Skip to content
The second half of the year is when security budgets get spent, deferred, or lost.
Capital projects approved in Q1 are delivered in Q3 and Q4. Budgets unspent by November disappear in December. And the projects that are most likely to be deferred are the ones that have not yet been properly scoped, because you cannot approve a budget for a project whose cost you cannot estimate, and you cannot estimate the cost of a project until someone has looked at the estate honestly.
This is why Q3 is the right time to commission a security estate review. Not because something has gone wrong, and not because a contract is up for renewal. Because the window for action is open, and it closes faster than most organisations expect.
What a security estate review is, and what it is not
A security estate review is a structured assessment of your current physical security infrastructure against three criteria: technical performance, compliance adequacy, and fitness for purpose going forward.
It is not a sales pitch. A review conducted by a credible, vendor-neutral integrator should give you an honest picture of what you have, what works, what does not, and what the realistic options are for addressing any gaps. That picture may lead to a project. It may not. In our experience, the reviews that produce the most useful outcomes are the ones where the client has been told things they did not entirely want to hear.
It is also not a fire alarm audit or a physical security guard review. It covers the electronic security estate: access control systems, CCTV and video management infrastructure, intruder detection, life safety system integration, and the network and cyber security posture of the physical security infrastructure itself.
What a review typically finds
No two estates are identical, but certain findings appear with enough regularity that they are worth naming.
Firmware obsolescence is the most common. Access control servers, IP cameras, door controllers, and network switches all run embedded software that receives security updates from their manufacturers. In most organisations, those updates are not being applied systematically. A security estate that was commissioned three years ago with current firmware has been accumulating unaddressed vulnerabilities silently ever since.
Access level drift is the second most common finding. Credentials issued to employees who have since left the organisation, or access levels that were expanded temporarily for a project and never revoked, represent a real and ongoing access control failure. In a well-managed estate, the access level database is reviewed and audited on a regular cycle. In most estates, it is managed reactively and updated when an HR team asks, and otherwise left as it is.
Integration gaps appear in most estates of any complexity. The access control system was integrated with HR six years ago, but the HR platform has been replaced twice since then, and the integration is now partially broken. The video management platform was connected to the access control system at commissioning, but the connection was never configured to trigger events in the way the security team assumed it would. These gaps are often invisible. The system appears to function, but the functionality that was specified and paid for is not actually operating.
Business continuity gaps are found in almost every estate. A single access control server with no documented failover procedure. A video management database that has never been backed up to an off-site location. No tested recovery time objective for the physical security infrastructure, despite the organisation having a detailed business continuity plan for everything else.
Why the findings matter commercially
Each of these findings has a commercial consequence that goes beyond the security risk itself.
Firmware obsolescence is a cyber risk that sits within the scope of the UK Cyber Security and Resilience Bill, which extends to managed physical security service providers and their clients. It is also a risk that will appear in your insurer’s risk assessment and in any due diligence process your organisation undergoes.
Access level drift creates a documented access control failure that will surface in a regulatory audit if your organisation operates in a regulated sector like financial services, pharmaceuticals, defence, or healthcare. The GDPR implications of retaining personal data including access records linked to identifiable individuals who no longer have a relationship with the organisation are a further dimension.
Integration gaps mean that the security system you are paying to operate is not providing the protection you believe it is. Events that should trigger alerts are not triggering them. Footage that should be correlated with access events is not. The gap between the system on paper and the system in practice is where incidents are missed.
What to do with the findings
The output of a security estate review should be a clear, prioritised schedule of findings — not a list of equipment that needs replacing, but a risk-rated assessment of what needs to be addressed, in what order, and at what approximate cost.
That schedule gives you the information you need to make a Q3 budget decision. Some findings will be addressed through managed services like firmware updates, access level audits, integration reconfiguration within your existing support contract or at modest additional cost. Others will require capital investment in hardware replacement or system migration. The review should make the distinction clear.
It should also tell you what the cost of inaction is, not in a speculative way, but in terms of the specific compliance exposure, the operational risk, and the commercial liability that each unaddressed finding represents.
Evolution conducts security estate reviews for enterprise organisations across the UK, Ireland, Italy, Netherlands, Norway, Sweden, Finland and the USA. If you would like an honest assessment of where your physical security estate stands before year-end budget decisions are made, we would welcome the conversation.