Each integration creates value and risk.
A particularly persistent risk in modern estates is the assumption that third-party devices are inherently trusted because they are part of a “known” ecosystem. In reality, trust is rarely earned by association.
Third-party devices often enter an estate through operational convenience: a new camera vendor, a specialised perimeter sensor, or an integration module to connect systems that were never designed to communicate. In many cases, these devices are approved because they solve an immediate problem, not because their cyber posture has been fully assessed.
The problem is that these devices frequently introduce new attack surfaces, including:
Even where devices are well-designed, the way they are deployed can undermine their security. For example, a device may be intended for a segregated security zone, but is deployed on a flat network for convenience, creating an unintended pathway into critical systems.
Trust should be earned through design, evidence, and ongoing verification. In many physical security estates, trust is instead granted through familiarity or convenience. The vendor is known, the device is installed, and the system works, so the risk is assumed to be low.
But cyber risk is not measured by familiarity. It is measured by exposure, control, and resilience.
Secure by Design therefore requires that every integration and device is treated as a potential risk vector until proven otherwise. This does not mean rejecting third-party devices but rather ensuring that they are deployed with appropriate controls, monitoring, and governance.
In practice, organisations can manage third-party risk through a combination of architectural controls and operational discipline:
In large estates, these controls are difficult to enforce without a centralised view. Supervisory platforms such as Datalog QL can help by providing visibility and governance across multiple systems, making it easier to identify where third-party devices connect, what data they exchange, and how they impact the overall security posture.
One of the most overlooked aspects of third-party risk is lifecycle management. Devices are often deployed and forgotten. Integrations remain in place long after they are needed. Credentials are rarely rotated, and documentation becomes outdated.
Secure by Design therefore requires a lifecycle approach:
When lifecycle management is treated as part of architecture rather than an afterthought, organisations can retain the benefits of third-party devices without exposing themselves to avoidable risk.
