I would like to apologize in advance if thoughts seem disorganized somewhat here. I've been writing this while doing other things, so I come back to it from time to time.
A friend of mine has said that if corporations followed all the security options in the books, there would be no way for runners to successfully do runs against their buildings. And, I agree it would be much harder, but not to the point of being impossible. The reason I say that is there are two main parts to a security system; The technological element and the human element. (I suppose in Shadowrun you could add a magical element, but I would lump it with techological to make it the 'security element' or something perhaps.) And the easiest part to violate is the human element.
I /know/ there are people here who follow things like Defcon, H.O.P.E. (Hackers on Planet Earth) and the other different conferences. Some of the ones I've been catching up on lately have been stuff on Penetration Testing, where to quote the movie Sneakers:
Bank Secretary: So, people hire you to break into their places... to make sure no one can break into their places?
Martin Bishop: It's a living.
Bank Secretary: Not a very good one.
Shadowrunners are in a unique position to be able to offer themselves out for that position, and some people can use that as legwork for future runs in the area. but what I am looking at is the opposite side of the coin, which has been discussed here a bit, such as in http://forums.dumpshock.com/index.php?showtopic=26993, How do buildings handle security?
Security has to be developed to be non-disruptive to the work being done. At the enterances, the security will be there to let the good people in and keep the bad ones out. But the more invasive the procedures are, the more it delays people, the less productive these people are, and thus the more your business suffers. But make security too easy and you'll let too much slip past.
I don't remember the exact quote off the top of my head, but Burn Notice had an saying in one episode something like "Proceed far enough into a high security building and you'll notice the security will disappear", I believe it was specifically referring to cameras and the like if I remember the quote, because the idea was not so much about monitoring, since they know you belong, but more on securing the stuff that's there. You stop using cameras in the internal areas and instead rely on security doors, for example.
The presence of magic can make monitoring and detection easier, though. Not to mention wards, watchers and the like, there is astral perception. I don't know if it's been duplicated in SR4, but in SR3, if you see an aura even on a 1 in Astral Perception, you can recognize it again when you see it. No memory check, just 'Yeah, I know that aura'. I don't know if you immediately know its Bob in Accounting, but you know you've seen it before. Which leaves mundanes in trouble since they can't change their auras. But with that in mind (and the fact aura reading can also pick up emotional states), why not have a couple magic types watching the enterances, scanning everyone who walks in, seeing if they know their aura and checking the emotional states. Anyone who doesn't match a known aura or has a problematic emotional state will be watched, maybe approached for help as if they were a customer (and could be subject to spells like 'Mind Probe' depending on your take on 'Does the subject experience the memories of a mind probe that the caster receives?', or maybe simpler spells to find out what they are doing here). This approach also lets you weed out disgruntled employees for your Corporate Brainwashing Sessions, whether its Paranoia-like 'Respect the Computer, The Computer is Your Friend' or something simpler like 'Workplace Safe Interactions' or 'Anger Management And You'. Especially if you make these on Simsense, lovely things psychotropes can do to people. Heck, you could have an odorless gas in the air, or chemicals in the food at the cafeteria and restaurants and the like (and the people putting it in the food could be programmed not to remember, so that they'll eat the same food without worry); imagine the run potentials there, too.
And where do tricks like this come from? From corporations using their own Penetration Testing teams, or basically, Shadowrun teams on their payroll. They live the 'good' life, brainwashed the same way to respect the company but given a bit more lateral thinking options than corpers would, so they can think outside the box. Now, your penetration testers find a lot of things your shadowrun team would think of. If you can find it, the show 'Tiger Team' had two episodes based on that, one against a Car Dealer and the other against a Diamond dealership. The movie Foolproof showas examples of how normal people can do flaw finding for a 'living' after all (and, please, can someone tell me what they meant by 'lancing a safe'? I have ideas based on the scene's context and props, but I am curious).
Your Penetration Testers would look at the system and act like Shadowrunners would. They would find technological shortcomings like the fact that the position of your security cameras creates blindspots or the motion sensors are not properly calibrated or that your security guards are too lazy or whatever.
So, looking at building security and possibility as a valid shadowrun target, I think it depends on the style of your team, skills available, and the level of the corp.
A low level store, like mom and pop's corner store may have one camera over the door facing the register and a safe below the counter using a combination lock.
The lowest tier of corporate building would be like a modern day office building I would think. Maybe add a few more cameras and the like for security, but it is laid back more of a friendly atmosphere, with a 'We're too small to bother with' sort of attitude when it comes to security.
Then you get into tier two corporate buildings, where there are security guards with some powerful guns, employees with badges and keycards and the like rather than just doors, a single group on matrix server.
Tier three, more keycards and keypads, maybe some biometrics, Different groups on the matrix servers, patroling guards, maybe some magic, etc.
And just keep building up from there until you get to the point of megacorps that have every piece of hardware in there, all sorts of magical security, everything. It's to the point you can't take a piss without it being drug tested, labelled and tracked until it is recycled into water because they want to make it a purely closed system to prevent outside tampering.
Basically, once you get to the high end, standard runners who go in guns blazing or stealth sneaking are likely going to be facing their worst nightmares and need to come up with stuff that will be completely brand new to try and find ways in. After all, when you have more money than God and the human resources to back it up, why would you leave any flaws in there if you could prevent it?