Cybersecurity Insights from FieldHub Build25: What Security Integrators Need to Know

We’re still buzzing from the incredible conversations at FieldHub Build25 in Baltimore. While we spent most of the conference diving deep into platform updates and industry trends, we wanted to do something a little different this year – and it turned out to be one of the most valuable sessions we’ve ever hosted.

We brought together an absolutely stacked panel of cybersecurity experts (their words, but we completely agree): Michael Sussman, who chairs Fenwick’s privacy and cybersecurity practice and was one of the earliest leaders in the field; Laura Galante, former director of the Cyber Threat Integration Center; and Jon Lenzner, former chief of staff to the FBI director. Alexis Serfaty, Director of Geo-Technology at Eurasia Group, moderated what became one of the most engaging and practical security discussions many attendees had ever experienced.

The Basics Still Matter Most

Michael’s opening caught many in the room by surprise. Despite his experience handling major intrusion cases for some of the biggest companies out there, he explained that the most common culprits weren’t sophisticated AI-driven attacks or nation-state operations, but simple human errors and overlooked fundamentals like multi-factor authentication. His advice? “If everybody paid attention to the basics, 80% of the problems would go away.”

So what are these basics? Think multi-factor authentication on every account, regular software patching, proper network segmentation, good logging practices, and meeting standard compliance frameworks. These aren’t exciting or cutting-edge, but they’re exactly what stops the majority of attacks before they start.

It’s kind of a big deal – and a relief – that we don’t all need to become cybersecurity PhDs to significantly improve our security posture. Focus on getting the fundamentals right, and you’re already ahead of most targets that attackers will simply move past in search of easier prey.

Physical Security and Cybersecurity Are the Same Team

Laura shared a point that really resonated with everyone. She reminded us that our adversaries don’t distinguish between physical security and cybersecurity — and that matters for all of us. Whether you’re installing cameras, access control systems, or monitoring equipment, you’re operating in both worlds at once.

She shared a fascinating (and slightly scary) story about water system attacks in small towns across America. The takeaway? Assuming you’re “too small” to be a target is dangerous thinking. These attacks often come through unsecured vendor systems and third-party connections – exactly the kind of networks we work with every day.

Third-Party Risk Goes Deeper Than You Think

Michael introduced us to the concept of fourth and fifth-party risk (yes, really). Here’s how it works: you have a vendor, your vendor has a vendor, and that vendor’s cloud provider gets breached. Suddenly, your customer data is compromised, and you have no contractual relationship with the actual breach point.

The solution? Flow-down requirements. Make sure your vendors commit that all security obligations flow down to anyone they work with. It’s a straightforward concept that can save you from serious headaches down the road.

When Ransomware Hits (Notice We Said “When”)

Jon from the FBI shared something sobering: “Everybody will get hit by ransomware at some point if they haven’t already.”

The good news? The FBI genuinely wants to help, and they’re victim-focused. Jon emphasized building relationships with your local FBI field office before you need them – not after. Companies with pre-existing FBI relationships resolved incidents in hours rather than weeks.

But here’s the kicker: even if you pay a ransom, there’s no guarantee you’ll get your data back, they won’t sell it on the dark web, or they won’t target you again. The best defense? Really good backups that let you restore operations in 24-48 hours without paying a dime.

Hardware Matters More Than You Think

Laura’s discussion about Chinese-manufactured devices was eye-opening. While not every Hikvision camera is actively being used for espionage, Chinese companies are legally required to report vulnerabilities to their government. That’s not speculation – it’s written into Chinese law as of 2017.

The panel’s advice? Understand what you’re installing, document your security controls around those products, and maintain relationships (like with the FBI) who can alert you if compromises are detected in products you’re using.

Moving Forward Together

We’ll be sharing more detailed insights from this session in future updates (AI’s impact on cybersecurity alone could be its own article). For now, we wanted you to have these practical takeaways that can genuinely help protect your business and your customers.

We’re excited to continue these conversations – they’re exactly the kind of real-world, actionable content that makes our community stronger. Let us know what resonated most with you, and what other topics you’d like us to tackle at future events on the FieldHub Community Discourse.