Close the Path. Keep the Door Working.

ILLUSTRATIVE

It's 11:48 p.m. The badge reader on a side entrance has a normal routine that Findavi learned over weeks: badge events, and conversations with one access-control server. Tonight it starts talking to an address it has never contacted.

• Spot. Findavi sees traffic outside the reader's normal pattern.
• Check. It looks up the device, its owner, the risk and the response rules your team approved.
• Ask. The reader is in Approve mode, so the on-call manager gets one narrow recommendation: limit the reader to its approved server.
• Act. She says yes. Findavi applies the supported action.
• Check security. The unknown address can no longer be reached.
• Check service. Real employee badges still open the door.
• Record. The alert, the approval, the action and both results are kept together for the morning.

Notice what didn't happen. Nobody jammed a radio. Nobody shut the building. One path closed, and the door kept working.

Closing the path is half the job. The door still has to open.

Tested on an operator's equipment

OBSERVED

In a controlled demonstration on an operator's equipment, Findavi detected and stopped a test attack on the RFID system, then a separate test attack on heating and cooling controls.⁶ These were demonstrations, not live incidents. We report them as exactly that.

Every badge system is different

SOURCED

Wireless access deserves its own checks. Testing by Germany's ADAC shows that relaying the signal between some keyless cars and their keys can let a thief open and start the car.⁷ Badges aren't car keys, and badge systems don't all use the same protections. That's the point: each system has to be checked on its own. We confirm coverage for your readers, badges and setup before Findavi acts on them.

When silence is the alarm

Sometimes the warning sign isn't a new connection. It's a missing one. An alarm panel that stops checking in. A sensor that goes quiet.

A quiet device isn't a fixed device. It may be the first sign you've lost the service it provides. Findavi alerts your team when a device drops off your network or its activity changes, so silence gets a human answer.

Two checks. Both must pass.

• Restrict a badge reader. Security: the unknown path can't be reached. Service: real badges still open the door.
• Remove an unneeded vendor modem. Security: the unapproved remote access is gone. Service: required readings still report.
• Change a gateway's factory password. Security: the old password no longer works. Service: sensor data still reaches its system.
• Isolate a remote sensor. Security: it can't reach other zones. Service: monitoring and alarms still report.

If either check fails, or can't be proven, the issue stays open.