The Challenge
A global technology company preparing a new headquarters fitout needed security that would not compromise the workplace culture that drives its commercial value. Canva’s open-plan layouts, minimal barriers, and accessible common spaces are not aesthetic preferences — they are how the company works. At the same time, the organisation’s profile and the building’s configuration created a threat profile that required considered security advice. The question was whether security could be designed to be invisible to the culture while remaining effective.
Our Approach
Core42 developed a five-tier security zoning framework before specifying any controls, creating a matrix that made trade-offs visible across zones. We built a purpose-designed calibration tool that mapped each security measure against its impact on workplace culture, giving leadership a structured way to make trade-off decisions between target hardening and employee experience. Differentiated security postures for operational and non-operational hours avoided the common failure of designing for the worst case and imposing it on everyday operations. A structured options analysis for building entry enabled leadership to select the access control approach that best balanced throughput, security, and cultural fit.
What We Delivered
A security management plan specifying 110 individually numbered controls across 13 categories, mapped to the five-tier zoning framework. The plan was structured in three parts — background, site-agnostic framework, and site-specific implementation — so the governance components could scale across Canva’s property portfolio without rework.
Why It Matters
This project demonstrates security advisory for culture-conscious organisations — those in technology, creative, and professional services sectors where workplace experience is a competitive differentiator. The scalable framework architecture and culture-calibrated approach apply to any organisation that treats its workplace culture as a business asset worth protecting, not overriding.