Almost a third of physical security and cybersecurity professionals say their building access controllers lack cybersecurity features, according to Mercury Security’s 2026 Trends in Access Controllers Report. The finding highlights a gap for businesses using connected systems to manage who enters their premises.
The global survey of 561 professionals found that 32% reported missing cybersecurity features, up from 21% in 2025. Access controllers manage entry through doors and connect with other security systems. As these connections grow, businesses must consider cybersecurity alongside the systems’ ability to control access.
“Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace,” said Steve Lucas, vice president, Sales, Mercury Security. “As they look to modernize, users also want to protect existing investments. That makes interoperability increasingly important and puts more weight on choosing controller platforms that can address current security requirements while providing the flexibility to support what comes next.”
Mercury Security, an open architecture access control hardware and an HID brand, surveyed administrators responsible for access control management, systems integrators, installers, and end users, among other professionals.
The report found that 74% said managing cybersecurity and coordination with IT teams had become more complex. Also, 86% said their organizations worked to keep up with changing cybersecurity and data protection standards.
For businesses upgrading their systems, compatibility matters. Some 69% identified interoperability, or the ability to work with other systems, as critical when buying controllers. Another 82% considered compatibility with older and newer technology important for future planning.
Businesses want to upgrade their access systems while keeping existing equipment and adding new features. Half of respondents already use or plan to adopt mobile credentials, which allow people to use their phones to gain access.
Cloud connectivity influenced purchases for 56% of respondents, up from 50% in 2025. However, only 41% said their controllers connect to the cloud, while 26% reported that this capability was missing.
Interest in advanced security functions also grew. Behavioral analysis and detection of unusual activity rose from 44% to 56%. Facial recognition was cited by 60%, while predictive security and threat prevention were cited by 50%.
The report said these applications make processing power, storage, connectivity, and cybersecurity greater considerations when choosing controllers. Also, 41% had linked controller data to programs tracking building occupancy and use, extending their role beyond door access to help organizations understand how premises are used.