A growing share of organisations say their access control systems are missing basic cybersecurity features, according to a new report from Mercury Security, an HID brand.
The Mercury Security 2026 Trends in Access Controllers Report surveyed 561 physical security and cybersecurity professionals worldwide, including administrators, systems integrators, installers and end users. It found that 32 per cent of respondents say cybersecurity features are missing from their current controller systems, up from 21 per cent in 2025.
The gap has widened even as security requirements around access control have grown. Seventy-eight per cent of respondents now consider the controller important or critical to their physical access control strategy, up from 72 per cent a year earlier. Seventy-four per cent said cybersecurity and IT coordination have become more complex to manage, while 86 per cent said their organisations are actively working to keep pace with changing cybersecurity and data protection standards.
“Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace,” said Steve Lucas, Vice President, Sales, Mercury Security. “As they look to modernize, users also want to protect existing investments. That makes interoperability increasingly important and puts more weight on choosing controller platforms that can address current security requirements while providing the flexibility to support what comes next.”
Interoperability shapes purchasing decisions
Sixty-nine per cent of respondents identified interoperability as a critical factor in controller procurement, and 82 per cent said backward and forward compatibility matters for future infrastructure planning. Mobile credentials are part of that shift too: half of respondents are already using or planning to adopt mobile solutions, and 46 per cent ranked mobile credential integration among the trends driving controller purchases.
Cloud demand outpaces what’s deployed
Cloud connectivity ranked among the leading factors influencing controller purchases, cited by 56 per cent of respondents, up from 50 per cent in 2025. But only 41 per cent said their controllers are currently cloud-enabled, and 26 per cent said cloud enablement is missing from their existing systems altogether.
AI capabilities add new demands
Interest in AI-driven features is also climbing. Behavioural analysis and anomaly detection rose from 44 per cent in 2025 to 56 per cent this year, facial recognition was cited by 60 per cent of respondents, and predictive security and threat prevention by 50 per cent. More than 39 per cent of organisations are exploring or have adopted edge computing within their security systems, and 41 per cent have integrated controller data with building occupancy and utilisation programmes.
Mercury has more than 8 million controllers installed worldwide and has operated as an open-architecture hardware platform since 1992. The full 2026 Trends in Access Controllers Report is available through HID.
