The Doorway Gap

We are not a neutral party. So check us.

We are not a neutral party, and you should not view us as one. SMR builds vertical-specialist marketing and sales programs for security integrators. So a study that we conduct that finds gaps in industry practices that we can fill supports our business. On its face that is a clear conflict of interest. Which is why we do not ask or expect you to trust us from the outset. We only ask you to read with an open mind and, most importantly, to confirm our work for yourself.

So the whole instrument is in the appendix — the six things we scored, the anchors we scored them against, and the seven buyer-focused pressure doorways we scored them through. You can run it yourself on any integrator's site, including ours, in about 10 minutes. And we highly encourage you to do just that. It may be the most business-advancing work you do this week. Where we credit an integrator, we do so anonymously. Where we find gaps or faults, we name no one. And as always we turn the instrument on our own work and publish what it found. In this case that includes a compliance citation of ours that needed fixing, which is the single thing we mark other firms down for hardest.

And that's the entire point of these studies. To identify current gaps and provide you with the means to close those gaps. This better serves your buyers and creates more opportunities and competitive advantage. But only for those few willing to take the time to read and apply the results.

The median firm opens one doorway. Zero give first.

A hospital security director does not carry one concern. They carry at least seven:

• Keeping staff safe when a patient, visitor or intruder turns violent.
• Controlling who moves through which door.
• Keeping the systems standing when the power isn't.
• The high-risk units — the emergency department, behavioral health, maternity, the pharmacy.
• What happens in the hour after an incident.
• The security decisions baked into a building or a renovation.
• The grounds, where the day's highest-distress moments often happen in the dark.

Real healthcare-security expertise is the ability to speak to those concerns in the buyer's language, in the order the buyer meets them, where the buyer actually lands.

Across 48 enterprise-capable Texas integrators, scored only on the content a buyer reads, the field does this thinly. The median firm genuinely engages one of the seven doorways. A real minority demonstrate genuine expertise, which matters, because it proves the bar is clearable by ordinary firms with ordinary budgets. But on the one move that turns a page into a relationship — giving the buyer a tool to diagnose their own building before any sales conversation — the field is unanimous in the other direction. Zero of forty-six put an ungated, buyer-run diagnostic in the buyer's path.

This is not a competence gap. Texas has excellent integrators. It is a gap between what these firms know and what their websites are willing to say and give — and it is, for the firm willing to close it, the widest and quietest opening in the market.

Key findings

• The median firm engages one doorway of seven — and at a depth we score a 2 of 10: enough to name a concern, not enough to teach a decision about it.
• Zero of forty-eight give first. Not one firm places an ungated, buyer-run diagnostic in the buyer's path — the single finding that survives every caveat. Why this matters →
• A strong minority clears the bar, demonstrating authentic expertise — proof the standard is reachable, and that the gap is one of recognition and will, not capability.
• Integrators aren't inventing compliance rules — but they are citing the wrong ones. They point to the standards from the trades they grew out of — fire alarms, cybersecurity, weapons screening — instead of the hospital-accreditation rules the security director actually has to meet. And even those few mentions are already out of date, because the Joint Commission renumbered all of its standards this year.
• The strongest pages still end at a contact form. Even the best firms in the field give the buyer nothing to use before the ask — the empty middle where a relationship could start goes unclaimed.

The natural question, reading this, is the one worth sitting with: where would our own site land? This report is built so you can answer that for yourself — the instrument is in Appendix A, published in full and free to run.

The website is no longer just a passive online brochure. It has now become the all-important first round of the sale.

The security director who will spend six or seven figures on an enterprise system does most of their evaluation before they ever ask for a consultation. They read, they compare, they form a shortlist — alone, on their own schedule, on their phone or computer between meetings. By the time a firm hears from them, the field has already been cut, and it was cut on the strength of what each website said about how well the integrator understood the buyer's own world and concerns. Why this matters →

That changes what a website is for. It is no longer decoration around a sales process. It is the sales process, in its first and most decisive round. And it means the questions that used to be settled in a discovery call — does this firm actually understand my world? can they help me think? — are now being answered, or not answered, by an integrator's website content. This study asks how well Texas integrators answer them.

Security directors search for seven ways in. Most integrator sites only provide one.

We did not invent an abstract rubric. We took the seven concerns a healthcare security director actually operates against and treated each as a "doorway" — a distinct way a buyer might arrive at a page already worried about something specific.

The critical distinction, and the one most sites fail, is between naming a doorway and engaging it. A page that lists "healthcare" among ten industries has named nothing. A page that says "we secure hospitals, clinics, and senior living" has named three building types, not three concerns. A doorway is engaged only when the content demonstrates that the firm understands what happens behind it. Most of what looks like healthcare content in this field is naming.

Two questions each page has already answered.

We set out to measure two things, and only two. First: across the seven doorways, how much genuine expertise does a Texas integrator's healthcare content demonstrate to the buyer who lands on it? Second, and sharper: does any firm give the buyer something of real value — a tool to understand their own situation — before asking for a name, an email, or a call?

The first question measures depth. The second measures generosity, which in a field of near-identical capability is the rarer and more decisive signal. A buyer cannot easily tell two competent integrators apart on their claims. They can instantly tell apart the one that helped them think before it asked for anything.

Forty-eight enterprise-capable integrators, across five Texas metros.

We assembled the set from the security integrators operating across Dallas–Fort Worth, Houston, Austin, San Antonio, and the surrounding metros that carry a signal of enterprise-level capability — the ability to sell and support the kind of system a hospital buys. A firm did not need a healthcare page to be included; the absence of one is itself a finding. We excluded pure guarding companies and product manufacturers, which play a different game. The result is 48 firms — the realistic competitive field a Texas healthcare buyer would encounter — plus the demo site we built to test our own thesis, scored separately and never blended into the field's distribution.

We scored the words, not the brand.

The hardest problem in a study like this is that a famous name reads as credible before it has said anything. To measure expertise honestly, we had to remove the halo. So each firm was scored under a controlled condition: proof points, client logos, company scale, awards, and third-party references were set aside, and only the substantive content — the actual explanation offered to the buyer — was read. A national brand and a two-person shop were scored on identical terms: what did the page teach? This is why a well-known firm can score low here. We did not score reputation. We scored the content a buyer reads once the reputation gets them to the page.

A profile, never a grade.

Each firm's content was scored 1–10 on six independent axes: breadth (how many of the seven doorways it engages), depth (whether it teaches a specific decision or recites an equipment catalog), sequence (whether it diagnoses before it prescribes), advisor stance (whether it equips the buyer to decide or just lists products), compliance currency (whether it cites the right standards, correctly, and current), and lane discipline (whether it stays honest about what security can and cannot do).

We report these as a profile, never averaged into a single score. A firm strong on breadth and weak on compliance is a different firm from one with the reverse, and a blended number would erase exactly the distinction a buyer — or the firm itself — most needs to see. The full 1–10 anchors for each axis are published in Appendix A.

Two readers, scored blind, reconciled in the open.

Every firm was scored independently by two different AI models — Anthropic's Claude and OpenAI's GPT — and their scores were reconciled line by line. Using two different models was deliberate. Two independent readers catch what one misses, and two different models catch what a single one is blind to. It's slower than one pass and far more honest, because the disagreements are where the errors hide. Where the two didn't agree, we didn't split the difference and we didn't default to the lower score — we took the read that was better grounded in the firm's actual content, or in the correct reading of a standard.

In practice, each model caught the other. One held the line on what counts as real depth; the other caught overreach the first had let slide. Several firms we were ready to fault, we cleared on a second look, because the fault turned out to be on a page a buyer would never reach. A wrong mark against a named firm was the thing we feared most, and we built the process to catch it.

And here's why the choice of evaluator matters to you, not just to us. These are the same kinds of AI models your buyers are now using. When a security director asks an AI assistant who to trust for a hospital project, that assistant reads your site much the way ours did — and answers from what it finds. So this study isn't only our read of your content; it's a preview of how the machines that increasingly stand between you and the buyer actually see you. That shift has a name — Generative Engine Optimization, or GEO — and it's something every integrator needs to be on top of. Why this matters →

We name no competitor. Not the weak. Not the strong.

This is a deliberate departure. We do not pillory firms in public, and we do not try to build our credibility or create business on someone else's exposure. Every competitor in this study is anonymous. When we say the field's best "grounds" content came from one firm, or that one of the largest security companies in the world posts a page that fails on mobile, we mean it precisely. And we will show the private report to the firm in question — but we will not name them in a study. If you want to know exactly where your firm landed and why, that scorecard is yours for the asking, privately. The only site we name in this study is our own. And by privately we don't mean you need to have a meeting with us to see it. Simply ask for it and we will provide it behind a password-protected area for your eyes only.

What this study is, and the four things it is not.

It is a point-in-time read; websites change, and a firm thin today may deepen tomorrow. It measures content, not capability: a firm may be superb in the field and silent on the page, and several here plainly are — the gap we measure is precisely between the two. Individual scores carry more uncertainty than the distribution; the shape of the field is robust, any single placement less so, which is why we publish the instrument so a firm can check its own. And it makes no claim about sales results, win rates, or customer satisfaction — only about what the buyer's-path content demonstrates.

Zero of forty-eight give first. This is the finding that survives every caveat.

Everything else in this study is a distribution — some firms higher, some lower, honest disagreement possible at the margins. This one is not. Of the 48 firms, the number that place an ungated, buyer-run diagnostic in the buyer's path — a tool that lets a director assess their own building and reach their own conclusion, with no email required and nothing captured — is zero. One firm gates a diagnostic behind a form, which is the tell: even the single firm that built the tool could not resist charging admission for it. The rest offer product pages and contact forms with nothing in between — the empty middle where a relationship could have started and doesn't.

This is the gap, stated at its sharpest. Not that the field's expertise is thin, though it is. That the field's generosity is absent — that across an entire competitive market, not one firm has been willing to help the buyer before asking the buyer for something. The demo site we built to test the premise puts an ungated self-check at every one of the seven doorways, plus a master assessment — because we wanted to know whether the empty middle was empty for a reason or empty by habit. It is empty by habit.

The median firm engages one doorway, to a depth of two. The field is not close to the buyer's actual need.

Reported as a profile rather than a grade, the six axes show where the field lives on each measure — and how far the strong minority, and our named demo site, sit above it.

Every scored firm, by profile — not by rank.

Companies are numbered arbitrarily (alphabetical by internal ID) — this is not a ranking, and the name key is never published. Six axes, each 1–10, reported as a profile, never blended: A Breadth · B Depth · C Sequence · D Advisor · E Compliance/currency · F Lane discipline. Doors = of the seven genuinely engaged (named ≠ engaged). Give = ungated buyer-run diagnostic before any ask (N; Y-gated = a form is required).

A real minority clears the bar.

A study that trashed everyone would invite the one counterexample that undoes it. This one names, up front, that a real minority clears the bar. A handful of firms demonstrate authentic healthcare-security expertise on the page — one engages the exterior grounds as a genuine operational environment; one teaches visitor-screening with a clinical empathy that only comes from having stood on the unit; one treats workplace violence as a life-safety issue rather than an HR checkbox and says openly that technology alone won't solve it.

We credit them because they matter twice over: they prove the bar is clearable by any integrator, and they sharpen the real finding. Because even these — the best the field offers — do not give first. The strongest pages in Texas still end at a contact form. The expertise, where it exists, still keeps everything and offers nothing.

The field cites the trades it came up through — and it's going stale.

We expected to find a field inventing mandates — claiming requirements that don't exist. We mostly didn't. What we found instead is displacement: the firms that cite competently cite the standards of the adjacent trades they came up through — fire and life safety, networked-systems cybersecurity, weapons screening — and go quiet on the director's own accreditation core, where they name a body loosely or say nothing at all. Genuine invented-mandate overreach turned out to be rare. The more common failure is silence on the exact ground the buyer stands on.

And there is a currency problem the whole field is about to trip over. In January 2026 the primary hospital accreditor renumbered its entire standards framework. Nearly every compliance reference we found still points at the old numbering — correct six months ago, stale today. This is the difference between a firm that knows the standards and a firm that tracks them, and it is exactly the kind of thing a buyer's compliance officer will notice. Current, correctly-pincited compliance content is now one of the cleanest ways for a firm to separate itself, precisely because the field hasn't updated.

Mobile performance across the field is failing the buyer.

Content is the study; the site's raw performance is a supporting read, so we kept it separate and small. We drew ten firms at random — the selection is reproducible from a fixed, published seed, so it is provably not cherry-picked — and ran each through Google PageSpeed Insights, on the same healthcare page a buyer would land on, on both a phone and a desktop.

Our demo anchor was re-measured at 93/100 in a later build pass — see our PageSpeed primer.

The pattern that matters here is the phone. Four of ten firms sit in the failing range on mobile, and the field runs roughly twenty points slower on a phone than on a desktop — the signature of a site built and checked on a monitor and never opened on the device the buyer actually uses. A healthcare director doing their first-pass research between meetings is on a phone, and a page that stalls there is a page that loses before its content is ever read. Performance is table stakes, and much of the field hasn't met them.

The instrument runs both ways.

A study that only found faults would be a lesser study. So we ran the analysis in the other direction too: where does a competitor do something we don't, and can we prove it before we borrow it? We found several genuine lessons — a firm that engages the grounds as its own environment; a firm whose decline to invent a mandate is more disciplined than most; a firm that frames workplace violence as life-safety. Each was verified against the live page before it counted, and two candidates were dropped when the verification failed. This is the same competitive-gap analysis we would run for a client on their behalf, shown here in public, on ourselves. What we adopted from it, and how, is in the next section — because the honest place to apply what the field taught us was our own site first.

Seven doorways engaged; depth that teaches a decision; and something given before anything is asked.

The model the field points at, by its absence, is not complicated:

• A buyer-facing page for each of the seven doorways, written to the concern rather than the product.
• Real depth behind each — not a catalog, but the actual decision a director faces, with the trade-offs named.
• Compliance cited precisely and kept current.
• Sequence that diagnoses before it prescribes.
• And, in the buyer's path, at least one ungated tool that lets the director find their own gap and arrive at their own conclusion — so that the next move, the call, is theirs.

None of this requires knowledge the good firms lack. It requires pointing knowledge they already have at the buyer, generously, and in the right order.

You can run this exact process on your own site. Here it is catching real gaps in ours.

Before we published a word of judgment about the field, we ran the full instrument on our own demo site — the highest-scoring site in the study — and it still found things to fix. A compliance citation of ours pointed at the right regulation but the imprecise sub-section, and getting that exactly right is the one thing we fault others for hardest. Two of our doorway pages named the governing standard generically instead of by its current identifier. A statistic on one page ran without its source. And one page had a genuine content gap — an early-warning concern it didn't address.

That is the honest shape of a real fix. It appears on the axes you worked and stays quiet on the ones you didn't; a profile that jumped everywhere would be a sign the measurement was bending toward the measurer. We hold our own score to the same inter-evaluator-variance caveat we apply to every firm in this study. The value here is not a dramatic before-and-after. It is that the method finds real gaps even in good work, that the fixes are specific and sourced, and that we are willing to show the seams in public.

The reason to show this is not humility for its own sake. It is that this is the exact loop we would run on your site — measure honestly, find the gap, fix it with sourced changes, re-measure — and the exact loop you can run yourself. We are not selling a secret. We are selling the discipline to run an open method rigorously, and the proof that we hold ourselves to it first.

A number with no source is not a fact.

Here is the episode that taught it, and it is the reason to trust the rest. A striking statistic on one integrator's site pointed us toward a genuinely useful idea — the claim that "roughly 90% of physical violence is preceded by verbal aggression." It's a compelling number. We went to use it, and first we went to source it, and there is no credible source for it. So we did not publish it. Then, looking for a sourced version of the underlying truth, we pulled figures from our own research and checked those too — and two of those turned out to be misattributed to studies that never reported them. We kept only what survived: a real, high-quality figure with a citation behind it, and we scoped the surrounding claim to exactly what the evidence supports and no further.

Every statistic on a page you publish is a promise to the buyer, and a buyer's compliance officer can check it. A number borrowed from a competitor, or handed to you by a research tool, is not yours until you have found its primary source.

We tell you this because it is the whole discipline in one story. If you do this work on your own site — and you can — do this. It is slower. It is the entire difference between content that impresses and content that survives contact.

The gap is wide, the top is nearly empty, and the discipline is one the industry half-possesses.

The picture is consistent across every measure we took. Texas has capable integrators. Their websites demonstrate a fraction of what they know, in a field where the buyer now decides on the page. A strong minority proves the depth is achievable. And on the one move that would separate a firm decisively — giving the buyer a genuinely useful self-diagnostic tool before asking for anything — the entire field, including its best, declines.

By design, you already hold what you need to act on this. Here is what we'd do with it:

1. Run the instrument yourself. It's in Appendix A. Point it at your own healthcare content and see which of the seven doorways you actually open. It takes about 10 minutes and is yours whether or not we ever speak.
2. Request your firm's private scorecard. We scored 48 firms; if you're in one of the metro areas covered, it's likely yours is among them. We'll show you exactly where you landed and why. Simply use the form below to request your report and we will set it up for you in a password-protected area. No need to meet with or talk with us.
3. Or engage us to set up and run your healthcare vertical market engine — the study, the market intelligence system, the site, the give-first tools, kept current. But that is the optional step. The method is the gift, and it is useful whether or not you ever speak with us.

Virtually overnight, your website has become the first round of the sale, conducted in your absence. This study is a map of a market that hasn't noticed yet.

The instrument, published in full.

The six axes, their 1–10 anchors, and the seven doorways — published so the study is reproducible on any firm's site, including ours. Copy it, paste it into any AI tool that can browse the web, and point it at your own healthcare content or a competitor's.

How to use it: Copy everything in the box. Fill in the two lines at the top — your healthcare page, and any competitors you want to measure against. Paste it into any AI tool that can browse the web (Claude, ChatGPT, Gemini). Read what comes back against your own page open in the next tab.

Content is half the test. The other half is the machine.

The instrument above measures what your page says. This second check measures how well it's built — and it's just as easy to run yourself. Go to Google PageSpeed Insights, paste in your healthcare page, and run it on both mobile and desktop. It's free, it takes under a minute, and it grades the things a buyer feels but can't name — and that an AI assistant reads directly when it decides whether to trust your site. Understand these scores →

What your PageSpeed report is actually telling you — a plain-English guide to all five checks →

How to see your full profile.

If your firm was among the 48 — and if you're an integrator in one of the metros covered that's very likely — you can request your firm's own report profile. Fill in the form below and we'll set up your report in a password-protected area for your eyes only — no meeting or call required. And no follow up from us unless you request it.

Company name *

Your name *

Email *

Company website — optional

Request my private scorecard

Goes to a real inbox at support@securitymarketing.com. We reply with a private, password-protected link — no CRM, no sales sequence.