Most enterprises run two security functions. One protects the network. The other protects the building, the people, and the executives. They report to different leaders, sit in different budgets, attend different meetings, and speak different languages. The arrangement feels orderly. It is also the single largest structural vulnerability in corporate security today, because the adversary does not respect the line between the two.
Adversaries already operate across the line.
The convergence of cyber and physical operations is no longer a forecast. It is how serious adversaries work now. Criminal groups, hostile state actors, and corporate-espionage operators run blended campaigns: cyber reconnaissance to enable a physical operation, physical access to plant a digital foothold, a disinformation push timed to a planned executive trip. The phases are sequenced deliberately, and they cross the cyber-physical boundary on purpose, because that boundary is where most defending organizations are weakest.
"A cyber breach exposes a home address. The address becomes a physical threat to the family. The two were never separate — only the org chart pretended they were."
When the two functions are split, the seam between them becomes the attack surface. The cyber team sees anomalous logins and treats it as an IT matter. The physical team sees an unfamiliar vehicle near a residence and treats it as a facilities matter. Neither knows the other is looking at two halves of the same operation. The signal that would have made the picture clear is sitting in two inboxes that never meet.
One leader. One picture.
The fix is structural, and it is not complicated. There should be a single chain of command. Both functions report to the same executive — the chief security officer or equivalent — who holds authority over both. Not a cyber leader and a physical leader operating in parallel and coordinating when they remember to. One security leader, with two functions reporting up, accountable for a single, fused threat picture.
That structure does a few things at once. It puts cyber telemetry and physical observation in front of the same person. It removes the negotiation that happens when two co-equal leaders disagree about whose problem an incident is. And it makes compounding visible, because the person reading the picture is reading all of it.
These features are not exotic. They are the basic structure of an integrated security function. They are also rare, and the rarity is exactly the opportunity for the companies willing to build them. The threat has already converged. The defense has to converge to meet it.