Cybersecurity and physical security were once treated as two largely separate responsibilities. Cybersecurity teams protected networks, devices, accounts, and data, while physical security teams focused on people, buildings, access, transportation, and other tangible assets.
That separation is becoming increasingly difficult to maintain.
Modern businesses depend on connected offices, smart building systems, mobile devices, cloud platforms, digital access control, surveillance systems, connected vehicles, industrial technology, and executives who constantly move between physical and digital environments.
For cyber physical security executives, the key issue in 2026 is therefore not whether cyber risk or physical risk matters more. The more important question is how one security event can create consequences across both environments.
The practical model is:
People → Devices → Data → Access → Location → Physical Assets → Business Operations
When these elements are connected, security needs to be coordinated as well.
What Does Cyber and Physical Security Convergence Mean?
Cyber and physical security convergence means organizations manage previously separated security functions through stronger coordination, shared information, common risk assessment, and aligned response procedures.
CISA describes convergence as formal collaboration between cybersecurity and physical security functions. The agency warns that when these functions operate in silos, leaders can lack a holistic view of threats affecting their organization.
This does not mean every organization needs to merge its IT security and physical protection teams into a single department.
Instead, executives need to ensure that the teams communicate when risks overlap.
Consider a corporate access-control system.
The credential may be digital, but the door is physical.
A compromised executive email account is a cyber incident, but information contained in the mailbox may reveal travel schedules, hotel details, meeting locations, or sensitive site visits.
Likewise, stolen company equipment is a physical incident that can become a cybersecurity problem if the device contains credentials or corporate information.
This is the fundamental reason cyber and physical security increasingly need to be viewed together.
Why Does This Matter More in 2026?
Businesses are increasingly operating through interconnected systems.
NIST describes cyber-physical systems and the Internet of Things as systems involving interacting digital, analog, physical, and human components. These systems are already relevant across manufacturing, transportation, smart cities, emergency response, energy, building systems, and other sectors.
The issue becomes even more relevant as offices, factories, hotels, transportation systems, warehouses, and other facilities become increasingly connected.
NIST launched an ongoing Cybersecurity for Building Systems program in February 2026. The program focuses on cybersecurity considerations for building services and helps building owners, designers, manufacturers, and other stakeholders understand threats, risks, countermeasures, and governance approaches for cyber-secure building systems.
This illustrates an important shift.
A building is no longer exclusively a physical environment.
Access control, HVAC, cameras, sensors, elevators, visitor systems, and other building functions may interact with digital infrastructure.
For executives, that means the boundaries between information security and physical security are becoming less clear.
A Cyber Incident Can Create Physical Consequences
One reason security convergence matters is the possibility of cascading impact.
Imagine that an organization’s digital access-control system becomes unavailable.
At first glance, this appears to be an IT problem.
However, employees may suddenly experience difficulty entering restricted areas. Security personnel may need to switch to manual procedures. Visitor management could become more complicated. Critical rooms may require additional monitoring.
A cyber event has now created a physical security problem.
The same principle applies to connected facilities, transportation, industrial systems, surveillance technology, and other cyber-physical environments.
CISA specifically notes that cyber and physical assets can be targeted separately or simultaneously, potentially resulting in compromised systems, economic damage, exposure of sensitive information, and operational disruption.
Therefore, organizations should evaluate:
Cyber Event → Physical Impact → Operational Impact → Business Impact
rather than stopping the analysis at the compromised device or network.
Physical Incidents Can Also Become Cyber Incidents
The relationship works in the opposite direction as well.
Suppose an executive’s laptop or smartphone is stolen during business travel.
The immediate incident is physical.
However, the device may contain corporate email, authentication applications, documents, contacts, meeting schedules, cloud access, or sensitive communications.
A stolen device can therefore create digital exposure.
Similarly, unauthorized access to an office may give someone physical proximity to computers, network equipment, documents, access cards, or employees.
This creates another chain:
Physical Breach → Device or Information Exposure → Digital Access Risk → Business Risk
For executives, understanding these connections is increasingly important because senior leaders often have access to highly sensitive information while also maintaining highly visible travel and meeting schedules.
Executives Sit at the Intersection of Cyber and Physical Risk
Executives occupy a unique position within an organization’s risk environment.
They often have privileged access to information, communicate with senior decision-makers, travel frequently, meet external stakeholders, visit operational facilities, and make decisions with significant financial or strategic implications.
Their digital identity and physical movements can therefore overlap.
An executive may use a smartphone to access confidential documents while traveling between an airport, hotel, corporate office, and industrial site.
The same device can contain calendars, contacts, emails, navigation information, and business communications.
The security question is no longer simply:
“Is the executive physically protected?”
or:
“Is the executive’s device secure?”
A more complete question is:
“How are the executive’s identity, information, devices, travel, access, location, and physical protection connected?”
That is the perspective cyber physical security executives need in 2026.
Executive Travel Creates a Cyber-Physical Security Environment
Business travel demonstrates the convergence particularly clearly.
Before an executive even arrives in Indonesia, information about the trip may already exist across several digital systems.
Flight information may be stored in email. Hotel reservations may appear in calendars. Meeting addresses may be shared through messaging applications. Driver information may be exchanged digitally. Site visit details may appear in corporate documents.
Once the executive arrives, those digital details become physical movements.
The relationship becomes:
Digital Itinerary → Airport Arrival → Vehicle → Route → Hotel → Meeting → Site Visit
Information security and movement security are therefore connected.
This does not mean every itinerary must be treated as highly confidential.
It means organizations should understand that unnecessary disclosure of sensitive travel information can create avoidable physical exposure.
Access Control Is No Longer Only a Physical Security Issue
Access control is another clear example.
Traditionally, physical access involved locks, keys, guards, and identification cards.
Modern systems may involve digital credentials, mobile applications, biometric technology, cloud-connected visitor management, and networked access-control systems.
That creates efficiency, but it also creates dependency.
NIST’s work on cyber-physical systems emphasizes that connected systems increasingly combine computational, communication, sensing, physical, and human components.
Organizations therefore need to consider both sides.
- Who is authorized to enter?
- How is authorization created?
- What happens if credentials are compromised?
- What happens if the system becomes unavailable?
- Who can override access?
- What is the manual fallback procedure?
Those questions cannot be answered effectively if cyber and physical teams never communicate.
Smart Buildings Make Security Convergence More Relevant
Modern corporate facilities can contain connected cameras, access controls, sensors, environmental systems, visitor management platforms, elevators, lighting, and other building technology.
NIST’s 2026 Cybersecurity for Building Systems program specifically recognizes the need for building stakeholders to understand cyber threats, risks, countermeasures, and governance approaches.
For executives, the lesson is straightforward.
A company’s physical infrastructure may now depend on digital systems.
This does not mean every smart building is inherently insecure.
Instead, organizations need to understand which physical functions depend on technology and what operational consequences could occur if that technology becomes unavailable or compromised.
Connected Operations Expand the Risk Landscape
The convergence extends beyond offices.
Factories, industrial sites, utilities, transportation infrastructure, warehouses, and logistics operations increasingly depend on operational technology and connected systems.
In May 2026, a NIST-hosted presentation on cyber-informed engineering for industrial control systems highlighted the need to connect cybersecurity risk management with engineering responses to physical risk.
This matters for executives visiting or overseeing operational facilities.
A cybersecurity incident in an industrial environment may have implications beyond information confidentiality.
Depending on the system involved, it could affect availability, operations, equipment, production processes, or physical safety.
Therefore:
Cybersecurity → Operational Technology → Physical Operations → People → Business Continuity
needs to be considered as one connected risk chain.
Human Behavior Connects Both Security Domains
Technology is not the only point of convergence.
People connect cyber and physical security as well.
An employee can accidentally expose confidential information digitally.
The same employee can allow an unauthorized visitor through a secured door.
An executive assistant may manage sensitive calendar information while also coordinating physical meetings.
A driver may know executive movement schedules.
A receptionist may control visitor access while using a digital visitor management system.
NIST emphasized the importance of human-centered cybersecurity again in August 2026, noting that stronger security programs need to consider how people actually interact with security processes and technology.
Security therefore cannot rely only on tools.
People → Process → Technology → Physical Environment
must work together.
What Should Executives Do Differently?
Executives do not need to become cybersecurity engineers or professional security officers.
Their responsibility is governance.
Senior leadership should ensure that cyber, physical, corporate security, operations, HR, facilities, legal, and risk teams know when they need to exchange information.
A practical starting point is:
Identify → Connect → Assess → Protect → Respond → Review
First, identify critical people, information, systems, locations, and operations.
Then determine how those assets depend on each other.
Assess what could happen if one component becomes unavailable or compromised.
Develop preventive measures and response procedures.
Finally, review incidents and exercises to improve the system.
The goal is not to create another layer of bureaucracy.
The goal is to prevent organizational silos from hiding important connections.
Security Teams Need a Shared View of Risk
One of CISA’s central arguments for security convergence is that separated security functions can limit organizational visibility.
When cyber and physical security functions collaborate, CISA says organizations can develop integrated views of threats, align risk management, share information, and work toward common security objectives.
This matters at executive level.
A cybersecurity team might detect suspicious access to an executive’s account.
A physical security team might know that the executive is currently traveling.
Separately, each piece of information may appear manageable.
Together, the information may change the risk assessment.
This is why security information should flow according to relevance rather than departmental boundaries.
Incident Response Should Consider Both Environments
Organizations also need to think beyond isolated incident-response procedures.
Suppose an executive’s smartphone disappears during a business trip.
Physical security may need to determine where the device was lost or whether theft is suspected.
Cybersecurity may need to revoke sessions, secure accounts, assess data exposure, or manage device controls.
Corporate management may need to determine whether sensitive communications were involved.
The response becomes:
Physical Incident → Cyber Response → Executive Protection → Business Assessment → Recovery
The same integrated approach can apply to unauthorized facility access, compromised surveillance systems, access-control failures, sensitive information exposure, and other incidents that cross traditional security boundaries.
Security Convergence Is Already Recognized Internationally
Security convergence is not simply a new corporate buzzword.
CISA’s guidance on Cybersecurity and Physical Security Convergence states that physical and cyber assets together represent significant organizational risk and warns against treating the two security divisions as completely separate entities.
The agency describes convergence as formal collaboration between previously separate security functions and identifies integrated threat management, information sharing, strategic alignment, and common security goals among its benefits.
Meanwhile, NIST’s Cyber-Physical Systems and Internet of Things program, updated in August 2026, describes modern CPS/IoT environments as hybrid systems involving interacting digital, analog, physical, and human components.
NIST also continues to work on the cybersecurity of physical environments. Its Cybersecurity for Building Systems program was created in February 2026 and remains an ongoing initiative focused on building services, cybersecurity, risk management, and governance.
Together, these sources reinforce the same message:
Cyber Risk + Physical Risk + Human Risk + Operational Risk = Enterprise Security Risk
Security Convergence Does Not Mean One Provider Must Do Everything
Organizations should avoid another misconception.
Recognizing the convergence of cyber and physical risk does not mean one security provider must perform every function.
Cybersecurity may require specialized IT security professionals.
Executive protection requires appropriate physical-security capabilities.
Legal matters require qualified legal professionals.
Emergency situations may require police, medical services, fire services, disaster-response agencies, or other public authorities.
The objective is coordination.
Each specialist needs to understand when an issue crosses into another domain and when information needs to be escalated.
That is much more realistic than assuming one department can independently manage every risk.
Legal Compliance, Security, Transparency, and Trust
Security convergence also needs governance.
Organizations need to understand applicable legal requirements, contractual responsibilities, privacy considerations, internal policies, and limitations on how security information is collected, stored, shared, and used.
Security capability should never be used as a substitute for compliance.
At the same time, compliance alone does not guarantee effective security.
A stronger relationship is:
Legal Compliance → Security Governance → Clear Responsibilities → Operational Quality → Transparency → Trust
Transparency is especially important when organizations use external security providers.
Clients should understand what service is being provided, who performs it, what information is handled, where responsibilities begin and end, and when another specialist or authority needs to become involved.
This strengthens trust without relying on unrealistic claims that all risks can be eliminated.
Where AMED Fits into the Security Environment
AMED Corporate Protection & Business Investigation publishes services focused on the physical and operational side of executive security in Indonesia.
Its official Executive Protection page lists threat assessment, situational awareness, route planning, and executive escort as elements of its Executive Protection Officers service.
AMED also publishes Secure Transportation services involving security-aware professional drivers, route risk management, premium MPV vehicles, and airport transfers.
For executives conducting business activities, AMED lists Business Travel Security for site visits, industrial inspections, business meetings, and regional travel. Its Corporate Protection Program also includes travel planning, executive protection, a dedicated safe-guide, and emergency response coordination.
These capabilities position AMED on the physical security, travel security, situational-awareness, and executive-protection side of the broader convergence discussion.
It is important not to overstate that role.
Based on the services verified for this article, AMED should not be described as a cybersecurity provider unless a dedicated cyber service can separately be verified from its official website.
Instead, the relevance lies in helping organizations connect executive movement, physical protection, transportation, route risk, situational awareness, and business travel with their wider corporate risk-management structure.
Cybersecurity Teams and Executive Protection Teams Should Communicate
Consider a foreign executive arriving in Indonesia for several days of meetings and site visits.
The company’s cybersecurity team may be responsible for devices, accounts, networks, remote access, and data.
The executive protection team may be responsible for movement, route planning, situational awareness, transportation, and physical protection.
These functions are different.
But the risks can overlap.
A suspicious attempt to access the executive’s email could become more significant if it occurs during travel.
A lost device could require both physical investigation and immediate digital response.
An exposed itinerary could require cybersecurity investigation as well as changes to movement planning.
The better model is therefore:
Cyber Team ↔ Corporate Security ↔ Executive Protection ↔ Executive
Information should move between functions when the risk requires it.
What Should Executives Ask Their Security Teams in 2026?
Executives can begin with one central question:
“If a cyber incident creates a physical security problem—or a physical incident creates digital exposure—do our teams know who needs to act?”
That question quickly reveals whether security functions are genuinely coordinated.
Leadership should understand who owns executive protection, who manages cyber incidents, who coordinates business travel, who handles facility access, who makes decisions during emergencies, and how information moves between these teams.
The objective is not to micromanage specialists.
It is to ensure the organization does not discover its security silos during an actual incident.
FAQ: Cyber Physical Security Executives
What is cyber and physical security convergence?
Cyber and physical security convergence is the coordination of cybersecurity and physical security functions so organizations can understand and manage risks that cross digital and physical environments.
Why should executives care about cyber-physical security?
Executives frequently combine privileged information access with travel, meetings, site visits, mobile devices, and public-facing responsibilities. A cyber incident can therefore affect physical security, while a physical incident can create digital exposure.
Can a cyberattack create a physical security problem?
Yes. Connected access controls, building systems, industrial technology, surveillance systems, and other cyber-physical environments can create physical or operational consequences when digital systems are disrupted or compromised.
Can physical security incidents create cybersecurity risks?
Yes. Stolen devices, unauthorized facility access, exposed documents, compromised access credentials, or disclosed travel information can create cybersecurity and information-security consequences.
Does AMED provide cybersecurity services?
The AMED services verified for this article focus on executive protection, secure transportation, situational awareness, route planning, business travel security, and related physical protection activities. This article therefore does not characterize AMED as a cybersecurity provider.
How can executive protection work with cybersecurity teams?
The functions can share relevant information when an incident crosses domains. For example, compromised travel information may require both a cybersecurity investigation and an adjustment to executive movement or protection planning.
What should companies do first to improve security convergence?
Start by identifying where people, devices, data, facilities, transportation, and operations depend on one another. Then define which teams own each risk and how they communicate when an incident crosses organizational boundaries.
Executives Need a Connected View of Security
The central security lesson for 2026 is straightforward.
Cybersecurity and physical security are no longer isolated worlds.
Connected buildings, mobile executives, smart devices, operational technology, cloud services, digital access systems, and modern business travel increasingly connect information with physical environments.
For cyber physical security executives, the right approach is not to choose between cyber and physical protection.
It is to understand the relationship between them.
Cybersecurity → Physical Security → People → Operations → Business Continuity
Organizations that understand those dependencies can create clearer responsibilities, better information sharing, and more coordinated responses.
For executives and foreign business leaders operating in Indonesia, AMED publishes services covering executive protection, situational awareness, secure transportation, route risk management, and business travel security.
Explore AMED Executive Protection
For information about the wider EFBA business ecosystem, visit PT EFBA Digital Mulia.
The objective is not to make executives responsible for every technical security issue. It is to ensure leadership recognizes that when digital and physical environments converge, security decisions need to converge as well.
