CYBERSECURITY gaps in physical access control systems are widening, with 32 percent of security professionals reporting that cybersecurity features are missing from their current systems, according to a 2026 global survey of physical security and cybersecurity professionals.
The findings are from Mercury Security's 2026 Trends in Access Controllers Report, based on a survey of 561 professionals conducted in early 2026. Respondents included access control administrators, system integrators, installers, consultants, original equipment manufacturers and end users.
The report found that the share of respondents identifying missing cybersecurity features rose from 21 percent in 2025 to 32 percent in 2026, an 11-point increase in one year. The report described the trend as evidence that "the gap between what organizations need and what their installed infrastructure actually delivers is widening."
At the same time, 78 percent of respondents rated the controller as important or critical to their physical access control system strategy, up from 72 percent in 2025. More than 90 percent assigned meaningful significance to controller selection.
"Organizations recognize the cybersecurity risks facing connected access control systems, but the infrastructure in place isn’t always keeping pace," said Steve Lucas, vice president for sales at Mercury Security, in the company's statement accompanying the report.
"As they look to modernize, users also want to protect existing investments. That makes interoperability increasingly important and puts more weight on choosing controller platforms that can address current security requirements while providing the flexibility to support what comes next," Lucas said.
Interoperability was identified as a critical factor in controller procurement by 69 percent of respondents, while 82 percent said backward and forward compatibility was important to future infrastructure planning. The report said the findings reflect a preference for gradual modernization while protecting existing investments.
Cloud connectivity was cited by 56 percent of respondents as a top purchase driver, up from 50 percent in 2025. However, only 41 percent said their controllers were cloud-enabled, while 26 percent reported that cloud enablement was absent from their systems.
The report said, "interest in cloud is rising faster than deployment levels," highlighting the gap between demand and existing infrastructure.
Mobile credentials are also gaining importance, with half of respondents already using or planning to adopt mobile solutions. Mobile credential integration ranked among the leading purchase trends at 46 percent.
The survey also found growing complexity in managing access control systems. Eighty percent said AI, automation and advanced features were more difficult to manage than three years ago, while 74 percent reported greater complexity in cybersecurity and IT coordination.
AI-related applications are also influencing controller requirements. Sixty percent of respondents identified facial recognition as a use case likely to affect physical access control, followed by behavioral analysis and anomaly detection at 56 percent and predictive security and threat prevention at 50 percent.
Interest in behavioral analysis and anomaly detection rose from 44 percent in 2025 to 56 percent in 2026, a 12-point increase.
The report also found that more than 39 percent of respondents were exploring or had adopted edge computing in their security ecosystems, while 41 percent had integrated controller data with building occupancy and utilization programs.
