Beyond the badge: The new identity imperative

NEW YORK—As physical security, cybersecurity and enterprise risk become increasingly interconnected, access control is undergoing a fundamental transformation. What was once a conversation about doors, readers and credentials is now centered on identity, data governance and organizational resilience.

Ahead of the Security Industry Association’s (SIA’s) Securing New Ground (SNG) conference in New York City on Oct. 20-21, Security Systems News spoke with Matt Butts, executive vice president, Americas, at Gallagher Security, and Kyle Gordon, executive vice president of global revenue and customer experience at AMAG Technology, about the market forces driving change, evolving customer expectations, and why identity is becoming the foundation of modern security strategies.

SSN: Why is now the right time for Securing New Ground to dedicate a session to access control and identity, and what are the biggest forces reshaping the market today?

Matt Butts: Three forces are converging at once. Physical and cyber threats are no longer separate conversations, technology is evolving faster than most organizations' investment cycles, and geopolitical instability has turned identity verification into a boardroom risk conversation rather than a back-office IT decision.

Kyle Gordon: For a long time, this category was about the door. You picked a platform, deployed readers and panels, and revisited it every five or seven years when the hardware aged out. That's not the conversation anymore. It's about the people walking through the door, not the door itself.

Two forces are driving that shift. First, identity has become the actual question, not access. Who is this person, what are they authorized to do, does that match what HR or the contractor system says it should be, and can I prove that months from now when an auditor asks?

SSN: The concepts of access and identity are becoming increasingly intertwined. How has that relationship evolved, and what does it mean for security leaders?

Butts: Access used to be about what you were given, a badge or a code. Identity is about who you actually are, and innovation is closing that gap fast. Mobile credentials are significantly harder to compromise than something that can be lost or handed off, which is why adoption is accelerating. But that shift comes with real responsibility.

Security leaders are now protecting some of the most sensitive personal data an organization holds, and it has to be safeguarded to the most stringent standards.

Gordon: I'd actually push back a little on the premise. Access and identity were never two separate conversations. They were always the same conversation. We just let the industry pull them apart.

The honest reason they got treated as separate disciplines is that standard access control was never built to satisfy the major elements of identity management. It could tell you a badge opened a door. It couldn't tell you whether that badge should still exist, whether it matched what HR had on file, or whether the person behind it had three other accounts nobody had reconciled.

What's happening now isn't convergence so much as correction. The technology is finally catching up to what should have been true all along, that access is just the physical expression of identity, and if you're not managing them as one continuous thing, you're managing risk you can't see.

SSN: What are the most significant changes you're seeing in customer expectations when it comes to access control and identity management?

Butts: The bar has moved from "does this keep people out" to "what else can this do for the business." Customers want broad integration that unlocks value well beyond security, workforce data, compliance, and operational insight.

Gordon: The biggest shift is security has been pulled out of its own corner. It used to be able to operate in its own little section, run its own systems, and report up through its own narrow channel. That's not true anymore. Stakeholders across the business now expect security to be part of the bigger conversation, and that's happening for two reasons.

First, these systems sit on genuinely rich data, who came in, when, how often, patterns of behavior across a portfolio of buildings, and other parts of the business want to use that data, not just security.

Second, an access control and identity system that isn't properly maintained is now understood as a real vulnerability, not just a security department problem, but an enterprise risk that shows up in board reporting and audit conversations.