The Empire State Building Security Failure: 5 Lessons Every Founder (Especially in Security) Must Learn

(This article contain affiliate links. If you sign up through them ,we earn a commission at no extra cost to you. Our editorial verdict is independent of any commercial relationship.)

Wednesday July 1, 2026 started as a usual day for all within the Empire state building, except for Angela Nikolau and her partner Ivan Kuznetsov. The couple entered the 1,454-foot skyscraper as regular visitors but with a different intent.

Angela was the subject of a 2023 documentary titled “Skywalkers: A Love Story.” On set, she said, “Love is like heights. The fear never goes away. You just get better at facing it.” Perhaps that line inspired such a scenic display to take their love to 1,500 feet above New York City. This breach, however, reminds us to stay security alert.

The Stunt

The Empire State Building has a yearly climb competition. This couple, however, didn’t wait to register, nor did they notify authorities. They entered the building as regular visitors, hid overnight, and bypassed security to access the restricted broadcast antenna in the early morning.

An observer, Julie Morris, stated to ABC-TV , “Well, I was on the top, the very top, along came these two people. Opened the mesh. Assumed they worked there and nobody stopped them.”

From her statement it was clear that the climbers might have been seen by some non-security personnel and tourists, but yet the security system failed to detect them.

Reports had it that they slept overnight inside the building before gaining access to the antenna shaft and, on getting to the top, unveiled a banner that read, “When the power of love beats the love of power, the world knows peace,” and then went ahead to get engaged.

Their actions raised a lot of questions, the most hair-raising one is being about security.

First, the Empire State Building is one of New York City’s most iconic landmarks and expected to be highly secured. Again, there is supposed to be an increased police presence with the FIFA World Cup event taking place across cities in the United States. It is also worthy to note that superstar Taylor Swift and Kansas City Chiefs’ Travis Kelce’s wedding celebration is expected to take place at Madison Square Garden. 

What’s more? This stunt occurred just 4 days away from the July 4th celebration of America’s 250th Independence Anniversary. 

These remarkable cultural moments make the timing of this incident difficult to ignore.

Five Lessons From the Empire State Building Security Breach

Whether you manage a corporate headquarters, a warehouse, or a mixed-use property, the lessons that ensure airtight security remain remarkably consistent.

1. Access Control can be tricky in High-Traffic Areas

If you have ever worked in a high-traffic environment, you understand how easy it is to lose track of people within the crowd. In an iconic center such as the Empire State Building, that is a tourist hotspot you need some extra measure or security protocol to ensure a safe environment.

Organizations and security personnels that employ traditional access control methods such as simple ID badge checks, reception sign-in books, and manual visual verification become unreliable when personnel are processing dozens of entrants every minute. More than 90% of organizations still report access control failures. Tailgating remains one of the most common access control failures worldwide, accounting for about 61% of all reports of access control failure.

Maintaining security in high-volume environments requires shifting from identity verification alone to continuous validation. For security staff and the CEO of a security firm tasked with protecting properties, the important question shifts from, “Can people enter?” to “Can we immediately identify when someone who shouldn’t enter gains access?”

Security tools such as Kisi, a cloud based access control system gives mobile credentials to individuals so they can access a business premises. Kisi also has tools for visitor management and real-time monitoring. Another security apparatus for high volume commercial buildings is Openpath (Avigilon Alta Access), it has anti-tailgating integrations as well as mobile access for entering doors offices.

2. Vendors and Contractors Are Often the Weakest Security Link

Large organizations sometimes employ the services of unofficial staff to carry out the function of cleaning,  and maintaining the office environment. IT technicians and food delivery personnel are mostly allowed into official premises and even restricted spaces with minimal verification. These individuals legitimately require building access, but often operate outside regukar oversight.

Common weaknesses noted in this aspect include; shared contractor badges, where a contracting company could be granted general access to certain areas, who then grant access to multiple staff.

Another loophole is forgotten active accounts when a project is finished. Every vendor should have clearly defined permissions tied directly to their assignment. Acontractor servicing air conditioning equipment should not automatically gain unrestricted access to executive offices or data rooms.

Busineeses should have rigorous vendor access management protocol like background verification, pre-approved work orders, and time-limited digital credentials. You can include escort for sensitive areas and audit trails of individuals who access to the organization’s premises.

Some systems such as the Envoy Visitor management system replace traditional paper logs with a secure, digital check-in process. Verkada Guest,another cloud-based visitor management system (VMS), integrates physical security with front-desk operations. It connects directly with the wider Verkada Command platform, allowing organizations to link check-ins with video security and building access control. 

3. Deterrence Is Not Detection

Over 65% of all organizations use some form of digital monitoring, including video surveillance and computer tracking, to increase workplace efficiency and maintain office security. The majority of commercial buildings and corporate offices use cameras to protect assets, improve visitor safety, and investigate incidents Visible cameras. 

While the use of security cameras is vital to monitoring an assigned area of security concern, they may discourage opportunistic threats, but they do not necessarily detect or deter determined ones. Most determined criminals take note of areas covered by a security camera and they exploit the blind spots. 

The distinction between detection of a security threat and deterrence is crucial. Real-time detection relies on systems capable of recognizing behaviours and not merely recording them. Modern security increasingly combines AI-powered video analytics, motion detection and object recognition, behavioural anomaly detection, automated security alerts and integrated alarm systems. 

Founders evaluating security vendors should ask a simple question “Does this system merely record incidents for later investigation, or will it notify us while the incident is still unfolding?” That difference often determines whether security becomes reactive or genuinely preventative.

You could explore the services of tools like Avigilon Unity Video. This is an AI-powered, on-premise video management software. It is designed for robust security operations, with live viewing, playback, access control unification, and object search capabilities. Its Unity Access Integration links visual and physical matches to verify alarms and access control events. This tool is available in Nigeria as well as the UK and Canada, with a camera channel license ranging from $100 to $300.

However, if your business realities do not make room for expensive subscription, you can get the Blink Video Doorbell. At $189.99, you have access to wireless smart security cameras and a head-to-toe HD view. It also has a Sync Module core including 3 camera systems that will give you a bird’s-eye view of critical areas in your business or home environment. 

4. The First Ten Minutes Determine the Outcome

No security system yet can prevent every incident. Whether the threat involves unauthorized access, workplace violence, theft, or a cyber-physical attack, the effectiveness of an organization’s security program is often determined by what happens immediately after the threat is detected. 

Many incidents escalate because there is confusion over who has decision-making authority or who records critical information. The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency recommend that organizations establish predefined incident response procedures with clearly assigned roles and communication channels to reduce delays during emergencies.

A well-designed escalation protocol removes uncertainty by ensuring that every alert immediately answers five questions: What happened? Who is responsible for responding? How severe is the incident? Who must be notified? And what actions must begin immediately? 

The first ten minutes are particularly critical because delays in decision-making often allow threats to escalate and increase operational disruption.

Founder-led businesses do not necesaarily need large security departments to respond effectively; they need disciplined preparation. A practical incident response plan assigns responsibilities, maintains up-to-date emergency contact lists, and includes regular tabletop exercises in which staff rehearse realistic scenarios. 

International standards such as ISO 22320 also emphasize regular training, coordinated command structures, and continuous improvement to strengthen emergency management capabilities. Organizations that rehearse their response are consistently better positioned to minimize disruption, protect occupants, and recover more quickly when incidents occur.

To help streamline notification and enhance prompt action, security founders could use Everbridge for critical emergency notifications and coordinated incident response. The Critical Event Management (CEM) platform and its emergency communication services operate globally across more than 200 countries and territories, including Nigeria. Everbridge services are billed annually and do not include a free trial. However, it is billed in US Dollars for a starting price of $5,000 per year. Users in Nigeria and other countries such as Canada and UK can access the services but will need to make their payments in USD.

5. Accountability Begins After the Incident Ends

A security incident should mark the beginning of an organization’s learning process rather than the end of its response. Resilience is built over time as companies adapt to security threats and learn from past failures.

An effective post-incident review tries to learn and understand how the incident happened in the first place. Furthermore, teams can synergize and learn from events that happened in other organizations. The National Institute of Standards and Technology recommends conducting structured post-incident analyses to identify root causes, evaluate the effectiveness of existing controls, and strengthen future response capabilities through continuous improvement.

Key post-event questions can include how the incident was first detected, how long it took responders to act, whether security controls functioned as intended, if personnel understood their responsibilities, whether communication protocols were followed, and what organisational or technological weaknesses contributed to the event. 

As a founder of a security firm or an individual responsible for a workspace, having a security protocol is indispensable to your success as a business. Security breaches rarely announce themselves, but being ready and streamlining your chain of command is essential to mitigating irreparable damage from emergencies and security breaches. One of the best options is to learn from experiences like the Empire State Building Incident and utilize tools such as Blink Video Doorbell, which is widely available and low-cost, with effective staff training.

Thabk you for reading! More informative content for you on FW. Snap Just Launched $2,195 AR Glasses—Is This the Future of Work for Founders? Read HERE