Cushman & Wakefield

In the age of cloud computing, mobile access, and real-time data, it’s tempting to think of “cybersecurity” as the only battleground worth fighting on. But as smart buildings become the norm and digital systems extend their reach into every doorknob, lock, and intercom, a more sobering truth has emerged: today’s threats don’t stop at the firewall, and they don’t start with a laptop.

They are unified. And our defenses must be too.

At the convergence of two once-separate disciplines— physical security and cybersecurity—lies a growing vulnerability for multifamily real estate operators. And it’s being exploited not just by hackers behind keyboards, but by smart criminals who blur lines between digital cunning and physical intrusion.

From cloned key fobs to hacked IP cameras, from unattended server rooms to mobile key duplication services, the modern attacker is multifaceted. The only appropriate response is one that matches that sophistication; not with more silos, but with a unified security governance model built for the complexity of today’s portfolios.

Why Siloed Security Models Fail

Historically, physical security lived under facilities or operations while cybersecurity sat with IT. These teams used different tools, frameworks, and KPIs. One side talked about access logs and patrol schedules, the other about intrusion detection and data encryption.

But here’s the problem: threats don’t respect org charts. Imagine a disgruntled vendor walking off with a master key, or worse, cloning it first. Or a smart thermostat acting as a backdoor into your Wi-Fi network. Or a security camera feeding footage to a foreign IP address because no one patched its firmware.

These are not hypothetical risks. They are real-world failure modes that can only be detected and defended if both physical and digital assets are governed together.

Smart Criminals: A Physical Threat with Digital Precision

Nowhere is this convergence more apparent than in the realm of key copying. While our industry focuses on firewalls and phishing, a quiet revolution is happening at the entryway: traditional mechanical keys are being duplicated at scale with tools once only available to locksmiths and law enforcement.

Mobile apps, kiosks, and mail-in milling services now allow virtually anyone to clone keys stamped “Do Not Duplicate.” And in multifamily properties, where vendor turnover, resident churn, and legacy master key systems collide, this creates a persistent, invisible threat.

Worse still, many properties lack a centralized record of key circulation. Who has access? When was the key last used? Has it been copied? These are questions with no answers and high liability.

When a breach occurs through unauthorized key use, the cost isn’t just measured in rekeying fees. It’s measured in resident trust, brand reputation, and potential legal exposure.

Toward A Converged Security Model

To meet this moment, we need more than technology; we need a new playbook. A converged security governance model starts by treating all assets like doors, data, and devices as part of one operational risk ecosystem.

Here’s how we do it:

1. Asset-Centric Risk Modeling: Stop categorizing assets as either “physical” or “digital.” Your access control server, for instance, is both. If a physical breach can lead to a network breach, both must be modeled together in your risk profile.

2. Centralized Policy Management: Compliance with GDPR, CCPA, or SOC 2 isn’t just about your cloud environment. It’s also about how you store camera footage or provision fob access. A single source of policy truth ensures consistency and accountability across domains.

3. Cross-Domain Incident Response: When an incident occurs, both your cyber and physical teams should have defined roles in a shared response playbook. Firewall logs and badge logs should correlate. Escalation paths should be unified.

4. Shared Dashboards and Metrics: Visibility is power. A dashboard that shows badge anomalies next to endpoint activity gives leadership the integrated view they need to act fast and act smart.

“The future of multifamily security will belong to operators who treat physical and digital vulnerabilities not as separate silos but as interconnected threats requiring coordinated defense.”

5. Executive Sponsorship and Budget Alignment: You can’t unify operations with fragmented budgets. Aligning physical and cybersecurity roadmaps prevents gaps, avoids redundant spend, and reinforces governance at the highest level.

Turning Master Keys into Managed Assets

We are not just talking convergence; we’re building it into how we operate. One technology you can implement for this part of this vision is Gatekeeper by Daedalus, a security innovation that transforms the humble master key into a digitally monitored asset.

Unlike smart locks that rely on networks (and introduce their own risks), Gatekeeper focuses on controlling the physical key itself. Using a tamper-proof holster and mobile-based access authorization, the system provides:

• Real-Time Telemetry: Know who accessed the key, when, where, and for how long.

• Behavioral Alerts: Get notified if keys aren’t returned or are accessed at unusual hours.

• Tamper Detection: Prevent unauthorized cloning or forced access attempts.

• Offline Reliability: Works with existing locks. No network dependency, no infrastructure overhaul.

In effect, Gatekeeper doesn’t replace your mechanical locks; it brings them into the 21st century with forensic-grade accountability. It’s a bridge between the analog past and the digital present, and it’s built for operational scale.

Risk, Resilience, and Resident Trust

We’ve reached a point where the costs of outdated security models are too high to ignore. Lost keys and unpatched devices don’t just threaten operations, they threaten people.

But this isn’t just about fear; it’s about opportunity. With the right tools and governance, we can:

• Reduce liability exposure

• Deter sophisticated attackers

• Meet rising compliance standards

• Strengthen operational confidence across teams

• Build smarter, safer, more trusted communities

Our regional property managers, on-site teams, and asset owners deserve the assurance that our defenses reflect the real-world risks they face. And that means not just hiring the best cybersecurity team or the best security guards, but unifying them under one cohesive strategy.

From Reactive to Resilient

Security in multifamily real estate is no longer about fences and firewalls. It’s about orchestration, which is the ability to connect dots, share signals, and act in concert across every layer of risk.

Smart criminals are already converging disciplines. It’s time we did too.

Whether through technologies like Gatekeeper or through unified governance frameworks, the future of multifamily security will belong to operators who can see the whole picture. The ones who treat physical and digital vulnerabilities not as separate silos but as interconnected threats requiring coordinated defense.

In doing so, we don’t just protect assets. We protect trust. And in this business, trust is everything.