The Seven Doorways.

A hospital security director's first encounter with your company is almost never a phone call. It's your website, read alone, on his schedule, usually after an incident or a budget approval has already put the problem on his desk. And in the first thirty seconds he is running a single test, whether he'd name it or not: does this company understand my world, or does it see a building with doors and cameras?

Most integrator websites fail that test in the first paragraph — not because the firm can't do the work, but because the page leads with the work. Access control. Video surveillance. Managed services. All real, all necessary, and all beside the point at the moment the director is reading. Because the pressure that brings him to you is rarely "we need cameras." It's something further upstream, in a world most integrator pages never enter.

We spent a long time mapping that world — researching what hospital security directors actually deal with day to day, then checking it against the standards they answer to and the practitioners who live it. It resolved into seven recurring pressures. We call them the seven doorways, because each one is a way a real conversation begins. They are below, in full. And in keeping with how we do everything: don't take our word for it. Ask a security director which of these keeps him up at night. The list will be familiar to him long before he finishes reading it.

Here is the part worth sitting with as you read. Watch how many of the seven your own healthcare page speaks to — and how many it's silent on.

Workplace violence and staff safety

The single fastest-growing pressure in the building, and the one that has turned security from a facilities line item into a boardroom conversation. Healthcare workers are assaulted on the job at rates far above most industries — enough that the Joint Commission wrote workplace-violence-prevention standards specifically for hospitals. But the director's problem isn't a statistic. It's that his nurses don't feel safe, an assault in the ED becomes his to explain, and the tools he was handed are a panic button that pages an understaffed office and a lockdown plan that lives in a binder.

And notice how wide his responsibility runs. It doesn't start when a fist is already swinging. It starts upstream — the behavior that was escalating for a week, the threat somebody reported and nobody routed, the restricted visitor who should never have been let back onto the floor. Then it runs through the moment itself — duress that reaches someone who can actually respond, weapons detection that fits a come-as-you-are front door, lockdown that can coordinate across a campus the size of a small town. And it doesn't end when the incident does. Afterward he owes a record: what happened, who was notified, what changed so it doesn't happen again.

A page that says "we offer panic buttons" has answered the smallest slice of that. A page that understands the arc — recognize, respond, and learn — is speaking to the person the job has made him. One honest boundary worth keeping in view: the prevention program itself — the threat-assessment team, the de-escalation training, the counseling after — is the hospital's to run. The integrator's job is the technology that makes all of it work: the reporting that reaches the right desk, the duress that finds a responder, the restricted-visitor flag enforced at the door, the record that holds up later.

Access, screening and visitor flow

A hospital is porous by mission. It cannot lock its doors the way a bank can — people arrive frightened, at all hours, needing in. So the director's version of access control isn't "keep people out." It's "how open is my building, really — who gets in, what gets screened, where can each person go, and can I prove it later?" The pharmacy, the NICU, the records room, the loading dock — each is a decision about who belongs, and every one of those decisions has to be defensible when someone asks.

Where it breaks is rarely the hardware. It's the propped door at shift change, the access rights that were never revoked when the contractor left, the weapon that walked in through an entrance nobody was screening, the moment Risk and Legal ask for the entry record and there isn't a clean one. And it's the question that sits underneath all of it: when something goes wrong two buildings over, how fast can the whole facility change state — from open, to restricted, to locked down — without stranding a patient who still needs to get to the ED? OSHA's healthcare guidance is blunt about the everyday version of this: sign-in procedures, visitor passes, enforced visiting hours, a restricted-visitor list the front desk actually holds. The director who has lived the gap reads a page very differently. He isn't shopping for readers. He's looking for someone who understands the documented decision trail — and the switch that flips the building from welcoming to sealed.

Security operations and system resilience

Most directors inherited a patchwork: three video platforms from three eras, a card system nobody fully documented, cameras that may or may not be recording tonight. But the deeper pressure here isn't any one device — it's whether the whole chain holds when it's needed. A camera can be working while the response still fails. The alarm fires — did it reach a person who could act? Did the location make sense? Did the video pull up on its own? Could dispatch talk to the responder? Did the door do what it was told? And when the network hiccuped or the power dropped, did the system fail loudly, or did it fail silent and nobody knew until morning?

This is the doorway that separates an integrator who sells boxes from one who understands operations. The director doesn't want more systems; he wants the fragments he already has turned into something single, verifiable, and accountable end to end — detection through notification, dispatch, response, and the record — working under real conditions, including the bad night when half of it is degraded. The failure mode is specific and career-defining: the incident happens, and the camera was down, or wasn't retaining, or produced a clip too degraded to use. A page that talks about "cutting-edge technology" is speaking to a buyer who has been burned by cutting-edge technology. A page that talks about a chain that still works when something in it doesn't is speaking to the person he's become. (This is also where the quiet cousin lives: these systems are on the network now, so their uptime is a cybersecurity question as much as a maintenance one.)

High-risk care environments

Here is where the generic "hospital security" page loses the director completely — because there is no such thing as generic hospital security. His building is a dozen different threat environments wearing one roof, and the rules change as you move between them. The Emergency Department, with its violence, its flow problems, its exposure after dark. Behavioral health, where the concerns are elopement, ligature risk, and contraband, and where the wrong fixture is a life-safety finding. The pharmacy, where the threat is internal — diversion of controlled substances and the DEA trail that has to hold. Maternity and the NICU, where the nightmare is infant abduction, and the answer is arm-banding, egress control, and a code that has to work the first time. And running across several of these at once: the patient who wanders or elopes, which isn't a place so much as an event that can start anywhere.

Each of these has its own regulatory weight and its own way of failing — and federal armed-assailant planning guidance points past the obvious five, to the forensic or incarcerated patient, the high-profile admission, the gunshot-wound arrival that brings the street in with it. A director scanning a page can tell in a sentence whether the firm knows any of this. "We serve hospitals" tells him nothing. Naming elopement, or the pharmacy diversion trail, or infant egress — even once — tells him he's talking to someone who has walked the units, not just the lobby. This is the doorway a director is most likely to enter through, because he'll come in on whichever environment is consuming his attention this quarter — and that's fine. Meet him at the one he's carrying; don't presume to tell him which of his risks is biggest.

Incident response, investigation and evidence

This is the doorway almost no integrator page enters — and it's the one the director feels most acutely, because it's the doorway that owns the worst minutes of his career. Not the conditions before, and not only the reckoning after, but the event itself, while it's still unfolding.

Play it forward. Something is recognized — a code is called. Now the questions come in seconds, not sentences. Did the right people get notified, in plain language, everywhere they needed to hear it? Did the building move to the right access state — this wing locked, that corridor held open for responders? Is there a place where someone can see what's happening and direct it? Can anyone say, right now, where the patients and staff and visitors are? When the police arrive, can the hospital hand them maps, live video, and access instead of a shrug at the door? And when it's over, there's the part every director already dreads: within hours he's in a room with Risk and Legal, and soon an accreditor, and the question is always the same — reconstruct it, defensibly. What happened, in what order, with what evidence, documented well enough to survive a survey. When the timeline has gaps, when the footage isn't there, when the evidence chain won't hold, the reconstruction becomes guesswork — and guesswork in that room is itself a finding.

Federal healthcare guidance treats an event like this in distinct phases — mitigation, preparedness, response, recovery — and the middle two are exactly where most integrator pages go dark. Here's the honest boundary again, because it matters: running the incident is the hospital's job — the command post, the drills, the care delivered in a hot zone are theirs, and enterprise emergency management is broader than physical security. The integrator's job is the machinery that lets their response work and lets the account survive scrutiny: the alerting that reaches everyone, the lockdown that behaves, the responder handoff of maps and video, the tracking that answers who's accounted for, and the record that holds. A page that speaks to the unfolding event and the defensible reconstruction after isn't selling fear. It's proving it has stood in that room before. And it's standing in a doorway almost none of its competitors have even found.

Planning, construction and commissioning

The pressure most integrators never even see, because it happens upstream of everything they sell. When a hospital builds a tower or renovates a wing, the security scope is either designed in at the drawings — written into the Division 28 specification, set as the basis of design — or it's bolted on afterward, at more cost and a worse fit. The director who has been through a capital project knows exactly which of those he lived, and he can tell instantly whether a firm understands the difference. The healthcare-security design guidelines the field actually uses now call for a security assessment led by a qualified professional at the conceptual design phase — not the punch list.

The failure here is timing, and it compounds. Security gets invited late — at construction documents, to "discuss door hardware" — when it should have been in the room at schematic design, shaping how the floor plan itself protects people. Pathways, power, door hardware, and network capacity get missed. Requirements get value-engineered out by someone who never understood what they were for. Nobody's quite sure whether the architect, the consultant, the contractor, IT, facilities, or security owns the gap. None of this becomes literally impossible as the project moves — but every month it gets harder, costlier, and more disruptive to fix, and the curve is steep. And there's a tail most pages forget entirely: the devices get installed, but were they ever commissioned as a working whole — tested as the operational system the director inherits the day the building opens? Installation ending is not the same as the system working. A page that understands the capital calendar and the handoff at the end of it is speaking to the director's most expensive lesson.

Campus, parking and exterior approaches

The risk does not stop at the exterior wall, but most security pages do. Parking structures and lots are where staff and visitors are most exposed and where coverage is usually thinnest — the walk to the car after a night shift, the sightlines a garage never has, the high-distress hours around an ED entrance that never closes. But it's wider than parking: the transit stop and rideshare pickup, the loading dock, the ambulance bay, the service entrance, the campus road, the remote clinic building, and the plain question of distance — how far is it from where an event happens to the nearest person who can respond, and how much can lighting, cameras, call stations, and exterior lockdown close that gap before help arrives?

The director knows his people are most vulnerable in exactly the places he's historically had the least ability to see, and where the response is furthest away. A page that treats the campus as a real environment — not an afterthought to the building — is speaking to a worry he carries every time a shift ends in the dark. (The odd conditions of a concrete garage — how it swallows radio and scatters sound — are real, and they're a good reminder that exterior technology has to be tested where it actually lives. But that's a detail for the conversation, not the headline. The headline is people, exposed, in the space between the building and the parking space.)

The silence a director notices

Read those seven back and the pattern is hard to miss. Most integrator websites — including the largest and best-resourced in the country — speak to one or two of these doorways, almost always access and video, framed as products. They are silent on the rest. And the silence is not neutral. To a director who lives in all seven, a page that engages two of them reads as a company that sees a building where he sees a hospital.

There's a sharper version of this worth naming. Of the seven, the one about the incident while it unfolds — recognize, notify, lock down, coordinate, account for everyone, then reconstruct it — is the emptiest of all. Almost no integrator in an entire regional market engages it. That isn't a gap to apologize for; it's an open doorway with nobody standing in it. The firm that walks through it first doesn't have to out-shout anyone. It's simply the only one there.

You don't need to out-spend anyone or out-technology anyone. You need to demonstrate, on the page, that you understand the world the buyer actually occupies.

That is the whole game, and it is winnable, because the bar is on the floor. The firm that demonstrates real understanding of the buyer's world is read as an advisor before a salesperson ever calls. The firms that don't are sorted on price, interchangeable, and never know why.

We built an entire study around this — scoring the security integrators in a major market on exactly these axes, the depth and breadth of the buyer's world their pages engage. The finding won't surprise you by the time you've read this far: you can read The Doorway Gap study here. But you don't need our study to act on any of it. Take the seven doorways, open your own healthcare page, and count. Then go ask a hospital security director whether we got the list right.

We'd welcome the chance to help you close the gap. You don't need us to see it.