Threatmatic · Physical Security & Building Systems
Take a mid-size hospital campus — a few hundred cameras, hundreds of badge readers, one lean IT/security team. Threatmatic doesn't manage the cameras. It secures the network underneath them, and it does it in hours, not the months a legacy vendor-VPN'd rollout takes.
01
Every camera vendor sells camera management. Every access-control vendor sells badge management. What nobody's selling is security for the network all of it actually runs on — because that network was never the product. It's the thing installers wired up once, years ago, to get the cameras talking to the NVR and the badge readers talking to the panel, and then nobody touched again.
That's the actual gap: not smarter cameras, a secured network underneath them — and for a campus that size, with a security team that lean, “secured eventually” isn't really an answer.
02
A legacy rollout on a hospital campus this size means a VPN concentrator provisioned per vendor, a firewall change-control ticket per building, and a site visit scheduled around whichever integrator installed the equipment originally. None of that is slow because anyone's being careless — it's slow because every step depends on someone else's calendar.
Legacy vendor rollout
6–8 weeks / site
Threatmatic
Hours, same session
03
The shape of it, once deployed: cameras, an NVR, badge readers, and a command center, each carved into its own zone — not one flat subnet shared by everything on the campus:
Zones · illustrative hospital campus
Each zone reaches only what it needs to — a camera reaching the NVR can't also reach the badge panel, even though both sit on the same physical switch.
The policy underneath the “Cameras” zone is the exact shape Threatmatic ships today — two lines, not a firewall project:
Cameras → NVR
egress · 10.10.2.0/24
Cameras — Deny All Else
egress · 0.0.0.0/0
04
Building-system vendors routinely ask for standing remote access to maintain their own equipment — a VPN concentrator, a static rule, an inbound port held open indefinitely for whichever integrator installed the NVR. Every one of those is a door left ajar long after the installer's truck leaves the lot, and every one of those is a provisioning step that turns a same-day rollout into a months-long project.
Threatmatic's own architecture already answers this — see The Network That Disappeared: no VPN server, no flat network, nothing listening for an inbound connection it didn't ask for. A vendor gets exactly the access a policy grants, over an outbound-only encrypted channel — not a standing hole in the perimeter, and not another provisioning ticket in the queue.
05
Physical security teams want occupancy and motion signal for automation and alerting — not another video feed to stare at. Testing against real RTSP capture from Threatmatic's own camera lab showed this is answerable from RTP traffic shape alone, without decoding a single frame:
That signal comes free from traffic Threatmatic is already watching for security reasons — a building management system can act on it without a camera vendor's video-analytics add-on, and without the privacy question of a third party watching the feed at all.
A legacy rollout is still waiting on a vendor's calendar.
This campus was done before lunch.
Threatmatic · physical security is a network problem