TechCrunch): https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/This episode is not legal advice. Talk to counsel about your specific deployment.#BiometricAccessControl #PhysicalSecurity #SecuriTea

Your employees want to be safe. They just don't want to be watched.Bert Williams, president of the International Organization of Black Security Executives (IOBSE), joins SecuriTea live from the IOBSE annual conference in Dallas to explain why more cameras does not mean more safety, and what actually works instead.We dig into how a Fortune 500 security program cut access violations by 75% by pairing technology with communication, training, and trust.In this episode:- Why the "surveillance gap" is opening inside our buildings- How to message a violation so it never feels like a speeding ticket- Bringing HR, legal, and communications into security rollouts early- Designing security into construction projects and tenant/property-manager handoffs- How bias gets built into systems, and why diverse leadership catches it- One training shift any leader can make this Monday- Why security is a relationship industry, not a regulation industryAbout Bert Williams: President of IOBSE, founded in 1982 to support Black professionals in security, and a corporate security executive who has led access control, site consolidation, and pandemic re-entry planning at a Fortune 500 company.Have a headline you want unpacked? DM it to me and I'll bring the receipts.0:00 Cold open: Employees want safety, not surveillance0:04 Safety, trust, and the 75% drop in violations1:35 Welcome and IOBSE's history2:40 Bert's path into IOBSE and the student program5:30 Making security proactive, not invasive6:50 What drove the 75% reduction: tech vs. people10:30 Consolidating four sites and designing security in13:00 Property management handoffs15:30 Diverse leadership and bias in systems17:45 One training shift to make this Monday19:40 Better communication for security teams21:00 Security is a relationship industry#Security #PhysicalSecurity #WorkplaceSafety #IOBSE #CorporateSecurity #SecurityLeadership

Alert Enterprise's EVP of Sales & Marketing, Will, explains why physical security and cybersecurity are still treated as separate budgets, and what that gap actually costs.Recorded live on the show floor at GSX (Global Security Exchange), episode 18 of the SecuriTea podcast.TIMESTAMPS 00:00 Cold open at GSX 01:05 Back-door vs front-door analogy 03:30 What the platform won't do05:12 Robot dog break 06:30 The $90M badge-data storyWhat is physical-cyber security convergence? Convergence means treating physical access control (badges, doors, visitors, contractors) and cybersecurity (identity, network, IT governance) as one connected risk picture instead of two separate teams and two separate budgets.Why does this matter to a board member? Most companies spend heavily to lock their cyber back door but leave the physical front door open, meaning badge and access-control data goes unmonitored even though it can reveal real financial risk.What is the $90M badge-data example? According to Alert Enterprise, one customer used badge-swipe data to discover contractors were billing 80 hours while only on-site for 40, a gap that led to $90M in savings. This is Alert Enterprise's own reported case, not independently verified.What does Alert Enterprise not do? Despite being an identity-focused platform, Alert Enterprise is not a cybersecurity intelligence tool. It does not manage cyber identity and access management (IAM) directly. It connects physical access governance to the IT systems already in place.

Physical security vendors have spent decades selling software platforms that failed their users.Live from IOBSE in Dallas, 30-year security veteran Holly Hunt pulls back the curtain on the industry's historical mistakes, from the early collapse of premature PSIM deployments to the systemic trap of the traditional "pipe economy".Holley and Xander break down why command-and-control culture cripples data sharing, how enterprise teams at Slack and SentinelOne automated compliance without human conflict, and why 360-degree mentorship is the only defense against industry stagnation.Chapters00:00 - Wire-Puller to Earning Respect in 2000 02:40 - The "Pipe Economy" vs. The Customer 04:35 - Why Early PSIM Deployments Hurt Clients 06:38 - The Real Reason Security Silos Exist 10:15 - Why Your Career Isn't a Journey—It’s an Odyssey 13:40 - Turning Slack Into a Corporate SOC 15:45 - Using Ambient AI as the "Bad Cop" for Zero Trust 17:15 - Breaking Past the Gatekeepers: Allyship at IOBSE 22:15 - "Growth Is a Personal Decision" 23:55 - The 360-Degree Mentorship RuleConnect with SecuriTea: Signal over noise. Integration over silos. Action over outrage.Holley Hunt: https://www.linkedin.com/in/happyhunting/Xander Alexander: https://www.linkedin.com/in/xanderalexander

Are low-bid private security contracts saving your enterprise money, or are they creating an indefensible negligence claim in civil court?In this episode, licensed attorney, 35-year industry veteran, and ASIS International President Eddie Sorrells breaks down the legal and operational realities of modern security procurement. We examine surging 2026 labor market wage trends, the risks of replacing human personnel with unintegrated AI, and the single cultural metric that proves real security ROI.Key Questions Answered:• Why are lowest-bid security contracts treated as evidence of negligence in court?• How does guard turnover and lack of training impact corporate liability?• What is the operational difference between threat prevention and cyber-physical resilience?• How do ASIS certifications (CPP, PSP, PCI) establish legal defensibility?• What core question must leadership ask security providers before signing an RFP?• How does frontline officer culture directly impact enterprise brand reputation?Featured Guest:Eddie Sorrells, Esq., CPP, PSP, PCI: President of ASIS International, Chief Operating Officer and General Counsel at DSI Security Services, and author of "Lead Where You Stand: Building a Career in Private Security Leadership."Chapters & Timestamps:00:00 - The Legal Time Bomb of Cheap Security01:40 - Signal Over Noise: Setting the Security Baseline02:21 - From Frontline Guard to 35-Year Executive: Eddie Sorrells05:04 - ASIS International and Developing Next-Gen Talent08:45 - Threat Protection vs. True Operational Resilience11:26 - The 2026 Labor Shift: Why Security Wages Are Surging14:44 - Cyber-Physical Convergence: Guards on Corporate Networks17:35 - Human Guards vs. AI Tech: Deploying the Right Tool21:20 - The Courtroom Lens: Defending Your Procurement Decisions24:45 - Demystifying the Triple Crown: CPP, PSP, and PCI Value28:56 - The #1 Leadership Question to Ask Security Providers31:38 - The Forgotten KPI: Voice of the Customer and Safety Culture36:04 - "Lead Where You Stand": Real-World Leadership Lessons40:05 - The Plateau Fallacy: Career Longevity in SecurityResources Mentioned:ASIS International: https://www.asisonline.orgBook: "Lead Where You Stand" by Eddie Sorrells#CorporateSecurity #RiskManagement #PhysicalSecurity #ASISInternational #GeneralCounsel #PremisesLiability #SecurityROI