The CISO now owns physical security. Here’s what that means for the channel

For years, selling physical security meant knowing one buyer. The director of physical security, or facilities, signed off on cameras, locks, and badge readers, and the conversation rarely left that room. That buyer is being moved aside.

Physical security budgets are rising sharply. EY research found that nearly 80% of organizations increased spending in the last budget cycle, and more than a quarter have now shifted oversight to the CISO, a role built for network defense, not card readers and lockdown logic. The money is growing, and the person controlling it has changed. For Value-Added-Resellers (VARs), Managed Service Providers (MSPs) and integrators, that is the most important shift in this market, and the partners who haven’t adjusted their go-to-market are still pitching buyers who no longer control the budget.

Here is what that looks like on the ground. A reseller who used to walk in with a door schedule now sits across from a CISO who wants to see NIST CSF mappings. An integrator arrives for a campus deployment and finds the cybersecurity team holds policy authority over systems they have never seen up close. Deals that should close stall, because no one in the room feels accountable for a physical incident. The handoff is happening faster than buying committees are used to.

Four things will determine which partners own this shift - and which get left behind.

Who actually owns the budget now?

Map the buying committee before you pitch anything. In most organizations going through this shift, the CISO owns the budget and the risk, but the physical security or facilities lead still owns day-to-day operations. Both are in the room.

If you assume the old buyer is still in charge, you will lose to a competitor who figured out the money moved. Your first job on any new opportunity is to establish who signs, who operates, and who is accountable when something goes wrong. In a convergence deal, those are often three different stakeholders.

How do you earn credibility with a CISO who has never run a physical system?

Learn their language. A CISO does not think in door schedules and panel counts; they think in frameworks, risk, and auditability. When you can map a physical access control deployment to NIST CSF, explain how it changes their attack surface, and show how you would prove it works under audit, you stop being a hardware vendor and become someone they can defend a budget line to.

The mistake we see most often is the reverse: walking a CISO through the technical detail of the physical install. That buyer does not want the schematic. They want to know what risk you remove, what you can attest to, and what happens when something is compromised. Translate physical implementation into security outcomes, and you will be in conversations your competitors never reach.

Where can partners attach services?

The opportunity sits in the gap nobody owns: the space between IT policy and physical implementation.

In the deployments we work on at Acre, that gap is almost always wider than the organization expects. The CISO sets policy, the facilities team runs the hardware, but almost no one owns the interface between them- the integration that decides what the physical system does when the identity provider is compromised, or what happens to a badge when a credential is exposed.

That is billable work, and it recurs: assessments that map physical controls to the security framework, integration between access control and identity systems, and managed services that keep the two estates talking and produce the evidence an auditor will ask for. This is where partners move from one-time installers to retained advisors, which is the more durable revenue anyway.

How do you structure the sale when the buying committee has changed?

Sell to the committee, not the individual. The deals that stall are the ones pitched to one stakeholder while another quietly holds a veto. Get the CISO, the physical security lead, and, often, IT into the same conversation early, and make accountability explicit.

Who owns a physical breach? Who owns a credential compromise that has physical consequences? When you name those owners in the room, you remove the ambiguity that kills deals, and you position yourself as the partner who understands the new org chart rather than the one still selling to the old one.

None of this requires the channel to become a cybersecurity practice overnight. It requires recognizing that the buyer has changed, learning enough of the CISO’s language to be credible, and building services around the integration gap the convergence created.

The partners who make that shift will own the relationship as physical and digital security keep merging. The ones who don’t will keep pitching to a room that’s already moved on.

The budgets are there. The question is: Are your conversations reaching the people who control that money?