The first line of defense is broken if you cannot revoke access

In cybersecurity, the concept of the first line of defense is well understood. The front door is the login. A user account. An admin account. An identity entering a system. Organizations invest heavily in protecting that entry point with MFA, passkeys, conditional access, privileged access controls, and continuous monitoring. The logic is simple. If you control access at the front door, you reduce risk across the entire estate.

In the physical world, especially in critical infrastructure and operational technology environments, that same logic is still applied far too weakly. There, the first line of defense is not a login screen. It is a door, a cabinet, a substation gate, a relay room, a switch house, a pumping station, or a maintenance hatch. Access is still often governed by mechanical locks and metal keys. That may feel familiar and robust, but from a control perspective it is outdated. A mechanical key is not an identity. It is a bearer object. Whoever holds it, owns the access. There is no authentication, no context, no policy check, no logging at the point of use, and in most cases no practical revocation.

That is the core problem. If you cannot revoke access, you do not control access.

Read more on why physical access must become identity-driven.

Photocredits:Istock/Galeanu Mihai