Why physical security still matters

The 2026 reality

Physical security feels old-fashioned. Everything is cloud. Everyone is remote-friendly. Why do badges and clean desks still matter?

Because the bad guys never stopped using physical:

• Tailgating is still the #1 way unauthorized people get into corporate offices
• Stolen laptops are still a top source of data breaches at companies that have otherwise strong cyber controls
• Server room and lab access controls protect the systems that hold your most sensitive data
• Lobby phishing — calling reception pretending to be a vendor or new hire — works because reception desks are designed to be helpful
• Trash and recycling bins still produce real intelligence when nobody shreds

Real recent incidents

• MGM Resorts, 2023 — Attackers called the IT help desk pretending to be an employee, used social engineering to get a password reset. Not physical infiltration, but same playbook: trust + helpfulness vs. verification.
• Casino industry, ongoing — Tailgating into restricted areas remains a documented insider threat vector, both for theft and reconnaissance
• Pharmacy chains, repeated — Customer-facing terminals left unlocked at counters have produced repeat HIPAA violations
• Banking, 2024 — Physical surveillance of employees followed by social engineering attacks ("I saw you at the bus stop, can you help me real quick?") used to gain trust

The asymmetry

Physical security has an unfortunate property: the cost of being wrong is high; the cost of being right is invisible. Nobody thanks you for politely challenging the unfamiliar person who turned out to be a contractor. But if you don't, and they shouldn't have been there, you may be the entry point in a data breach narrative.

The healthy approach is friendly verification. "Hi! I don't recognize you — are you here for someone specific?" is friendly. "Excuse me, can I see your badge?" is acceptable. "GET ON THE GROUND!" is not the expected behavior.

What's NOT your job

You aren't security personnel (unless you actually are). You don't need to:

• Physically intervene with anyone
• Detain anyone
• Pursue anyone
• Conduct searches

You DO need to:

• Notice
• Politely verify
• Report what doesn't seem right

That's the model for every module in this course.