Most Managers Can’t Prove Their Security Works

SAN FRANCISCO -- A new report reveals that most organizations have no single, persistent identity for the visitors and contractors moving through their buildings, and most have already experienced a real physical security incident despite high confidence in their programs.

Across two separate 2026 studies, Envoy, a security management platform, finds a structural blind spot: security teams feel protected, but their systems can't prove it, and most have already been breached

The research shows a wide gap between confidence and coverage. Forty-four percent of leaders at high-security workplaces say they cannot confidently state who was in their building yesterday.

Seventy-nine percent report at least one unauthorized or unverified person in a workspace they shouldn't have been in the past year. Across both studies, nearly three out of four give contractors no single identity that follows them across locations. And despite that exposure, 62 percent say they're confident they'd pass a compliance audit today with no preparation.

The confidence is real. The coverage is not. The numbers tell a consistent story across both studies:

• 44% of leaders at high-security workplaces can't confidently say who was in their building yesterday
• 79% report at least one unauthorized or unverified person in a workspace where they shouldn't be in the past year
• 71-72% give contractors no single identity that follows them across locations
• Yet 62% are very confident they'd pass a compliance audit today with zero preparation

That confidence gap holds even as security programs mature. In the sensitive-workplace study, 58% of leaders believe their program would stop an unauthorized person from entering, yet only 52% have badge control on sensitive doors, and just 47% escort visitors at all times.

In the separate enterprise compliance study, audit confidence peaks at single-site organizations (71% very confident), but drops to 58% the moment a second site enters the picture — the exact point where identity stops following a person from building to building.

No industry has solved it
The gap widens further by industry. Healthcare organizations give contractors a single identity across sites only 22% of the time; manufacturing, 26%. Financial services (31%) and technology (30%) fare modestly better, but no industry clears even one in three. Scale doesn't fix it either: even organizations with 20+ sites still fail to give most contractors a persistent identity, at just 32%.

For leaders protecting the most sensitive work in the country, the exposure is direct:

• AI models and training data top the list of intellectual property they fear losing (18%), narrowly ahead of client data (17%) and proprietary research (16%);
• 39% have personally seen a visitor or contractor reach a restricted area;
• 28% have seen someone view or photograph work-in-progress on whiteboards, screens, or prototypes;
• 67% are concerned about intentional insider exposure and 66% about unsupervised contractors — the exact threats current controls handle worst.

"In our facilities, we're not just protecting a building but protecting technology that has national security implications," said Tim Carr, Senior Security Manager at Attalon, one of more than 16,000 workplaces that use Envoy to support security and compliance.

"Knowing exactly who's on-site at any given moment, and being able to prove it after the fact, isn't a compliance checkbox for us, it's core to how we operate. This research confirms what we see every day: confidence in a security program means nothing if you can't actually account for who came through the door."

The findings draw on studies that interviewed 782 enterprise compliance leaders and 294 leaders at frontier AI labs, defense-tech firms, and biotech/medical R&D sites – the organizations with the most to protect.

To read "The State of Physical Security & Compliance" in its entirety, visit envoy.com.

From manufacturing sites and data centers to life sciences labs, healthcare facilities, and corporate headquarters, Envoy unifies visitor management, risk assessment, mailroom management, digital signage software, resource booking, and emergency management into one integrated platform.