I'm guessing it's mostly the former. The sort of attack which involves -- for instance -- fake IDs and/or ninjas crawling through the ceiling is relatively rare, especially compared to online attacks (which are a more serious threat anyway).