Access Points & Weak Spots

An access point is any route through which a person, tool, hazard or information leak can reach a collection. A weak spot is the feature of that route that makes unauthorised entry, removal, damage, substitution or reconnaissance easier than the collector intends. The route may be a window, but it may just as easily be a cleaner with unrestricted movement, a shared alarm account, a visible parcel label or an unsealed service penetration above an archive.

Serious risk assessment therefore looks beyond locks and asks how access unfolds. Security works as a sequence of discretion, deterrence, detection, delay and response. The collector's task is not to make every opening impenetrable. It is to understand realistic paths, interrupt them before one routine failure exposes the whole collection and ensure that any attempted interference is discovered soon enough for a useful response.

The governing question

From the perspective of someone who knows what is here, what is the easiest realistic path to reach, remove or damage it - and which assumption makes that path possible?

Chapter model

Trace the whole path, not the most obvious door

A collection can be exposed long before a person touches the building and remain exposed after an object leaves it. Follow the path in order and test where each layer fails.

Public information

Can an outsider discover the collection, its highlights, location, routines or security arrangements?

Property approach

Can the property be approached privately, quickly or with useful climbing and concealment aids?

Building entry

Which door, window, garage, cellar, roof or communal route is realistically most attractive?

Internal movement

Once admitted or inside, where can a person move and what can they see without challenge?

Collection enclosure

Does the room, cabinet, safe or container create meaningful control, delay and compartmentation?

Object removal

How easily can the object be concealed, carried, detached, packed or substituted?

Exit and disposal

Can it leave unnoticed, and would documentation support rapid recognition, recovery and proof of loss?

Why the complete path matters

Collectors often overinvest in the building exterior while leaving the collection itself in an unrestricted spare room. In that arrangement, the front door may resist forced entry well, yet anyone legitimately admitted to the property can see the collection, reach its keys and move small objects without crossing a second controlled layer.

The reverse error also occurs. A strong safe may protect selected objects while public posts, deliveries, predictable absences or weak account recovery reveal where the value is concentrated and how the surrounding system operates. The point of the path model is to expose these gaps between individually reassuring measures.

What counts as an access point?

Treat access as a family of routes rather than a list of openings. The same collection may be reached physically, operationally, digitally and environmentally.

Physical entry

Doors, windows, garages, cellars, roof openings, shared entrances, gates, side passages and any other route through the building envelope.

Routine human access

Cleaners, tradespeople, carers, household visitors, couriers, valuers, researchers, removal firms and others who may enter legitimately but reach more than their task requires.

Internal movement

Collection-room doors, cabinets, safes, key cupboards, packing areas, alarm controls and the routes a person can use once already inside.

Information access

Social posts, photographs, parcel labels, public records, livestream backgrounds, shared inventories, weak email accounts and travel announcements that reveal what exists, where it is or when it is unguarded.

Emergency and safety access

Fire exits, emergency releases, firefighter access, utility isolation points and doors that unlock during an alarm. These routes cannot simply be removed; they require dual-purpose planning.

Environmental access

Openings and penetrations through which water, smoke, pests, light, pollutants or heat can reach vulnerable material even when no person enters.

Diagnostic framework

What makes an access point weak?

A weak spot is rarely defined by one product specification. Diagnose the route through the conditions that shape real opportunity.

Reachability

Can someone approach the point privately and remain there long enough to work?

A strong barrier can still be weak when concealment gives an intruder time. Privacy changes the practical resistance of the whole route.

-A rear door hidden by dense planting
-A basement entrance below street level
-A detached garage screened from neighbours

Accessibility

How easily can the route be reached or made reachable?

Assessment must include the surrounding environment. Bins, flat roofs, trees, scaffolding and stored ladders can turn an apparently remote opening into a practical entry point.

-Garden furniture beneath a low roof
-An unlocked side gate
-A shared balcony beside an upper-floor window

Resistance

How much real delay does the complete assembly provide?

The weakest component governs performance. A premium lock does little when the frame, fixings, glazing, hasp or surrounding material is poor.

-A strong padlock on a weak staple
-A cabinet lock set into thin board
-A safe that is not appropriately anchored

Predictability

Does routine behaviour make the control easy to anticipate or bypass?

Convenient habits can quietly erase physical security. Repeated routines tell a knowledgeable person when controls will not be used.

-A spare key in a familiar hiding place
-An alarm omitted during short absences
-Collection-room doors left open for cleaning

Detection

Would activity at this point be noticed promptly and reliably?

Recording an event is not the same as detecting it in time. Blind zones, local-only recording and alerts dependent on one fragile connection can leave a route effectively unobserved.

-A camera that misses the approach
-A detached store with no dedicated sensor
-Alerts sent to a silenced phone

Response

What credible action follows an alert?

Security must connect detection to a person, decision and response. Without verification, a keyholder or a plan for absence and system failure, an alert may only create post-event evidence.

-No named responder while the collector is abroad
-No plan for broadband or power failure
-An alarm that nobody can verify remotely

Authority

Does one key, code or account grant more access than the holder needs?

Excessive privilege creates a broad failure point and makes accountability difficult. The problem may be a credential design rather than a physical opening.

-One key opens the house, room and cabinet
-Shared smart-lock administrator accounts
-Former contractors retain active access

Maintenance

Has the control degraded, drifted or become too inconvenient to use?

Security controls are not permanent facts. Doors move, batteries fail, vegetation grows, software ages and temporary access quietly becomes normal access.

-A door closer no longer latches
-A camera lens obscured by growth
-An outdated key or user register

Collector scenario: the impressive front door

A collector upgrades the front entrance with a high-quality lock and assumes the principal security problem is solved. The rear garden remains concealed, a side gate does not lock, bins sit beneath an upper window and the collection-room door is a hollow internal door whose key is kept in a nearby drawer.

The upgrade is not useless. It improves one route. The error is treating evidence about that route as evidence about the whole path. The assessment should now ask which route a knowledgeable person would choose instead.

Assess the actor, not only the opening

The same window, visitor route or credential can carry different risk depending on who might use it, what they know and how much time they have.

Opportunistic intruder

Limited prior knowledge, preference for speed and low exposure, and a tendency to take visible portable objects.

Weak spots to test

-Unlocked openings
-Visible collections or keys
-Tools and ladders left outside
-Poor lighting and easy escape routes

Informed intruder

Knows or suspects that valuable collectibles are present, may target a particular room and may arrive prepared.

Weak spots to test

-Revealing social posts
-Known travel dates
-Single-layer security
-Security equipment that can be reached after entry

Insider or authorised visitor

Enters legitimately, understands routine and may remove, substitute or damage objects gradually without forced entry.

Weak spots to test

-Unsupervised movement
-Shared keys or credentials
-Poor item-level inventory
-Long intervals between checks

Contractor or service provider

Temporary access creates opportunity beyond the work area even where there is no reason to distrust the person involved.

Weak spots to test

-Doors propped open
-Alarm zones disabled and not restored
-Keys issued without return logging
-Collection layout exposed during work

Targeted specialist offender

Researches specific objects, exploits procedures and may target logistics, storage or transport rather than the residence itself.

Weak spots to test

-Publicly known high-value holdings
-Predictable transport routines
-Overconcentration of value
-Security built around ordinary household assumptions

Clarify uncertainties and correct practical defects.

15-19Significant weakness

Plan improvement and break the route deliberately.

20-25Priority intervention

Treat as a high-priority access path and consider specialist input.

A low-probability route may still require urgent treatment where failure exposes irreplaceable objects, all credentials or the entire collection. Record the reason for the score and the consequence that sits behind it.

Build an access-point register

The written register turns a walk-through into a repeatable assessment. Include internal rooms, containers, human permissions and digital credentials rather than limiting the exercise to exterior doors.

Field	What to capture
Identifier	Door D1, window W3, cabinet C2 or credential K4
Location and route	Where it is and which spaces it connects
Normal users	Household, staff, cleaner, visitors, contractors or public
Control	Key, code, card, supervision or no control
Barrier and detection	Door, glazing, safe, sensor, camera or none
Normal and failure state	Locked, open while occupied, releases on alarm or unknown
Dependencies	Power, Wi-Fi, battery, cloud service, one keyholder or one account
Assets reachable	Selected cabinet, records, keys, whole room or whole collection
Weakness and priority	Observed defect, consequence and review priority

Failure analysis

Look for chains of weakness

Collection risk is often created by several modest defects that align. Read each chain from the outside world to the object and identify the first practical place to interrupt it.

Rear-window chain

Side gate does not lock

Planting screens the garden

Furniture reaches a low roof

Upper window is routinely open

Collection-room door is unlocked

No sensor covers the room

Collector judgement

No single condition looks dramatic. Together they form a continuous path from public space to the collection without useful interruption.

Legitimate-visitor chain

Purchases are publicised online

Visitors enter the home

The collection is visible from the hallway

Cabinet keys are stored nearby

Individual pieces are poorly inventoried

Loss may remain unnoticed for months

Collector judgement

Excellent exterior doors do not repair a route created by legitimate entry, visible value and weak accountability.

Technology chain

A smart lock uses a shared account

The password is reused

Multifactor authentication is absent

Access logs are not reviewed

The router is outdated

The emergency key is poorly controlled

Collector judgement

The practical access point crosses physical and digital systems. Treating either side in isolation misses the complete weakness.

Property context changes the route

Do not apply a generic home-security checklist without considering how the premises are occupied, approached and managed.

Detached or semi-detached home

The layout matters more than the property label. Detached homes may provide privacy for an intruder; semi-detached homes may gain more natural observation but still contain secluded rear or side routes.

Frequent concerns

-Side passages and rear doors
-Garage-to-house connections
-Conservatories and accessible flat roofs
-Sheds containing tools or ladders

Terraced home

Close neighbours do not guarantee observation. Shared passages, rear alleys and adjoining extensions can create access routes that are difficult to attribute to one property.

Frequent concerns

-Rear alleyways and shared access
-Low adjoining walls
-Cellar routes
-Deliveries visible from the street

Flat or apartment

A controlled communal entrance is one layer, not a substitute for securing the individual dwelling and its internal routes.

Frequent concerns

-Tailgating and shared fobs
-Parcel areas and contractor movement
-Adjacent balconies or fire routes
-Assumptions about concierge oversight

Outbuilding or detached collection room

Distance from occupied space can increase working time, delay discovery and make communications or power failure more consequential.

Frequent concerns

-Delayed detection
-Thin walls, roofs or large doors
-Isolated power and communications
-Transport between the house and store

Commercial store or archive

Operational access usually dominates. Staff, deliveries, loading areas, fire exits and out-of-hours permissions must be managed as a system.

Frequent concerns

-Staff and former employee credentials
-Loading bays and outgoing goods
-Cleaning and contractor access
-Stock reconciliation and CCTV retention

Self-storage unit

Secure storage is a marketing description, not a risk conclusion. Assess the facility perimeter and the individual unit separately.

Frequent concerns

-Tailgating and code sharing
-Unit construction and gaps above partitions
-Staff access and limited unit-level detection
-Delayed discovery and environmental suitability

Read reassuring evidence carefully

A visible control is evidence about one part of the system. The collector must still ask what it means and what risk remains.

Evidence

A strong external door

Meaning

The most obvious route has useful physical resistance.

Collector risk

Other openings, internal access, key control or visitor procedures may remain weak. One component does not establish whole-property security.

Evidence

Visible CCTV

Meaning

There may be deterrence and evidence collection.

Collector risk

The camera may have blind spots, fail to create a timely alert, record to removable equipment or depend on fragile connectivity.

Evidence

A locked collection room

Meaning

Casual entry is restricted.

Collector risk

The door, frame, key control and detection may still provide little delay. A privacy lock is not automatically a security layer.

Evidence

Objects stored in a safe

Meaning

A further physical layer exists.

Collector risk

Certification, anchoring, code control, internal environment and concentration of value still require separate judgement.

Evidence

Only family members have access

Meaning

Public exposure is reduced.

Collector risk

Trusted access may still be informal, broad and unattributable. Controlled access protects trusted people from mistakes and false suspicion as well as protecting objects.

Myth versus reality

Myth

Burglars only use the front or back door.

Reality

Risk includes windows, garages, communal entrances, internal rooms, visitor access, logistics, credentials and information leakage.

Myth

An alarm makes the property secure.

Reality

An alarm contributes detection. It does not replace resistance, delay, response, maintenance or control of legitimate access.

Myth

Nobody knows what I own.

Reality

Deliveries, visitors, sales activity, photographs, backgrounds and public records may reveal more than the collector consciously disclosed.

Myth

My cabinets lock, so the objects are protected.

Reality

Many display locks discourage casual handling but are not intended to resist determined attack or removal of the cabinet itself.

Myth

The collection is too large to steal.

Reality

A person may remove only the smallest, most valuable, recognisable or saleable objects.

Myth

Trusted people do not need controls.

Reality

Controls also prevent mistakes, ambiguous custody, accidental damage and unfounded suspicion. Trust and accountability are compatible.

Action hierarchy

Improve the route in the right order

The most expensive intervention is not automatically the most useful. Begin with uncontrolled access and complete paths before refining already strong components.

Priority 1

Remove uncontrolled access

Deal first with openings routinely left unsecured, unknown keyholders, obsolete credentials, unrestricted visitor movement, visible high-value objects and unmanaged administrator accounts.

Priority 2

Break complete access chains

Find routes where a person can move from outside to the collection without meaningful interruption. Add a layer at the point that most efficiently breaks the chain.

Priority 3

Connect detection to response

Confirm that important routes are detected, alerts reach a named person, events can be verified and absence, power loss and broadband failure have been considered.

Priority 4

Strengthen high-consequence points

Prioritise routes to unique objects, portable value, provenance files, authentication records, keys, inventory data, alarm controls and whole-collection storage.

Priority 5

Improve governance

Create practical procedures for visitors, contractors, deliveries, keys, codes, alarm use, emergency access, opening, closing and incident reporting.

Priority 6

Verify and maintain

Test controls under realistic conditions, record failures and repeat the assessment after changes to the collection, property, household, staffing or technology.

Collector access-point inspection

Inspect actual behaviour and current condition rather than the system as designed or remembered.

Outside the property

Walk the whole boundary in daylight and darkness.
Identify concealed approaches, climbing aids and unlocked side routes.
Review lighting, vegetation and what can be seen through windows.
Observe where parcels are left and what collection-related waste reveals.

Building envelope

List every door, window, garage, conservatory, cellar and roof opening.
Test whether doors close and latch; inspect frames and surrounding material.
Include rarely used and emergency openings.
Record glazing near handles, detection gaps and maintenance defects.

Internal routes

Follow the routes used by visitors, cleaners and contractors.
Identify rooms reached without supervision and sightlines into the collection.
Locate keys, alarm controls and network equipment.
Ask whether one breach exposes every valuable object and record.

Collection room and enclosures

Inspect the room door, frame, windows and dedicated detection.
Confirm who has access and where keys or codes are controlled.
Review cabinet and safe installation, not merely the lock brand.
Separate objects, keys and records where concentration would amplify one failure.

Credentials and procedures

Count keys and identify holders; remove obsolete access.
Change shared or compromised codes and review smart-system users.
Observe actual behaviour: propped doors, skipped alarms and unsupervised access.
Assign responsibility for alerts, deliveries and system failure.

Scenario testing

Test plausible access, not just hardware

A static survey shows what is installed. Scenarios reveal how the system behaves when attention is divided, routines change or several controls fail together.

Five-minute visitor opportunity

A visitor is left alone while the collector answers a telephone call in another room.

?What can be seen, touched or concealed?
?Can keys, documents or packaging be reached?
?Would movement be attributable?
?How quickly would a missing item be noticed?

Contractor near the collection

Work is required in or beside the room where valuable objects are stored.

?Can the work zone be isolated?
?Should objects be screened or temporarily moved?
?Who supervises and controls photographs?
?Are disabled alarms restored after the work?

Night-time perimeter breach

Assume that the rear boundary has already been crossed.

?Is the approach detected or visible?
?Which opening offers the easiest next step?
?What creates delay after entry?
?Who responds and on what evidence?

Collector away for two weeks

The property is vacant and normal routines are interrupted.

?Who knows about the absence?
?What do public posts and deliveries reveal?
?Who holds keys and receives alerts?
?What happens after power or broadband failure?

One small item removed each month

An authorised person removes a portable item gradually rather than attempting a dramatic theft.

?Would item-level records reveal the loss?
?Can near-identical variants be distinguished?
?Are access events attributable?
?Could a genuine object be replaced with an inferior copy?

Fire alarm releases doors

An emergency causes one or more access-controlled doors to unlock.

?Which doors release and who controls re-entry?
?Can collection security remain proportionate without obstructing escape?
?How are responders directed?
?Who confirms that security is restored afterwards?

Documentation that strengthens the assessment

Security documentation should support review, maintenance, accountability and recovery without becoming a new information leak.

Access-point register and annotated floor plan
Key, code, card and authorised-user register
Visitor, contractor, delivery, opening and closing procedures
Alarm zone map, response plan and keyholder details
Photographs of doors, frames, cabinets, safes and installations
Equipment certificates, safe specifications and installation records
Maintenance, testing, incident and false-alarm logs
Insurer requirements and correspondence
Object-level inventory and identification photographs
Periodic review record showing what changed and why

Sensitive records need their own access judgement

Do not keep the only copy of the security plan beside the collection, and do not expose detailed floor plans, alarm zones, keyholder information or administrator credentials through an ordinary shared folder. The documentation that improves response can also improve reconnaissance if handled carelessly.

Specialist threshold

When an informal household review is no longer enough

Professional advice is warranted when consequence, complexity, public exposure or prior threat exceeds what a collector can reasonably assess through ordinary observation.

-The collection materially exceeds ordinary household contents value.
-Objects are unique, culturally important, highly portable or publicly known.
-The premises combine residential, commercial, staff or public use.
-The collection is held in an outbuilding, warehouse or complex shared facility.
-A secure room, safe, sophisticated alarm, CCTV or access-control system is being specified.
-Previous theft, stalking, threats or targeted reconnaissance have occurred.
-Insurers impose technical requirements or fire safety appears to conflict with security.
-The collector cannot confidently identify all access routes, keys, credentials or administrators.

The correct starting point

A specialist should begin with the assets, threat, premises, operating routine and required outcome - not with a predetermined camera, safe, lock or alarm package. Product selection follows the operational requirement.

The central collector judgement

Good access control remains compatible with ordinary life, accessibility, emergency escape, conservation and enjoyment of the collection. It is successful when the controls are proportionate enough to be used consistently and layered enough that one predictable lapse does not expose everything.

1Valuable assets are not unnecessarily advertised.
2Entry and information routes are understood rather than assumed.
3Legitimate access is limited, attributable and reviewed.
4No single routine failure exposes the whole collection.
5Interference is detected early enough for a credible response.
6Physical barriers create useful delay rather than symbolic reassurance.
7Loss, substitution or damage is discovered quickly.
8Objects are documented well enough to support identification and recovery.
9Controls remain practical enough that household members and staff will use them.
10The assessment changes when the collection, property, routine or technology changes.

Key takeaways

-An access point can be physical, human, operational, informational, digital, emergency-related or environmental.
-Assess complete paths from knowledge of the collection through entry, internal movement, object removal and exit.
-The weakest route is shaped by concealment, accessibility, resistance, detection, response, authority and maintenance - not by one branded component.
-Chains of modest weaknesses are often more important than one dramatic defect.
-Use scoring only as triage; consequence and written judgement remain decisive.
-Prioritise uncontrolled access and complete routes before adding more equipment to already strong points.
-Documentation improves accountability and recovery but must itself be protected as sensitive security information.

Continue learning

Visibility & Public Exposure

Understand how displays, online activity, deliveries and public information can reveal the existence, value or location of a collection.

→

Back to Risk Assessment

Return to the full risk-assessment sequence and place access weaknesses alongside value, portability, absence and storage-location risk.

→

Household & Visitor Risk

Continue into the human side of access: trusted people, visitors, contractors, routines, supervision and accountability.

→