Mercury Security survey: one in three organizations say access controllers lack needed cybersecurity features

Mercury Security, an HID brand, published its 2026 Trends in Access Controllers Report based on a global survey of 561 physical security and cybersecurity professionals. The headline finding: 32% of respondents said their existing access control hardware lacks the cybersecurity features their organization now requires — up from 21% just one year earlier. At the same time, 74% said managing cybersecurity and IT coordination has become more complex.

The report also shows that reliability and uptime remain the top purchasing priority for physical access controllers, cited by 57% of respondents, followed by cost-effectiveness at 34% and cybersecurity features at 30%. Interoperability — the ability for controllers to work with cameras, cloud platforms, and other security systems — was rated critical by 69% of respondents. Only 41% of controllers currently in use are cloud-enabled, suggesting many deployments are running hardware that cannot meet where organizations say they want to go.

For facilities managers and security directors, the data points to a growing gap between what existing access control infrastructure can do and what organizations now expect of it. A controller (the hardware panel that manages who can open which doors) is increasingly expected to support cloud connectivity, integrate with video and IT systems, and meet modern cybersecurity standards — roles it was often not designed to fill. Organizations planning a refresh or expansion of their access control systems may want to evaluate controllers against cybersecurity and interoperability criteria alongside the traditional reliability and cost factors.