The security gap nobody talks about and how one startup is closing it
It started with watches and alarm clocks. Long before identity and access management became a discipline, Vincent Philipsen was already fascinated by how systems work on the inside. As a child he would open mechanical clocks just to see how the gears connected. That curiosity carried him through studies in economics, a technical post graduate programme and eventually into the ICT world, where he has worked since the late nineties. Today, he is the CRO and co-founder of Key2XS. The company is based at the security campus, HSD Campus in The Hague and builds technology that connects digital security to the physical world.
A lifelong fascination with how systems really work
Vincent describes himself as a commercial professional who always needed to truly understand the technology behind the story. After starting his career at the former PTT Telecom, now KPN, he moved from telecom into information technology and began working with startups.
“I am not a techie, but I really need to understand what is happening. Otherwise I cannot explain it or build something meaningful.”
When digital security meets physical reality
Most people know identity and access management from their daily work. You log into enterprise software, you are allowed to see certain systems and not others, depending on your role. If you change jobs or leave a company, those digital rights are revoked.
“In critical infrastructure, people are not only working with laptops. They are working with physical assets like bridges and substations. And when someone leaves the company, you cannot revoke a physical key with one click.”
Two worlds that were never meant to stay apart
The digital side of security is usually owned by the Chief Information Officer and Chief Information Security Officer (CISO). The physical side is managed by facility management. These two domains rarely talk to each other. During a project for the Province of North Holland, Vincent and his co-founder Reinier discovered how fragmented the situation really was. Thousands of locations, thousands of cylinders and access plans maintained in endless Excel sheets.
“There was no solution in the world that connected identity management with physical access. Everything was custom work.”
Building the missing layer in critical infrastructure
Key2XS connects identity management platforms with physical access systems so that digital identities become the single source of truth for both worlds. For CISOs responsible for compliance with European regulations such as Network and Information Security Directive (NIS) and Critical Entities Resilience Directive (CER), this finally provides control over physical access.
“The CISO is accountable for security policies, but until now they had no real control over what was happening on the physical access side.”
One identity for both screens and doors
At the heart of Key2XS is the idea that every role in an organisation should have exactly one access profile. Whether someone logs into enterprise software or unlocks a substation, the same identity defines what is allowed and what is not. Acting as the connecting layer between existing systems removes the need for manual workarounds and Excel based access plans.
Back at the heart of The Hague’s security ecosystem
This is not Vincent’s first time at the HSD Campus. He has been part of the Security Delta ecosystem before and returning felt like a natural step.
“It is the startup mentality, the people and the ecosystem. It was a no brainer to become part of HSD Campus again.”
From his office on the eighth floor, Vincent looks out over The Hague with views stretching from the royal residence to the ADO Den Haag stadium. Together with the international community and the ease of inviting customers and partners into the building, it makes the campus more than just an office location.
Growing responsibly in a world that cannot afford mistakes
Key2XS works with organisations in energy, telecom, banking and emergency services.
“I want to grow, but only if we can do it responsibly. In critical infrastructure, shortcuts are not an option.”