I agree. Here are some rules of thumb I use (which I base off of my my day job....which is physical security)
Use passive security to do the following:
Warn,
Deny,
directFirst:
Warn. This is accomplished mainly by signs (both physical and AR) warning individuals approaching the protected facility that they are not authorized access. This will give your sec-teams the 'legal justifications' for any active follow on actions (especially if it is a facility that authorizes lethal force). With enough warnings, the casual or accidental intruder will leave. If they stay, well....they should know what they are getting themselves into.
Next:
Deny. This is accomplished by fencing (normal, electric, electronic...remember, fences need not be physical). Physical fences do not have to be a traditional fence. Hedges, trees, etc. can be just as effective (and sometimes more-so). There are more active denial systems, but we are talking about passive systems. Along with fences you have things you wouldn't think are part of the system: Large concrete planters, etc. Go ahead, try driving through one of those).
Last:
Guide and route. Use the passive systems to route intruders to where
you want them to be. Have an inner and outer fence. the inner fence can be more of an active denial (electrified, razor wire, etc), forcing the intruder to move in one or two predictable directions. pop-up denial walls can cut intruders off and (potentially) trapping them. Just a few ideas.
Not mentioned is, of course, the observation and IDS (Intrusion Detection System) part. This is by cameras, a wiz patrolling astrally, etc. The IDS are motion sensors, IR (heat sensors that detect anything above a preset level), and simple mag-switches (break the connection and an alarm sounds). Most (and really all) are not obvious physically.
Your active security (On-site security, Rapid Response Force, local police contractors) will deal with the intruders. The passive systems will give them a crucial edge, tracking and forcing the intruders to where they will have the advantage. Use this layered approach and I think you will find that even on-site security will become even more dangerous.
Active security is generally defined as something that can get up and move - from roving security guards to a security network that takes snapshots of your face as you break in and forwards it to the police so they can pick you up after you break out.
Passive security is something that you build, maybe power, but generally sits there. Concrete walls, false walls, pressure plates, infrared or motion sensors, hidden safes, security-protected maglocks on safes with false bottoms, wifi-blocking paint cutting off your team's ability to communicate (perhaps including a security booth only allowing one person through at a time), wards warning conjurers, long-term observation drones taking detailed scans of the PCs, and potentially that security spider jumped into every device in the building. I have used all of these against my players.