Cybersecurity gaps are widening in physical access control systems as organizations connect more devices and applications while struggling to keep their controller infrastructure up to date, according to a global survey by Mercury Security.
Mercury Security’s 2026 Trends in Access Controllers Report found that 32 percent of respondents said cybersecurity features were missing from their existing controller systems, up from 21 percent in 2025.
The survey covered 561 physical security and cybersecurity professionals, including access control administrators, systems integrators, installers and end users.
At the same time, 74 percent said cybersecurity and information technology coordination had become more complex to manage, even as 86 percent reported that their organizations were working to keep pace with changing cybersecurity and data protection standards.
Bigger role
Controllers are also becoming more important in organizations’ long-term physical access control strategies.
About 78 percent of respondents considered controllers important or critical to their physical access control system strategy, up from 72 percent last year.
“Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace,” Mercury Security vice President for sales Steve Lucas said.
As organizations modernize, Lucas said they also want to protect existing technology investments, increasing the importance of interoperability and platforms capable of supporting future requirements.
The survey found 69 percent considered interoperability a critical factor when buying controllers, while 82 percent said backward and forward compatibility was important to future infrastructure planning.
Cloud gap
Demand for cloud connectivity is also growing faster than deployment.
Cloud connectivity was cited by 56 percent of respondents as a factor influencing controller purchases, up from 50 percent in 2025.
However, only 41 percent said their controllers were already cloud-enabled, while 26 percent identified cloud capabilities as missing from their current systems.
Mobile technology is similarly influencing purchasing decisions. Half of respondents either use or plan to adopt mobile solutions, while 46 percent identified mobile credential integration as a trend driving controller purchases.
AI demands
Emerging technologies are adding further pressure on infrastructure.
Behavioral analysis and anomaly detection were cited by 56 percent of respondents, up from 44 percent in 2025. Facial recognition was cited by 60 percent and predictive security and threat prevention by 50 percent.
More than 39 percent are also exploring or have adopted edge computing, while 41 percent have integrated controller data with building occupancy and utilization programs.
Mercury Security said the findings indicate that organizations increasingly view controller purchases as long-term infrastructure decisions rather than standalone hardware investments, requiring them to balance cybersecurity and reliability with cloud, AI and integration requirements. —Ed: Corrie S. Narisma
