Home Insights How we work Contact
Healthcare · After an incident

Security built for the questions that come after — yours.

When something happens, the only questions that matter are what your systems saw, what they did, and whether you can prove it. We build the physical layer that answers them.

The after-state

You know this state, or you are bracing for it. An investigation opens — OSHA, CMS, the state, or your own root-cause review. A family wants answers. Counsel wants a defensible account. The board asks what happened and whether the systems performed. And through all of it, one thing either carries you or becomes the story itself: the record of what your systems captured.

The questions are specific and evidentiary now — not “are we secure” but what did our systems see, what did they do, and can we produce it. That is the pressure this room is built for. Not to relitigate what happened — to make sure your account of it is evidenced rather than anecdotal.

What we build

Not a catalog of devices — one coordinated response-and-record chain.

Detection and duress that route to a location, access control matched to the threat of each area, video and lockdown that coordinate the response — and, at the end, the retrievable, time-synchronized record the whole chain produces. Its value is the links: a call that reaches a place, an alert tied to a camera, a lockdown that fires on the access event, an account you can produce six months later. The failure types this room is about are each a break at one link.

1Activationthe alert fires2Locationwhere it is3Routingto whom4Responsecoordinated5Verificationcamera + access6Recordretrievable after
01Duress & staff-alert — fixed and wearable, routed to a location.
02Access control matched to each area’s threat — selective, never a fortress.
03Weapons detection — scoped to what it addresses (see the limit below).
04Video & location awareness — verification, coordination, and the record.
05Lockdown & mass notification — coordinated during an active event.
06The evidence record — the central element. The retrievable, time-synchronized account of activation → response → resolution. After an incident, this is the loudest question in the room.

On weapons screening, the plain limit: the Mayo Clinic’s 2026 review found only about a third of hospital shootings were potentially preventable by it — so we scope it to that third; the other two-thirds depend on interior response, coordination, and the record. And we’ll name the one class where the physical answer measurably worked: infant abduction, where tagging, access control, and drilled protocol drove the base rate down.

How the chain breaks at one link — and how each break closes →

The physical layer we own

Most of what happens after an incident isn’t ours — and shouldn’t be.

The investigation, the legal and regulatory response, the care the affected people need — that is your leadership’s and your counsel’s work, and it should be. Most of what a regulator cites after an event is program and process the organization owns, not integrator hardware.

Our part is the physical layer underneath it: the systems that detect, alert, coordinate the response, and create the record of what happened and how those systems performed. That record is what the investigation, the governing-body reporting, and the litigation all draw on: it is what makes the account evidenced rather than anecdotal.

What it looks like when it works

One coordinated response — and a record you could produce.

Illustrative · replaced with your verified results at onboarding
Director of Risk & Security · an illustrative 400-bed regional health system

“When the state investigator asked us to walk through the event, we had the whole timeline in one place — not six systems to reconcile by hand at midnight.”

What we built — the physical layer: duress routed to location, access and video tied to each alert, lockdown firing on the triggering event, and one time-synchronized record across all of it.

The result — illustrative: after an event, one authorized person could retrieve the full account — activation, location, response, access, and video — before preservation windows closed. The investigation, legal, and clinical response stayed with their leadership and counsel, where they belong.

System artifact
Incident record — retrievable
activation → location → acknowledged → dispatched → response → video + access → resolved
[ your real reconstructed timeline appears here ]

Illustrative example — not a real client and not a guarantee of results. On a live deployment this shows a named facility’s actual, verified reconstruction.