Cybersecurity capabilities are emerging as a growing concern in physical access control infrastructure, with nearly one-third of security professionals surveyed by Mercury Security saying their existing controller systems lack needed cybersecurity features.
Mercury Security’s newly released 2026 Trends in Access Controllers Report found that 32% of respondents identified cybersecurity features as missing from their current controller systems, up from 21% in 2025. At the same time, 74% said cybersecurity and IT coordination have become more complex to manage.
The report is based on a global survey of 561 physical security and cybersecurity professionals, including administrators responsible for access control management, systems integrators, installers and end users.
Despite the reported infrastructure gaps, 86% of respondents said their organizations actively work to stay current with changing cybersecurity and data protection standards.
“Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace,” said Steve Lucas, vice president of sales at Mercury Security. “As they look to modernize, users also want to protect existing investments. That makes interoperability increasingly important and puts more weight on choosing controller platforms that can address current security requirements while providing the flexibility to support what comes next.”
Controllers take on a larger role
The survey found 78% of respondents now consider the controller important or critical to their physical access control system strategy, compared with 72% in 2025.
As controllers connect more devices, systems and applications across the security environment, organizations are placing greater emphasis on infrastructure capable of meeting current requirements while accommodating additional capabilities over time.
Interoperability is playing a significant role in those decisions. Sixty-nine percent of respondents identified interoperability as a critical factor in controller procurement, while 82% said backward and forward compatibility is important to future infrastructure planning.
The findings indicate organizations are looking for ways to modernize gradually while preserving existing investments and maintaining the ability to add new capabilities.
Mobile credentials are also influencing controller strategies. Half of respondents said they are already using or planning to adopt mobile solutions, while 46% ranked mobile credential integration among the trends driving controller purchases.
Cloud interest outpaces deployment
Cloud connectivity was cited by 56% of respondents as a factor influencing controller purchases, up from 50% in 2025.
Current deployments have not reached the same level. Forty-one percent of respondents said their controllers are cloud-enabled, while 26% identified cloud enablement as a capability missing from their existing systems.
The results indicate demand for cloud capabilities is growing faster than their deployment within existing controller infrastructure.
AI and edge computing create additional demands
The survey also found growing interest in technologies that can place additional demands on access control infrastructure.
Behavioral analysis and anomaly detection were cited by 56% of respondents in 2026, up from 44% in 2025. Facial recognition was cited by 60%, while 50% cited predictive security and threat prevention.
As these applications develop, controller selection increasingly involves considerations around processing power, storage, connectivity, cybersecurity and integration architecture.
More than 39% of respondents said they are exploring or have adopted edge computing within their security ecosystems. Another 41% have integrated controller data with building occupancy and utilization programs, extending the use of access control infrastructure beyond traditional door control.
Taken together, the survey findings point to controller procurement becoming a longer-term infrastructure consideration as organizations weigh reliability and cybersecurity requirements against interoperability, cloud connectivity and the ability to accommodate emerging technologies.
The full 2026 Trends in Access Controllers Report is available here.
