“Most organizations get the majority of their physical security advice from salespeople (who somehow seem to recommend their own products).”