Warren Buffett and Berkshire Hathaway are back in the news. According to the latest 13-F filing—a quarterly report required by the SEC that discloses an institutional investor’s equity holdings—the 94-year-old investing legend has trimmed positions in several banks and broad market ETFs. 

Yet, Berkshire remains one of the most impressive collections of wholly owned businesses and public stock holdings, backed by an enormous $325 billion cash pile. Buffett’s empire spans multiple industries, from insurance and utilities to manufacturing and retail. You can find a pretty neat infographic here via IndyFin.

But one sector is noticeably missing: access control and security. Buffett has never directly invested in access control, despite the industry’s growing importance. That got me thinking—if Buffett were to invest in this sector, what would it be, if anything?

From decades of Berkshire Hathaway shareholder letters, annual reports, and interviews, we have a clear framework for Buffett and the late Charlie Munger’s approach to value investing. 

Let’s apply their quality-over-price investment philosophy to the access control sector and see which companies might fit the mold.

Wonderful companies at a fair price

Buffett’s investment journey started with the Benjamin Graham school of value investing, which he learned at Columbia University. Graham’s approach, often called the “cigar butt” strategy, involved buying companies that were so cheap they couldn't be ignored. 

These businesses were often struggling but still had a few profitable years left—just like finding a discarded cigar butt with a couple of puffs remaining.

The problem? These weren’t robust businesses. They were cheap for a reason, often facing structural declines or having weak long-term prospects.

That changed when Charlie Munger convinced Buffett that instead of buying mediocre businesses at great prices, it was better to buy wonderful businesses at fair prices. This shift led Buffett to focus on quality over price, which became the defining strategy of Berkshire Hathaway’s success.

The illusion of earnings per share

Quantifying what makes a company wonderful and fairly priced isn't intuitive. However, Buffett dropped a key insight in his 1979 shareholder letter, where he outlined his litmus test for measuring a company’s performance.

First, he does not believe in focusing on earnings per share (EPS)—a common metric many investors rely on. He explained why:

"Earnings per share, of course, increased somewhat (about 20%) but we regard this as an improper figure upon which to focus… 'Earnings per share' will rise constantly on a dormant savings account or on a U.S. Savings Bond bearing a fixed rate of return simply because 'earnings' (the stated interest rate) are continuously plowed back and added to the capital base. Thus, even a 'stopped clock' can look like a growth stock if the dividend payout ratio is low."

In plain terms, Buffett is saying that EPS growth can be misleading because it doesn’t necessarily indicate a company is actually improving or becoming more efficient.

For example, suppose Company A earns $100 million and retains all of it, reinvesting at zero growth. If next year it earns $120 million, EPS might rise 20%, but that doesn’t mean the business itself became better—it just added retained earnings back into the business.

Instead of EPS, Buffett prefers return on equity (ROE) as the true test of a company’s quality.

ROE is the holy grail of quality

ROE measures how efficiently a company generates profits from shareholders’ equity. It’s calculated as: 

ROE = Net Income ÷ Shareholder Equity

Buffett calls ROE "the primary test of managerial economic performance" because:

1. It’s harder to manipulate with accounting tricks.

2. It shows how well a company generates profits relative to the capital invested.

3. It filters out companies that rely on excessive debt to boost earnings artificially.

This is why Buffett doesn’t start with P/E ratios when evaluating stocks. Instead, he looks for high ROE and strong economic moats before considering valuation.

On that note - Buffett loves businesses with wide economic moats—companies with durable competitive advantages that allow them to maintain profitability over time. Most of these by nature tend to be high ROE, high margin businesses. 

Examples include:

• Railroads, which are oligopolies with high barriers to entry. For example, Union Pacific has a 41.46% operating margin and a 42.60% ROE. 

• Strong consumer brands, like Coca-Cola, which has an operating margin of 24.83% and an ROE of 39.55% today.

These characteristics ensure sustainable profit margins and long-term pricing power, making them ideal "wonderful companies" under Buffett’s framework.

Yes, they’re not cheap by any means, but you don’t go shopping for houses or cars based purely on price—you look for quality, something built to last. A home in a great location or a reliable car that runs for decades is worth paying up for.

Equities aren’t any different. The goal isn’t to find the cheapest stock but to own the highest-quality businesses that you can hold through thick and thin.

Quality access control firms

Before we go over some potential candidates, get this in your head—focus on quality first, price later. This mindset will save you from bag-holding bad companies that look cheap for a reason. If you want quality, expect to pay a premium and recoup that from a long-term hold.

Here’s a list of some access control firms from my screener. 

As per Buffett’s philosophy, the primary checks are:

1. High ROE—at least 10% to ensure the business generates strong returns on shareholder capital.

2. Double-digit gross margins—indicating pricing power and operational efficiency.

You'll also notice two additional metrics added:

1. Altman Z-Score—a financial model that predicts bankruptcy risk using liquidity, profitability, leverage, and market value metrics. A score above 3 is generally safe.

2. Piotroski Score—a 9-point fundamental scoring system evaluating profitability, leverage, and operating efficiency. A score of 7-9 signals a company in strong financial health.

These composite measures help filter out weak businesses that might look good on surface-level metrics like P/E but have underlying financial instability. If you're looking for high-quality, durable businesses in access control, these are the key indicators that matter.

What do I do now?

This is where you, as an access control executive, have the advantage—understanding the business beyond the numbers. Take these four companies. 

Know their products, services, and geographic footprint. Break down what percentage of revenues comes from different types of customers—commercial, government, industrial, or residential. 

Look at recent acquisitions and divestitures to see where the company is heading. Evaluate management tenure, credentials, and corporate culture. Does the leadership team have a track record of delivering value?

We already know from last quarter’s figures that these firms meet the quantitative definition of quality. But now, you need to qualitatively assess what’s driving this quality.

1. Is it sustainable or a one-trick pony?

2. Does the company have a strong moat, or is it vulnerable to disruption?

3. What does the competitive landscape look like in 5, 10, or 20 years?

Another option is the lazy way—assemble a basket of 30+ access control stocks with high ROE and strong operating margins and rely on the group as a whole to perform well over time. But the issue? Access control is a narrow sector. There aren’t enough publicly traded companies to diversify away the risk.

That’s why deep business analysis is crucial. Understanding the qualitative factors driving these companies' success is the difference between owning a long-term compounder and chasing a stock that looks good on paper but fades over time.

Join John Morris, a security expert and Access Control Executive Brief Member, as he exposes flaws in widely-used access control systems. With 15 years of experience evolving from commercial electrician to security application engineer, John delivers a compelling demonstration of how the Wiegand protocol puts your facility at risk.

Watch it here or click the image above.

In this exclusive technical breakdown, you'll witness firsthand:

• How unauthorized individuals can secretly harvest badge credentials

• The ease of simulating access cards and fooling readers

• Methods criminals use to create false access logs and cover their tracks

• Real-world techniques that can completely disable door security systems

Don't let outdated technology compromise your security. Learn why leading organizations are abandoning Wiegand for the superior OSDP protocol, and what steps you need to take to protect your facility.
Perfect for: Security professionals, facility managers, IT administrators, and anyone responsible for physical access control systems.

I woke up this morning to a cold, snowy and as Winnie the Pooh might say, blustery day here in Nashville today. You see, I am in the early riser club, and even if I didn’t want to, my sweet pups would not allow me to sleep in, strategic alarm clocks, laughing. One of my practices in the morning, as I get my coffee is to look out my window where I have my bird feeders stationed to watch the feeding folly. I try to keep my feeder’s full in the winter to allow my bird’s to fatten up and make it through the winter.  My favorite part watching them though is the two-part process it has. There is probably room for 6 places per feeder times two, which seems like a lot to allow them to grab the good stuff and be on their way.  Now the other 20 plus birds, sit in the tree next to them, patiently waiting for their turn, chirping away. So you could almost think of it like a waiting room for birds or for my restaurant friends, the drive thru line! Ha! Where do I come up with this stuff right? 

So, why exactly do I share my bird story and what the heck does this have to do with anything, Angie? I think so many of us can relate to a time when they were sitting on the sidelines, waiting for their turn to engage or impress, to take the field for the touchdown or get the bat to swing for the fences? Some of the most important lesson’s I have learned being an impatient sales lady, I almost added very, laughing, is really the key to success and timing, and I would add perfect timing. Timing to wait for your dream job, timing to be introduced to the company that is number one on your list of prospect’s, timing to present your amazing, revolutionary product  that will rock their world. Sorry folks, I don’t agree that patience is a virtue, I think the lesson for us to embrace here, is to learn to recognize the right timing and perfect timing if you have the muscle. Let me unbox this a bit for you.

Let’s just ask. Have you ever jumped the gun on something, or realized you might have blown that shot of a lifetime to tell your story “ Why YOUR product or company and Why they need it now?” Instead of making the hard but alternate choice to breathe, take time to prepare yourself for that moment by even saying something like “I would love to be able to tell you more, but I feel the best opportunity for you to get the full value and picture of what we do best, would be if I assembled the right team and time for that works for you. This would allow us to get a better understanding of your goals and needs that might align with our product.”  Hmmm, that sounds good doesn’t it? Now, full disclosure, there were many times, the two ears, one mouth rule, on listening and not talking, have flown way past me, with me blurting out my thoughts, ideas, etc. wanting to convince someone to take that next step with me on the fly. I would also admit, I have lost some wonderful opportunities by doing just that. Maybe that is why sadly I am not sipping a mojito on an island somewhere! So sad for me. My older self today though would tell my younger self, Angie, slow down, wait for right timing by being better prepared with a better understanding of your audience and their issues. Now, wait a minute? Isn’t that discovery in sales or really anything to have the best results? Laughing, it sure is, and great discovery that prepares you to know your audience and their need’s, with solid prep and timing. How many people do you know that get on the phone and just kind of wing it, hoping someone picks up, not really know what they are going to say? Tsk, Tsk! A lot of people, and I am in the mix sometimes, thinking my charm will just win them over, but in reality, it can be annoying and really like shooting blind in a barrel.  Look at me throwing that southern mantra your way! Really though, timing, a prepared audience, great discovery before you wait to come off the sidelines, swing for the fences and get your shot, is going to lead to much higher ratio of success and build a solid relationship bridge. You see in life, nature always learns first, just like my birds, timing is everything to get what you are waiting on the sidelines for. Just keep practicing! 

I think that’s good, right? So, let’s start here, what does my favorite

CoPilot say a security integrator is? Well, their definition is “a company or individual that designs, implements, and manages security systems for various clients. These systems can include physical security products like surveillance cameras, access control systems, and alarm systems.” They also say, “security integrators typically assess a client's specific security needs,” or we use to say, develop a technology and solutions roadmap based on need and budget. You see integrators using a food analogy, are the middle of the cookie, in between the manufacturer and the end user or client. It was our job to take the product from our product toolbox, and design a plan, scope, and solution, to provide exactly what our amazing discovery had told us the client needed and could afford with a solid ROI. Shazam! Laughing, I wish it had been that easy, but truthfully, when integrator’s do it well, you have a high rate of success for your manufacturer partners and your clients.

So if you read my superhero story last week, and you follow the same line of thinking as in the Marvel Universe of Security, the integrators are the ones deciding which superhero to send, or deploy, based on their strengths and abilities to bring home the win. The win for the company, as well as the client, is a fully integrated solution that always catches the bad guys. Now, I think am stretching this theory a bit, but there is always room to include integrators in my Marvel Universe, because I say so, laughing.

The real subject that Lee touched on, and hit a good nerve, was does the name today, security integrator, really do it justice, and why are we not seeing that evolve to reflect the role they play in our industry. Hmm, this is such a great topic, and my original two cents was nobody wants to blaze the trail in fear it won’t be followed by others. Let’s face it, we are all followers in some capacity. Now, there is so much more here, but that was my gut instinct when I read the question. I also feel like an alternate description of an example like System’s Engineer or Solution Architect’s, etc. may be too limiting for some and be a stretch for other’s that haven’t developed all those muscles quite yet. In saying this, I feel like with the evolution of the single pane of glass, and all the disparate technologies that are in need of integration on one or few platforms, will require a superhero! You see how I just wove that in, laughing! But seriously, regardless of the name you choose, I have heard the ugly rumor that security integrators may not be needed like they used to be, and that is the biggest fallacy out there. Trusted advisors leading solution designs, technology roadmaps, project management, with stellar service and installation teams will always be needed, regardless of what you decide to call them. It’s really what they deliver to foster and advance their technology partners and provide the end user with the best-in-class experience that has been sold and asked for. I am not saying security integrators might need some rebranding, but the name needs to be a close to one size fit’s all, and in today’s world, that just might be hard to find.

Many of us today have heard of the concept of a Digital Twin.  It has become a buzzword, and like most buzzwords, what it is has gotten lost in translation.  Is it a product? Yes, for many it has become a product.  Is it a methodology?  Yes, again.  Are they three-dimensional?  Some, not all.  Digital Twin technologies can come in forms from dashboards to three-dimensional floorplans; from static to interactive.  Digital twins may not “look” like the system they represent, but can still be a digital twin of data.  The concept of a Digital Twin is that it is a business-solving framework, a component to most digital transformation mindsets.  The biggest takeaway is; that just like training AI models, good data in = good data out (within reason). The correlation is bad data in=bad data out.

Digital Twins are being used in almost every business today 

Officially, a digital twin is an integrated data-driven virtual representation of real-world entities and processes, with synchronized interaction at a specified frequency and fidelity – As defined by the Digital Twin Consortium (https://www.digitaltwinconsortium.org/).  The concept of Digital Twin is a maturity model; moving through descriptive, diagnostic, predictive, prescriptive, to autonomous.  Digital Twin technologies; the actual product itself that the user can touch, feel, and see can cross six different data component layers.  

Okay, the brain hurts; right?

Don’t worry, it's going to get better.  First off, let’s start out with an easier definition.  Digital Twins are a digital representation of a physical asset that can be interacted with throughout the entire lifecycle – design, build, operation, and refresh – Jon Polly, Security Business Magazine, August 2021.  Anything connected to the corporate network becomes an asset that can be viewed, manipulated, etc. as part of a whole system, without giving up control of the actual subsystem.  

Next, what really is a digital twin when it comes to the security industry, and why does it really matter?  Well, for starters, in my opinion, Digital Twins are how data-driven companies will use physical security data for… another buzzword, wait for it… Business Intelligence.  While security departments will use security technologies, businesses will use Digital Twin interfaces to interact with ALL connected subsystems.  

Let me explain.  Many enterprise security technologies work with other security industry technologies.  The Internet of Things (IoT) is still somewhat foreign to the security industry.  Sure, some technologies are adopting IoT, cloud, and a host of other technologies, but they are not adopting integrations with these technologies.  This leaves companies, especially those with… wait, another buzzword… Digital Transformation mandates or the removal of organizational silos of data; such as IT, Security, HR, and Facilities/Engineering as examples.  This is where Digital Twins are finding adoption expeditiously across enterprises.  Companies are utilizing a single interface software; be it a three-dimensional floorplan, or just a dashboard of data that provides a virtual representation in real-time, these Digital Twins are where all IP-connected technologies connect and work together.  

The access control and video management systems (VMS) are not going away anytime soon, but they may be relegated to the security operations center.  This, while the rest of the organization uses the Digital Twin platform to correlate the data from the access control system, the VMS, building management systems, HVAC, IT server room sensors, and the list goes on; allowing the company to have a better understanding of the holistic technology subsystems it is built upon, allowing more data sharing and faster response times internally while not affecting the actual systems.  

If this report provided you insight and you would like to know more about this technology or other security technologies in our industry, we encourage you to reach out to Jon Polly directly at jon.polly@protechtsp.com or find him on LinkedIn at http://www.linkedin.com/in/JonPolly.