Life Time operates a sprawling physical footprint - over 190 Athletic Country Clubs, 15 coworking spaces, and residential apartment complexes - all across the United States. The attack surface is the interesting part: every location runs access control systems, point-of-sale terminals, member-facing apps, connected fitness equipment, and networked building infrastructure spanning pools, spas, and hydrotherapy suites. That's a lot of IoT endpoints, a lot of personally identifiable information, and a threat model that blends OT security concerns with classic retail and SaaS risk profiles.
The digital stack extends through the LT App, which integrates personal training programs and tools like the Active Metabolic Assessment, and Experience Life Magazine's publishing operations. Member data, payment processing, health and fitness telemetry, coworking network access, and residential smart-building systems all fall under the same corporate umbrella. Cybersecurity here means defending a hybrid environment that touches physical security, application security, data privacy, and enterprise IT across dozens of distinct operational domains.
Life Time's stated mission centers on helping people improve how they live, work, play, and think about their health. For a security team, that translates into protecting a large, heterogeneous environment where the boundaries between consumer-facing tech, building operations, and corporate infrastructure are blurred by design. The scale - 190+ physical locations plus digital platforms - demands an approach that accounts for distributed networks, member-facing applications, and the convergence of fitness technology with traditional enterprise systems.
