Beyond the Perimeter: Protective security in a connected world
Technology permeates every aspect of our lives, creating hybrid risk across physical, personnel, and cyber domains. NPSA asks security professionals to assess whether existing models of responsibility still reflect the environment they protect.
It’s a sunny Tuesday morning. I wake up and my smart watch tells me I’ve been sleeping better recently, probably since I started scrolling less on social media before bed. I’m visiting a new client today, so over breakfast I programme the route into the car from my phone and switch on the air conditioning. Before I leave, I ask the home assistant to add some essentials to the family shopping list, which notifies my partner.
Throughout the day my phone tells me that I missed a delivery and that a neighbour left a message at the front door. After a long day at work, I’m looking forward to watching the new crime drama my streaming platform recommended.
We now routinely communicate with appliances, vehicles, home security, entertainment systems, and other connected technologies that permeate every aspect of our lives. In parallel, the physical environments we protect depend on similar advances. Offices automatically adjust heating, lighting, and other facilities based on sensor data, and in industry, older equipment is being fitted or replaced with new digital systems.
Connected technologies can both strengthen and threaten security and privacy. More everyday services are delivered through online accounts, effectively trading convenience and personalisation for a rich digital footprint, as online data ecosystems build detailed profiles of users doing the weekly shop, hailing a taxi home, or planning their next holiday. Similarly, connected workplaces can expose sensitive insights about sites or processes from aggregated data, unintentionally creating valuable hostile reconnaissance tools.
Traditional security models, structures, and roles have diverged from operational reality as connectivity has shaped environments. Hybrid threats pose complex risk across physical, personnel, and cyber domains. Controls that were once bounded, visible, and locally enforced are now deeply intertwined with digital data, infrastructure, and governance that sit outside the conventional perimeter. Across commercial estates and office buildings, factories, public spaces, and critical infrastructure, networked technologies increasingly underpin how physical spaces function and how people interact with them.
NPSA’s work across physical and personnel security consistently highlights the growing influence of connectivity and data-driven processes. This is both in the environments we seek to protect, and the measures we use to protect them.
Organisations rely more heavily on connected platforms, remote operations, and dispersed infrastructure to deliver access control, hostile vehicle mitigation, weapons detection, visual surveillance, building management systems, and personnel functions. Physical security specialists must recognise how inextricably interdependent their fields are with technology, and vice versa; if not directly, then through people, whose behaviours are increasingly driven by interaction with personal devices and the digital systems around them.
A system outside your control
In this connected environment, every device interaction generates data that often travels far beyond the immediate system. Individual components, though simple in isolation, both influence and respond to a vast and opaque digital ecosystem. This ecosystem ignores organisational and geographic perimeters; it spans personal devices, corporate systems, and public infrastructure, linking entities across trust boundaries that operate under different security standards and legal obligations.
For protective security professionals, this misalignment between technical reality and organisational control represents a growing challenge. Security outcomes increasingly depend on systems and actors outside their visibility and authority. In some cases, service providers route or process data in jurisdictions where external authorities can legally compel access, often without the system owner’s knowledge or consent. As a result, organisations may depend on, or be exposed to, parts of a connected ecosystem they neither control nor fully understand.
The mission to secure our people, information, and physical assets brings together issues spanning protective security disciplines. This complexity challenges traditional notions of perimeter security, and demands an approach that accounts for the distributed, dynamic, and interdependent nature of modern connected ecosystems.
Security beyond convergence
The threat of access to data and control over systems in connected physical environments isn’t new; these dynamics are often discussed under the banners of ‘convergence’ and ‘cyber-physical’ systems. What continues to evolve, however, is the scale and richness of information generated, the range of capabilities embedded into everyday environments, and the degree to which human behaviour is influenced by technology. As functionality and integration increase, so too does the potential value of these systems to hostile actors. ‘Convergence’ is a starting point; implications for security extend beyond to fundamental questions of dependency, authority and accountability.
Six pressure points
For security professionals, this introduces a series of interlocking consequences that cut across domains:
- An expanded digital attack surface. Every new connection inevitably increases the potential access points available to hostile actors. Internet of Things and endpoint devices, particularly in the consumer domain, are rarely built with security as a primary consideration. Regardless of provenance, the design characteristics common to many connected devices challenge long-held expectations around system control, assurance and accountability.
- A dispersed physical attack surface. Though it may feel intangible, digital connectivity rests on a vast and very real hardware footprint. Endpoint devices, terrestrial and subsea telecommunications cables, data centres, internet exchanges, and satellite systems form a complex web that spans countries and continents. This physical sprawl means that vulnerabilities are not confined to single sites, networks, or attack domains; they emerge wherever the physical components supporting connectivity are exposed.
- Supply chains further complicate this picture. Connected ecosystems are assembled from layered hardware and software components of mixed provenance, forming complex and obscured supply chains that organisations are unable to map comprehensively. Even then, considering the fluidity of investment and ownership, any mapping of supply chains and dataflows is only point-in-time. Without end-to-end visibility and assurance, changes to upstream service agreements can erode trust in system integrity and data over time.
- Insider risk is also reshaped by connectivity. As connected ecosystems grow, so too does the number of individuals with access to, or influence over, their components, including contractors, technology vendors, integrators, and third-party service providers, many of whom will sit outside traditional personnel security models. Security teams struggle to exercise effective oversight, which is obscured by patterns of legitimate access, remote maintenance, and shared responsibility models.
- Systems increasingly rely on real-time data feeds to function. What once were add-ons or functionality enhancements have become operationally critical. This reliance introduces new dependencies on connectivity and data availability; disruption to data streams, whether accidental or malicious, can have cascading effects. Under degraded conditions, systems may behave unpredictably; understanding how a system is designed to operate without connectivity becomes as important as performance under normal operation.
- Finally, adversaries can use data-rich environments as powerful sources for virtual hostile reconnaissance against individuals, premises and organisations. Aggregated fragments from across multiple sources can reveal sensitive insights, whilst seemingly harmless in isolation. Revealed patterns of behaviour, system usage, physical layouts, and operational processes may be exploited by hostile actors to undermine security in the physical world, acquire sensitive information, subvert process, or influence individuals.
Taken together, these developments point to a shift in the security environment. They challenge assumptions about our traditional models of security disciplines, they challenge expectations about control, assurance, and accountability, and they challenge our understanding of dependencies and exposure. These concerns don’t belong to one sector or point to threat from any one source; they reflect a change in the environment we all operate in.
Reassess your exposure
This shift will continue, and as security professionals we must be prepared to engage with it deliberately. Connected technologies are already embedded in our organisations, supply chains, and daily lives; opting out is not realistic. What is within our control is how intentionally we understand those connections, how clearly we define responsibility for them, and how routinely we test the assumptions that underpin trust in our systems.
NPSA recommends that security leaders and practitioners take the time to reflect on their own connected ecosystem, and whether existing models of responsibility still reflect the environment you protect.
This evolution will present differently to you depending on your sector, your technologies, your customers, and the threats you face. Many readers may be familiar with these challenges already; we encourage you to start those conversations within your organisations, and contribute to the wider professional dialogue. Bringing experiences into the open by sharing what has worked, what has not, and where tensions remain will be essential to developing more resilient practice.
Where consequences are most acute, NPSA and our partner national technical authorities will continue to work to make the UK, your people, and organisations, more resilient to terrorism, state threats, cyber and technical attack. This begins with a collective baseline of preparedness, of which security professionals across the country are the essential part.
Further guidance and support are available at npsa.gov.uk, but the first step begins with asking: do our current security assumptions still match the world we operate in today?
National Protective Security Authority (NPSA)
