Interoperability will decide who wins the next decade of access control
by Pete Jones, Founder and Managing Director, Third Millennium
We are at one of those rare moments where the forces reshaping physical security are genuinely transformational in ways that will demand a fundamentally different approach from manufacturers, integrators and end-users alike.
The pressures are converging from multiple directions at once: threats that were theoretical a decade ago are now immediate; user expectations have been reset by consumer technology; the regulatory environment is tightening; and the long-standing boundaries between physical security, cybersecurity and IT are dissolving. Together, these shifts constitute a reckoning that the industry can no longer ignore.
The end of the perimeter: when cyber and physical security become one
For much of its history, physical security operated in a world of its own — readers, cards, controllers and cables were largely disconnected from the IT infrastructure around them. That separation no longer exists and the consequences are significant.
The rise of zero-trust architectures is pushing organisations to rethink how identities are authenticated and verified across both digital and physical environments simultaneously. Zero trust treats every access request as potentially hostile and requires continuous verification rather than one-time authentication. Applying that to physical access — where a credential presented at a door has historically been sufficient to grant entry — demands a more dynamic, software-driven approach to credentialing and a move away from legacy technologies never designed with today's threat landscape in mind.
Layered on top of this is quantum computing. Quantum computers will eventually be capable of breaking many of the encryption methods that underpin current access control systems — and that prospect is already influencing procurement decisions today. Infrastructure deployed now will still be operational when quantum computing matures, so buying on the assumption that current cryptography will remain secure is a risk organisations cannot afford to take.
This is where open standards become critical. OSDP introduced secure channel communication between readers and controllers, but its underlying cryptographic foundations are ageing and there is now active work to evolve it towards quantum-resistant models. Whether a system can be updated to support post-quantum cryptography should be on every specification checklist.
Probing for weakness: the case for ethical hacking
One of the more underappreciated shifts in how the security industry must operate is the growing importance of adversarial testing — deliberately probing systems in a controlled way to find vulnerabilities before malicious actors do. Ethical hacking, long established in cybersecurity, is now essential for physical security as systems become increasingly software-driven and connected.
In access control, this means analysing communication protocols, examining how credentials are handled and stress-testing devices to identify weaknesses. The value of an independent, external perspective is critical: as manufacturers, our design assumptions create blind spots. An ethical hacker, approaching a system without those assumptions, only needs to find one overlooked vulnerability to fundamentally change your understanding of your own product.
Discovering a vulnerability is only part of the process: what matters equally is how that information is handled. Responsible disclosure and working collaboratively with vendors to remediate issues are essential to maintaining trust across the supply chain.
Ethical hacking is not a one-off exercise. As new credential types, communication standards and encryption approaches emerge, there is always a fresh surface to test. It functions as a continuous feedback loop for innovation — treating vulnerabilities the way a good manufacturer treats product defects: as signals to be acted on, not liabilities to be managed quietly.
The credential in your pocket - and the intelligence behind the door
Ask most people in the industry what single technology will have the greatest visible impact on physical security in the coming years, and the answer is mobile access — specifically, wallet-based credentials embedded in Apple and Google platforms.
Earlier generations of mobile access, relying on proprietary applications, faced real adoption barriers: app downloads, version management and deployment overhead made them operationally complex. Wallet credentials are different in kind, not just degree.
Sitting alongside boarding passes, payment cards and digital driver licences, wallet credentials are fast, often accessible without unlocking a device and built into tools people already use continuously. Security is also materially enhanced: they leverage the device's underlying security architecture, including secure elements, encryption and biometric authentication, and issuance and revocation can be managed remotely.
The data supports this direction. HID’s 2026 State of Security and Identity Report found that security improvements now lead adoption decisions at 50%, with convenience at 34% — a notable shift reflecting growing recognition that mobile credentials deliver robust protection as well as ease of use. As the two major mobile ecosystems converge towards standardisation, adoption will accelerate significantly.
Running in parallel is the rise of artificial intelligence within smart buildings. Access control software will increasingly incorporate intelligent systems capable of monitoring usage patterns, detecting anomalies and predicting threats before they occur — a radical departure from systems that are, by design, reactive. AI also has the potential to deliver the industry's long-held ambition: genuinely frictionless access, where a system infers not just that a person is present, but that they are authorised and intend to pass through.
That level of intelligence requires AI to draw on data from multiple sources simultaneously — access control, video surveillance, building management systems, IT networks and more. The real transformation is not AI in isolation, but AI combined with open, interoperable platforms that allow data to flow and be analysed at scale.
Regulation requires careful thought
Any serious assessment of the decade ahead must engage with the regulatory dimension. As AI becomes more deeply embedded in security infrastructure, concerns around privacy, transparency and accountability are moving from compliance checklists to genuine purchase criteria.
The EU AI Act is setting out clear requirements for high-risk applications in security and surveillance. For access control, the implications are concrete. Data governance demands greater rigour: biometric data must be collected, processed and stored with strict privacy safeguards and organisations will need to demonstrate compliance rather than simply assert it. Explainability is becoming a requirement: AI-driven decisions on access denial or behavioural anomalies must be auditable. And bias must be designed out, not retrofitted.
The scale of the attitudinal shift is striking. HID's research found that 67% of end users now express concern about the ethical and privacy implications of biometrics, compared to 31% the previous year. Privacy has moved from a backstory to a headline and organisations that treat this as a compliance burden will find themselves at a disadvantage against those that treat it as a design principle.
Regulation, handled well, is a catalyst. Clear rules accelerate the adoption of open standards, establish a level playing field and create the conditions in which AI-enabled security can earn the trust it needs to fulfil its potential.
Interoperability enables future proofing
Looking across these forces together — cyber-physical convergence, quantum-era cryptography, adversarial testing, mobile credentials, AI and tightening regulation — the common thread is clear. The organisations that navigate the next decade well will prioritise interoperability over lock-in, treat long-term resilience as a design requirement rather than a sales point and build the flexibility to adapt as technology evolves.
For manufacturers, that means investing in open standards, supporting phased migration paths that work in the real world of constrained budgets and subjecting systems to rigorous adversarial testing as a matter of course. For integrators and end-users, it means asking harder questions at procurement — not just whether a system works today, but whether it is built to survive the threat landscape of the future.
Physical security has always been about protecting what matters. The tools available to do that have never been more powerful or more complex. The reckoning the industry faces is not a crisis - it is an invitation to build something genuinely better.
About the Author
Pete Jones is Founder and Managing Director of Third Millennium, a Welsh manufacturer of advanced access control solutions and part of HID, a global provider of trusted identities solutions.
