Access control has moved from mechanical locks and prox cards to phone-based credentials, cloud-managed platforms, and tight integration with surveillance, HR, and building automation. The 2026 decisions being made now about access control infrastructure will shape the next decade of every building.
01The death of the prox card.
125 kHz prox credentials, the standard for 25 years, are trivially clonable with a $30 tool from Amazon. Every access-control refresh should move to encrypted smart credentials (iCLASS SEOS, DESFire EV2/EV3, MIFARE Plus) or mobile credentials.
Plain prox remains in place in many operations because it's cheap and "worked fine." It does not work fine against a motivated attacker. Any security audit of a facility with prox-only credentials will flag this.
02Mobile credentials are now mature.
Phone-as-key via Bluetooth or NFC is now reliable. HID Mobile Access, Brivo Mobile Pass, Openpath, Kisi, the products work, the user experience is clean, and the security model is stronger than most physical credentials.
The soft case: users always have their phones. Issuance is instant (email invite, no physical card to mail). Revocation is instant (toggle off in the admin panel). The hard case: the one user who refuses to install an app on their personal phone. Offer a fob fallback, move on.
03Cloud-managed platforms: pros and cons.
Cloud access-control platforms (Brivo, Openpath/Avigilon Alta, Kisi, Genetec Cloudrunner) have transformed the admin experience. Managing a 30-door, 400-user system from a browser is genuinely better than the old on-prem ACM client.
The tradeoff: ongoing subscription ($5–$12/door/month typically), and an operational dependency on the platform's uptime. Both are manageable. The productivity win usually exceeds the subscription cost within 12 months.
04Integration is where the value is.
Access control integrated with surveillance (Avigilon/Genetec/Milestone + the ACS) delivers "show me video from when this door opened." Integration with HR systems auto-provisions and de-provisions credentials based on employment state. Integration with visitor management creates clean audit trails.
A standalone access-control system is table stakes. An integrated platform is meaningfully better. The 2026 project worth doing is the one that connects the pieces.
05The hardware lasts 15 years. Choose accordingly.
Readers, door controllers, and associated cabling typically remain in service 15–20 years. The platform decision made today is really a decision about the next decade-and-a-half of the building.
Specify hardware that's not locked to a single cloud platform. Mercury-compatible controllers (the industry standard) can move between Brivo, Genetec, S2, Openpath, and others. This preserves flexibility as the platform market evolves.
Access-control installations live today across 22 sites, a Naples medical office with Genea, a Fort Myers industrial tenant on Brivo, three HOAs on ButterflyMX for resident mobile access, and two law firms on Openpath. Mercury-compatible hardware on everything over 16 doors so the cloud platform is never a lock-in.