Originally published in The Access Control Collection (TACC) on October 2nd, 2026.

I read Mike Gillespie’s breakdown of the Flock camera compromise last issue. Great piece on surveillance, data, and public trust.

It also left me with an engineering headache.

Because once someone physically holds a connected device, I want to know exactly where the bleeding stops.

The reporting didn’t establish a fleet-wide compromise. But if you design connected security equipment, you’d better have an answer for the worst case: can capturing one edge device hand an attacker the keys to the kingdom?

We’ve seen this movie. In the 2013 Target breach, attackers reportedly walked in using credentials stolen from an HVAC contractor. (Because obviously the path to payment systems runs through the thermostat.)

Blast radius has to be designed, not discovered. Otherwise you’re chasing a perimeter after the system’s already breached.

For access control, that means looking past the firewall — interrogating the reach of every credential, device key, and issuing authority.

We’ve been reading about Aliro 1.0, and it keeps dragging me back to three questions: What makes an issuer trustworthy? What evidence should buyers demand? And whose neck is on the line to deliver it?

My starting point is containment. If one device is captured, prove the others are safe. If an issuer is compromised, show me which doors it can open — and how fast that authority dies.

Individual device keys. A shared fleet secret is a synchronized self-destruct button. Individual keys isolate compromised hardware — if the backend actually limits what each device can do.

Separate verification from issuance. In signature-based designs, a reader only needs the public key. Capturing a reader shouldn’t turn it into a credential factory.

Scope the issuer. Separate signing authority by customer or site. Useless if every reader trusts every issuer blindly.

Yes, this takes more work. And sure, everyone loves buying expensive solutions to lock up their keys. But an “unstealable” key is useless if the system blindly approves a bad request to use it. Protecting the key is the easy part. Shouldn’t we protect its usage too?

The offline door is where marketing promises go to die. “Revoked” is a comforting button to click in an admin portal. But a disconnected lock in a basement doesn’t magically know that Dave from accounting just got fired.

Unless someone physically walks an update to that door, Dave’s badge still works.

Short-lived credentials limit the bleeding. On-device checks stop replay attacks. But neither of those mechanisms actually taps the lock on the shoulder to say Dave is gone.

Someone has to own the whole answer.

Issuer, manufacturer, integrator, enterprise — each owns a piece. But the customer needs one named owner, or every vendor just passes the buck.

Working on offline access taught me one thing: assume it breaks.

A trustworthy issuer proves what their authority can reach, how misuse is detected, and how that authority dies.

That’s the conversation I have with teams before it’s their device that goes dark and never comes back.