A card reader will not fix infrastructure.
Zoned by risk. Cloned by no-one. Auditable forever.
Every door defended against cloning, tailgating, and fire-code failure — with an audit trail that holds up at a Labour Court hearing or a PDPA inquiry.
Five ways access systems become liabilities.
Cloneable credentials.
A Flipper Zero clones a 125kHz EM or HID Prox card in 45 seconds at a coffee shop. Every credential in your building is forensically worthless.
Mag-locks on fire exits.
BOMBA finds it during inspection. The Certificate of Fitness is withheld. Your tenant can't move in. Your liability runs in real time.
Manual offboarding.
Fired on Monday, walked back in on Wednesday week 3, took a laptop. Card was never deactivated. The insider-threat window is two to three weeks.
Tailgating.
One swipe, five people through. Your audit log is fiction. Insurance and PCI-DSS audits fail.
Default admin/admin on the access server.
Port-forwarded for "remote support". Shodan finds it. Ransomware arrives a month later, with the cardholder database.
One counter per pain. One deliverable per counter.
The workshop that replaces door count.
We refuse to quote by door count. Every project starts with a 90-minute Risk Zone workshop. Doors classified Public / Staff / Restricted / High-Security. Credential strength, reader class, lock type, and audit retention matched to each zone.
You sign the Risk Zone Map. We build to it. The map is the contract.
Sample artifacts we will share on request.
Find out what your access system actually proves — before someone else does.
A 90-minute walk of your existing system. A 3-page report covering cloned-credential exposure, mag-lock-on-egress findings, offboarding latency, biometric DPIA gaps, and MFA recommendations per zone.
Findings are confidential and held under PDPA-compliant retention. Used only to scope remediation.
A signed swipe is only as defensible as the system behind it.
Every access deployment converts into an Access Health retainer. Offboarding latency, tailgate events, forced-open alerts, and lock holding-force test results — reported quarterly. PDPA audit logs retained for the legally defensible window.