Mercury report reveals growing cybersecurity gap in access control systems

CYPRESS, Calif.—Mercury Security has released its 2026 Trends in Access Controllers Report, finding that cybersecurity challenges, interoperability requirements and emerging technologies are playing a larger role in how organizations approach physical access control infrastructure. 

The report, based on a survey of 561 physical security and cybersecurity professionals worldwide, found that 78% of respondents consider the access control controller important or critical to their physical access control system strategy, up from 72% in 2025. According to Mercury, the increase reflects the controller's expanding role as organizations connect more devices, systems and applications across their security ecosystems. 

Cybersecurity gap widens 

One of the report's key findings centers on cybersecurity. Thirty-two percent of respondents said cybersecurity features are missing from their current controller systems, compared with 21% a year earlier.  

At the same time, 74% reported that cybersecurity and IT coordination have become more complex, while 86% said their organizations actively work to stay current with evolving cybersecurity and data protection requirements. 

“Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace,” said Steve Lucas, vice president of sales for Mercury Security. “As they look to modernize, users also want to protect existing investments. That makes interoperability increasingly important and puts more weight on choosing controller platforms that can address current security requirements while providing the flexibility to support what comes next.” 

Interoperability remains key 

The survey also found that interoperability continues to influence purchasing decisions. Nearly 69% of respondents identified interoperability as a critical factor when procuring controllers, while 82% said backward and forward compatibility are important to future infrastructure planning.  

Mercury said the findings indicate many organizations prefer a gradual modernization strategy that preserves existing investments while allowing for future upgrades. 

Mobile credential adoption is also shaping controller requirements, with half of respondents either using or planning to deploy mobile credentials. Additionally, 46% ranked mobile credential integration among the trends influencing controller purchasing decisions. 

Cloud, AI influence controller purchases 

Interest in cloud connectivity is growing as well. Fifty-six percent of respondents cited cloud connectivity as a key factor in controller purchases, up from 50% in 2025. However, only 41% reported their current controllers are cloud-enabled, while 26% said cloud connectivity is lacking in their existing systems. 

The report also pointed to increasing demand for AI-enabled and advanced security applications. Behavioral analysis and anomaly detection were cited by 56% of respondents, up from 44% in 2025, while 60% identified facial recognition and 50% cited predictive security and threat prevention as important capabilities. Mercury noted that these applications place greater demands on processing power, storage, cybersecurity and integration architecture. 

Beyond traditional access control functions, respondents reported using controller data for broader operational purposes. More than 39% said they are exploring or have adopted edge computing within their security environments, while 41% have integrated controller data with building occupancy and utilization programs. 

According to Mercury, the findings demonstrate how controller selection is evolving from a hardware purchasing decision into a long-term infrastructure strategy, with organizations seeking solutions that balance cybersecurity, reliability and future technology adoption while avoiding large-scale system replacements. 

The full 2026 Trends in Access Controllers Report is available here. 

Related: Alocity integrates Mercury platform to expand AI-powered security offering

Photo courtesy of Mercury Security