Welcome to Volume 2 of The Security Breakdown!

As a reminder, building on our digital-first media vision here at The Access Control Collective, we're expanding our offerings with The Security Breakdown—a comprehensive security intelligence hub in partnership with industry experts. This initiative complements The Access Control Executive Brief with in-depth security coverage across multiple formats. Current members get automatic access to all content, while new subscribers can choose between a full membership or a free newsletter. Our commitment remains to deliver valuable, drama-free insights with integrity, focusing on unveiling rather than unraveling industry information.

Welcome to Volume 2. This week, we hear from Brian Karas and Tony Dong, an introduction by Angie Barnes, and some thoughts and information from me. We will continue to build out the contributors and are in active discussions with many of you to bring insights, deep technical reports, and more. If you would like to be a contributor, please message me at lee@leeodess.com.

Here are some quick updates from me:

Topology Map is getting an upgrade!

The Access Control Executive Brief members will get an exclusive preview of our latest innovation in two weeks. We've partnered with an exceptional team to transform our Topo Map into a sophisticated custom-trained LLM knowledge base. This revolutionary tool will serve the entire security industry beyond access control. The platform offers powerful capabilities, including instant answers to security industry questions and the ability to cross-reference proprietary information with open-source data. Its community-driven approach sets this apart, allowing industry professionals to contribute valuable insights while maintaining quality through expert verification. Instead of relying on a single source of truth, we're creating a collaborative, transparent, and globally accessible knowledge base. Best of all, this valuable resource will be included in both individual and corporate memberships at no additional cost. We're approaching the launch in just a few weeks, and we're thrilled to unveil this groundbreaking tool that will serve our industry's evolving needs.

The AC/MA Summit (NY, USA)

Scheduled for March 4th at Houlihan Lokey's office in NY, is a groundbreaking half-day event focusing on the global access control and financial industry. This first-of-its-kind summit brings together professionals from banking, corporate development, private equity, and venture capital for networking, keynotes, and panel discussions. The impressive speaker lineup includes financial market presentations from Michael Morabito and Justin Abelow of Houlihan Lokey, a corporate development panel featuring executives from HID, Salto, and Chamberlain, and a private equity panel with representatives from LLR Partners, Triton Partners, and Ulysses Management. The event includes a venture capital discussion led by Annie Lan from Egis Capital Partners and a panel of companies sharing their capital-raising experiences, featuring CEOs from Kisi, Brivo, and SwiftConnect.

Get your tickets here.

The Security Event (Birmingham, UK)

If you are a manufacturer or service provider serving the European market, The Security Event (as it's lovingly known) is the perfect show to showcase your offerings. We've partnered with the show producer, The Nineteen Group, to present the XForum—a thought leadership stage featuring over 60 talks, discussions, and presentations across three days. Surrounding the XForum are 12 "pods," which offer an excellent way to enter the show or establish a local presence if you already have a booth. The pods cost £8,000 and are transacted directly with The Nineteen Group (for clarity: we don't receive any money from pod sales; we're paid separately to activate the XForum, regardless of pod sales). We'll support you with social media and coordination efforts upon signing up. We're currently 50% sold, and I'm eager to fill the remaining pods. As a bonus incentive, any company that secures a pod will receive a complimentary 1:1 long-form podcast with their executive team, which we'll produce at no cost.

ACS25 (San Sebastian, Spain)

The Access Control Summit (ACS) is returning for its third year as the premier gathering for access control industry leaders, featuring an exclusive 150-seat event hosted by SALTO WECOSYSTEM in San Sebastian, Spain. This prestigious summit has attracted an impressive lineup of executives from Dormakaba, Allegion, Salto, Wesco, Google, Acre, AlertEnterprise, AMAG, Verkada, Nedap, PDQ, iLOQ, Veridas, SAGE Integration, Elatec, SwiftConnect, Brivo, ColorID, Touch2Access & ELF, Nineteen Group, Wavelynx, Intel, Raymond James, CoreWillSoft, Pelican Zero, PassiveBolt, Zenitel, igloo, IDCube, Dot Origin, Secom, Legic, Axis, Idemia, Sharry, Zaplox, Assa Abloy, Accessia, Butterfly MX, PSA, SIA, Kastle, and Gallagher - with more industry leaders joining. This intimate setting offers attendees unique opportunities to engage in meaningful discussions, explore industry trends, and shape the future of access control technology. Get your tickets here.

PS: I am sure some of you may forward this, but please do so sparingly and encourage others to sign up here. Thank you!

Thank you!

Warren Buffett’s number one rule of investing is simple: "Never lose money." Sure, even Buffett’s broken his own rule a few times—his investments in airlines and Kraft Heinz come to mind—but on the whole, his track record speaks for itself. The reasoning behind this rule is just as straightforward: if you’re picking individual stocks instead of buying the whole market, you can’t afford to blindly "buy the dip" or "average down."

Why? Because the math of losses works against you. A 10% loss means you need an 11% gain to break even. A 25% loss requires a 33% gain. Lose 50%, and you’ll need to double your money just to get back to where you started. It’s a asymmetrical proposition to begin with.

And today, with risk-free T-bills yielding upwards of 4%, you don’t need to take unnecessary risks if you’re unsure about your investment thesis. You can park your money in something safe and still make a return (this is called a “hurdle rate”).

To hammer this point home, let’s take a trip to the dumpster bins of the security industry—a place littered with companies that have burned unsuspecting retail investors in spectacular fashion. These examples will highlight the red flags you should watch out for before putting your money on the line.

Remember: investor relations presentations and press releases are designed to paint the rosiest picture possible. Forward-looking statements—those vague promises of growth, profits, or new clients—are often little more than hopeful guesses. Always check the numbers.

And if those numbers come from a company that doesn’t even bother with proper audits (like OTC stocks), don’t waste your time.

The Basic Ratios

Here’s the good news: you don’t need to pull up a 10-K report or get buried in accounting minutiae to do a gut check on whether a company is worth investing in. Even Yahoo Finance is more than enough for some quick answers.

If you’re going to put your money into a business, treat it with an owner’s mindset. Ask yourself this: would you buy a private business with negative free cash flow, negative profit margins, and negative earnings per share? No? Then why would you buy a public company in the same financial shape?

Retail investors often fall into this trap because public stocks are marked to market—their price is displayed front and center on your brokerage app, and that number moves based on supply and demand. But here’s the critical point: the price doesn’t change the fundamentals of the business. Just because a bunch of people hype it up and drive the price higher doesn’t mean the company magically stops being a cash-burning mess.

Take Knightscope (KSCP) as a case in point. This company makes security robots and was one of the first to use Regulation A+ crowdfunding. A quick glance at its Yahoo Finance profile tells you everything you need to know:

What kind of company is this? Well, to put it bluntly, it’s one where the fundamentals are a disaster. Negative profit margins and operating margins mean the company is bleeding money. The astronomical negative ROE indicates it’s destroying shareholder value at an impressive pace. And if you thought free cash flow might save the day, think again—it’s negative too.

Now, growth investors often make exceptions for companies with negative profitability, arguing that they’re investing heavily in R&D or acquiring customers aggressively to scale. Fair enough.

But that doesn’t apply here. One quick glance at quarterly revenue growth (YoY): -10.10% tells you all you need to know. It means they’re shrinking, not growing. Despite all that cash they’re burning, their revenue is actually declining year over year. In what world does that justify an investment?

Knightscope isn’t a growth company; it’s a warning sign. Don’t fall for the hype just because it’s public and has a flashy product. Always dig into the basics.

Management Commentary

While press releases give management the liberty to spin forward-looking statements as optimistically as they like, they don’t have the same freedom in official filings. That’s where they have to be more candid and forthcoming.

If you want a better sense of how the business is actually doing and what management thinks its prospects are, look at the 10-K (annual report), 10-Q (quarterly report), and 8-K (current report).

These documents are designed to be qualitative—plain language sections that discuss the company’s operations, financial condition, and future outlook.

The section you’ll want to zero in on is "Management’s Discussion and Analysis of Financial Condition and Results of Operations" (MD&A). It’s a fantastic resource, especially for those of you who aren’t financially inclined or who feel your brain melt staring at spreadsheets (like me).

Here’s a pro tip: hit Ctrl+F and search for terms like "going concern" or "delisting." Why? Because when those phrases pop up, they’re massive red flags.

Let’s take KSCP as an example again. Funny enough, both terms are mentioned multiple times in their latest 10-Q filing.

• "Going concern" essentially means management is warning you that the company might not survive. If they’re putting it in writing, the financial situation is probably dire.

• "Delisting" means the company is at risk of being kicked off its exchange (e.g., Nasdaq). Why? Usually because their share price has fallen too low.

If you see these phrases in a company’s filings, it’s like a flashing neon sign that says "stay away." Management is essentially telling you the business is struggling to keep the lights on. Pay attention.

Toxic debt, dilution, and reverse splits

Remember this: as a shareholder, you’re dead last in the capital structure. All that corporate talk about "maximizing shareholder value"? It’s meaningless when a company is fighting to stay afloat. When push comes to shove, management will happily throw you under the bus to keep the lights on for another quarter.

Companies in trouble, like Knightscope, have a nasty habit of screwing over their shareholders. The most common weapon of choice? Toxic debt, dilution, and reverse splits.

Here’s how it works: the company raises cash by issuing convertible securities—things like convertible bonds or preferred shares. These securities allow the holder to convert them into regular shares, usually at a steep discount to the market price. Why is this toxic? Because as the stock price tanks (and it will), these conversions flood the market with new shares, causing even more downward pressure on the price. It’s a vicious cycle.

The net result of this toxic debt is usually dilution. This happens when the company increases the total number of shares outstanding. It’s even worse if management goes a step further and approves an increase to the authorized share count.

Here’s the plain-language version: they’re baking a bigger pie and selling slices of it to raise cash. But your slice of that pie? It’s worth less and less every time they dilute.

Why do they do this? To stay solvent, of course. They’ll work with an underwriter to sell these shares on the open market—essentially throwing your equity value into a woodchipper to fund operations.

And here’s where it gets even nastier: reverse stock splits. A reverse split is like a sleight of hand. The company consolidates your shares at a set ratio—say, 100-to-1.

If you owned 1,000 shares before, now you have 10. The price per share goes up temporarily, but nothing about the company’s fundamentals improves. They just made the pie smaller so it looks more appealing.

Now, when you combine all of this—toxic debt, dilution, and reverse splits—you get what I call the “death spiral”. Here’s how it plays out in five simple steps:

1. The company hits its authorized share limit, let’s say 1 billion shares, and can’t issue more.

2. They push through a reverse split—100-to-1—so 1 billion shares become 10 million.

3. They work with a firm like Hudson Bay Capital to issue convertible securities.

4. The newly converted shares flood the market, driving the price down.

5. The cycle repeats, with more authorized shares, more dilution, and another reverse split.

What does this look like on a stock chart? Picture a jagged line trending endlessly downward, with occasional spikes, only to collapse again as the dilution kicks in.

It’s a financial horror story, and unfortunately, it’s far too common. Don’t fall for it.

Physical security is a world of networked devices these days, and for a multitude of reasons connecting these devices with a physical cable is the preferred means of linking things together. But what happens when it just is not practical to get a network cable from the device to the nearest network switch? In these cases we usually opt for some kind of wireless connectivity, which is almost always based around some version of Wifi.

This topic is very complex, with lots of variations, so to keep this simple, we will focus on the most common situation, which is you have a device with an Ethernet port, and no way to plug it into a switch. We will also assume the distance you want to span is less than 1000’, in a physical area that is mostly, if not entirely, under your control. This is by far the most common scenario I come across, or have people ask about.

One last thing before we jump into the technical bits, this is written to assume you have at least a basic understanding of wired and wireless networks and related topics.

Situation 1: There is an existing suitable wifi network

Almost every business has a wifi network in operation these days. For most standard business or residential internet packages you get a wifi access point by default, and it is preconfigured with some boring SSID like “Spectrum-1345”. If your wifi network is created by hardware from the last 10 years or so, it likely supports both 2.4Ghz and 5Ghz networks, and can stream at least 100Mbps of data without any trouble.

If you have an existing wifi network, and it doesn’t suck, all you need is a simple wifi bridge and you can attach any device with an ethernet port to that network (after configuring the bridge of course). This is a ~$50 solution that takes 5 minutes to set up. This will work perfectly fine for a door controller, a typical surveillance camera, or anything along those lines. Keep in mind that those devices will be on the same logical network as all of the other devices on that wifi network, whereas best practices usually put security and surveillance equipment onto a segmented network.

I have seen this approach used successfully hundreds of times, and while it is not the most recommended, it does work, and even streaming video from a camera will work fine. A typical H.265 video stream from an 8MP camera is rarely more than 6Mbps, or about 6% of the bandwidth of even the most generic 2.4Ghz network.

The downside to this approach is all of the issues that you are likely already aware of if you are familiar with wireless networks. It can work great, until it doesn’t. New devices might be added that negatively affect the network. New sources of interference can come into play, crippling the entire wireless network. But a security problem you’re solving with a $50 bridge should be, by definition, one that is not mission critical in the first place.

Situation 2: There is no existing suitable wifi network

In this scenario, either there is no wifi network at all, or there is a wifi network but you are smart enough to know to not try to ride your equipment on that network.

At a high level, the solution here is very similar from a topological perspective, we are going to connect a wifi device to our remote camera, controller, or whatever. We are also going to add a dedicated device at the other end as well, so that we have full control of wireless equipment that is dedicated to our task.

Typically the equipment used here will be referred to as a kind of Point to Point bridge, sometimes referred to as PTP bridge, or just PTP Wireless. Ubiquiti is a commonly used product in this space, though I see integrators that do a lot of these kinds of links opt for higher end equipment from companies like Ruckus that tend to have more ruggedized options.

Frequently the equipment in this class will be outdoor rated, as these impossible-to-cable scenarios tend to involve outdoor locations. In many cases you can find devices that are PoE-powered on one end (the device that goes at or on the building), and with PoE output at the other end (to power up the network device). Also, in case it was not already obvious, you need to power this equipment, so your remote end needs to get power somehow, it’s not completely wireless.

Dedicated PTP setups will have directional antennas, so that the wifi signal is concentrated over a narrow angle. This helps increase range and reliability. This also means that the devices need to be aligned to point at each other, and will need a clear line of sight, or at least minimal obstructions between them.

Some Additional Considerations

While there are products that utilize proprietary protocols, which can sometimes add a level of throughput or reliability that exceeds that of standard wifi, all of these devices use the same unlicensed spectrum. One of the biggest hindrances of a wifi network is spectrum congestion (too many wifi devices operating in the area), or outside interference from other equipment. In this situation, proprietary protocols likely won’t fare any better than standard wifi, as they will be subjected to the same issues. Also, any device using the unlicensed spectrum bands has to conform to the same transmit power limitations, so you will tend to see similar overall performance from any equipment (provided of course you are not comparing a super cheap option to a higher end product).

You can think of a PTP link as an invisible ethernet cable. This means that at the remote end you don’t have to limit yourself to a single device, you can hang a switch off the remote point and connect multiple devices over that link. If you are using 5Ghz equipment, or newer 2.4Ghz equipment, you can easily get a couple hundred Mbps over that link and you’d never know you were backhauling those devices over a wireless link.

In my recent analysis of the access control industry for 2025, I've identified several key trends that are shaping our future. The first major shift I'm seeing involves capital markets, where heightened public safety concerns drive investment interest, particularly as our industry transitions from hardware to software solutions.

I've observed significant movement in industry consolidation, noting how brand recognition is crucial in this mature market. While several companies are positioning for IPOs, current economic conditions may present some challenges. Additionally, I'm seeing a fundamental transformation in platform evolution, where we're moving away from isolated systems toward more integrated, API-first approaches.

The SMB market presents an exciting opportunity, with enterprise solutions becoming increasingly relevant to smaller businesses. However, I acknowledge that transitioning from traditional dealer networks to digital-first models may face some resistance. In the marketing space, I'm particularly excited about the emergence of B2B influencer marketing and the opportunity for manufacturers to build stronger online communities.

While I believe these changes are inevitable, I recognize that some of these transformations may take longer than anticipated, given our industry's traditionally conservative nature (time to get off our heels and onto our toes). The interplay between capital markets, consolidation, and SMB market development could create interesting dynamics that we must watch closely. To hear or to watch more, please check out a free truncated version of Access Control Executive Briefs 89, where I dug deep into each trend. If you want to hear the entire episode and receive future Access Control Executive Briefs, active Slack community, and much more, consider joining as a member.

Metropolis, the company that recently acquired Oosto (see Volume 1 for background), has been unheard of in security, though they dominate the parking technology space, using many products that you might find on an ISC West show floor. Having recently acquired SP Plus, and secured $1.8B in financing, Metropolis is a huge player in this space, with projections of processing over $4B in parking revenue in 2025.

Lee Odess often talks about how the security market is much larger than what most analysts peg it at, and how manufacturers and integrators are ultimately missing out on more revenue than what they are actually getting. Metropolis is a good example of this, if you’ve ever paid for parking, then you’ve seen that the gates, ticket dispensers, RFID/NFC readers, LPR cameras, and other devices are all straight off the ISC West show floor, or small derivatives of products you’d find there. The difference though is that companies like Metropolis use these products as the tools to unlock larger revenue streams, and build applications more around problem solving than just pure safety and security. There is no reason that Boom Edam, i-Pro, or Wavelynx (to name a few) couldn’t be technology leaders in this space, and there is no reason that any moderately equipped integrator couldn’t target their marketing to these kinds of applications to expand their markets.

Couple parking technology applications with the trend we are seeing in more solar-powered, 5G-connected surveillance trailers and rapid deployment systems, and you have the potential to create dynamic, controlled, profitable, parking areas around concerts and events in a way like never before. Somebody is going to build that. Is it going to be a “Security” company, or a “Parking” company?

This one happened late 2024, but did not seem to get a lot of coverage in our space so I thought it would be worth looking at again. A UNC Chapel Hill student cloned university access badges, and then used those cloned credentials to access offices and other areas that he did not have permission to access by default. His LinkedIn page and Student page show the typical background of a “hacker nerd” (meant in the purest sense), and while there are no indications of nefarious intent, this incident shows that insecure credentials can pose real-world risks.

Online coverage does not list how he cloned the credentials, however RFID cloning tools have been around for many years, and recent things like the Flipper Zero have only made cloning more accessible to the masses. Anyone who has looked into this knows that RFID has been considered highly insecure and easily cloned for over a decade now.

Looking at this from a bigger picture perspective, I think this incident both underscores the vulnerability of RFID, and also in a way highlights why it is still not commonly seen exploited in the wild for most users. For the average office worker there is little incentive to clone cards to access off-limited areas. Most people want to spend less time in the office, not more, and the risk of losing a job isn’t worth it. While credential cloning is push-button easy if you have insecure credentials, you still need to get close to a person with a valid credential, and have a cloning device (though they can be purchased on Amazon). This all adds up to needing a strong incentive to go through the process of cloning another person’s credential, which reduces the likelihood of it actually happening.

There are applications that are at higher risk of cloned credentials. Universities in general, particularly ones with a strong tech program, should not use insecure credentials of any kind. Bored students with access to high tech equipment, and at a general stage in life where they are pushing boundaries and exploring new things probably isn’t a great combination. Any situation where a card is used as a form of payment, such as parking garages, corporate cafes, vending, etc. would also be a lucrative target for someone to consider trying to clone and use another person's credential. Apartment buildings, particularly with amenities such as pools and gyms can also be targets. In the scenarios I have heard of here, valid residents often willingly clone and share weak credentials with family members, romantic partners, or close friends to give them access to those areas for their own enjoyment. This last one, while definitely wrong, is less of a direct risk, as these people could just as easily share their actual valid credential, or let someone into a secured space using their credential. The loss is also less direct most of the time, an extra person or two at the apartment pool or gym is likely no real issue, unless it results in crowding or other issues.

To be clear, there is no reason or excuse for continuing to deploy insecure credentials today, and legacy systems using these credentials should formulate a plan to phase them out rapidly. However, the risk to most organizations is most likely fairly moderate, but at the same time increasing, not decreasing, over time.

So, let’s open this with the first out of the gate COMING SOON contribution from the “Impatient Sales Lady”, with a different spin? What real nuggets and information can make this newsletter your GO TO every week, where the printer starts whirring and the highlighter comes out, maybe even a sticky note on the desk to remind you what you learned and can apply. Even the head is shaking while reading going, yes, I hadn’t really thought of that right? If we can do that with this weekly contribution then, boom, we have done something that provides value and will keep you coming back for more week after week. In saying all of this with my Angie rambling’s, are you in? Give us and me a chance to do that. I promise we won’t let you down, and when this hit’s your linked in updates or your inbox, you will save it, print it or put it somewhere you know you can come back to it, for the value it provides.  This newsletter will thrive just on Lee’s amazing insight alone, I just want to give him a bit of Angie spin and thoughts to provide the value we all seek in our amazing industry, we call security.

Look for our Premier article next week, Drum roll!  – Superpower Moments: When did these Security Titans of Leadership feel like a superhero in their career and what "superpower" they used to succeed.

Guest Contributor’s, Tara Dunning – Vice President of Global Sales and Strategy, Wesco, Julaine Simmons, Sr VP of MC Dean, Inc., Michal Moss Early, EVP of Corporate Strategy DMP, and Maureen Perrelli, Industry G.O.A.T., Disruptor and Strategic Leader.