For decades, access control was viewed as a purely physical security function. The objective was straightforward: ensure the right people could gain access to the right areas at the right time. If the doors opened when they should and remained locked when they shouldn’t, most organisations considered the system secure. ย That mindset no longer reflects reality, writes Mike Gillespie, of the information security and governance consultancy Advent IM.
Access control platforms are highly connected business systems. They integrate with cloud services, CCTV platforms, identity providers, visitor management systems, HR databases, building management systems, mobile credential applications and enterprise networks. While this convergence has delivered significant operational and security benefits, it has also fundamentally changed the nature of the risk. ย Access control is no longer just about controlling access to a building. It has become a critical component of organisational cyber resilience.
As I have argued for many years, cybersecurity is not an IT problem; it is a business problem. The same principle applies to access control. As soon as a system becomes connected, it becomes a target. The challenge for security professionals is recognising that modern access control systems now sit directly within the cyber threat landscape.
Expanding attack surface
The security industry has embraced digital transformation at pace. Cloud-based administration, mobile credentials, integrated security operations, AI-driven analytics and smart building technologies have all become mainstream. These innovations have delivered undeniable benefits. Security teams can manage multiple sites remotely, rapidly provision or revoke credentials, gain deeper operational insights and respond more effectively to evolving threats. ย However, every connection creates another potential attack path.
Government agencies such as NCSC and NPSA continue to warn that internet-connected operational technologies remain attractive targets for cyber criminals and nation-state actors, particularly where weak authentication, poor asset visibility and exposed remote access services exist. In many organisations, physical security technologies fall outside traditional cybersecurity governance frameworks, creating blind spots that attackers are increasingly willing to exploit.
What concerns me is that many organisations still assume security technologies are inherently secure simply because they are security technologies. That is a dangerous assumption. Attackers do not care whether a vulnerability exists within a finance application, a CCTV platform or an access control server. They simply look for the easiest route to achieve their objective.
Lessons from the Verkada breach
One of the most significant examples of this reality emerged in March 2021 when cloud-based security provider Verkada suffered a high-profile compromise. Attackers gained access to the company’s platform through exposed administrative credentials associated with a support environment. Once inside, they were reportedly able to access live feeds from approximately 150,000 security cameras across customer environments, including hospitals, schools, manufacturers and corporate sites. More significantly for physical security professionals, access control information, including badge credential data for some customers, was also accessed. The incident exposed several uncomfortable truths.
First, a breach affecting a security technology provider can rapidly become a breach affecting hundreds or thousands of customers. Second, physical security systems must now be considered part of the wider attack surface. Third, trust alone is not a security strategy.
Many organisations assume that because a solution is delivered by a reputable security vendor, the risks have been transferred. The reality is very different. Cloud adoption delivers enormous benefits, but organisations remain responsible for understanding the cyber risks associated with the technologies they deploy.
The most important lesson from Verkada was not that a vendor was compromised. Vendors will continue to experience incidents because no organisation is immune from cyber attack. The real lesson was that access control systems are no longer isolated physical assets. They are cyber-physical systems capable of creating both digital and physical consequences when compromised.
New generation of threats
The threat landscape has evolved dramatically over recent years. ย Ransomware groups are increasingly targeting operational technology environments and critical infrastructure sectors. Cybersecurity research has shown significant growth in ransomware activity impacting operational environments, with attackers seeking not only to steal data but also to disrupt operations and business continuity. In many cases, the initial compromise originates within traditional IT environments before attackers attempt to move towards operational systems.
The implications for access control are obvious. ย A compromised access control platform could potentially allow an attacker to create or modify credentials, unlock secured areas, disable physical security controls, disrupt emergency procedures, access sensitive operational information and in many cases move laterally into other connected systems. This is not simply a facilities management issue or a physical security issue. It is an enterprise risk issue.
AI: defender and adversary
Perhaps the greatest change facing security professionals today is the rapid adoption of artificial intelligence (AI). ย AI is already transforming the way physical security systems operate. Access control platforms can leverage machine learning to identify unusual behaviour, detect credential misuse, highlight anomalous access patterns and improve situational awareness across large estates.
Within modern security operations centres, AI can help correlate events from multiple systems, reduce false positives and provide faster visibility into emerging threats. In short, AI has the potential to become one of the most powerful defensive tools available to security professionals.
Unfortunately, it is equally attractive to attackers. ย Criminal groups are already using AI to automate reconnaissance, improve vulnerability discovery, create convincing phishing campaigns and enhance social engineering operations. Generative AI enables adversaries to produce persuasive communications at scale, often tailored to specific individuals or organisations. The result is an increasingly sophisticated arms race. Both defenders and attackers now have access to powerful new capabilities. Success will not depend on who has access to AI. It will depend on who uses it more effectively.
Building resilience
The good news is that many of the most effective security controls remain relatively straightforward. Organisations should focus on several core principles:
These recommendations align closely with guidance issued by government cybersecurity agencies regarding operational technology and internet-connected systems. Asset visibility, secure remote access and strong authentication remain among the most important controls available to defenders.
Future is converged
The physical security sector is undergoing a profound transformation. ย Access control systems are evolving into intelligent, connected platforms that support not only security outcomes but also workplace experience, operational efficiency and business intelligence. As organisations continue to embrace smart buildings, digital twins, automation and AI-driven technologies, the convergence between physical and cyber security will continue to accelerate.
The security profession must evolve accordingly. The organisations that continue to view access control as merely a door management system will struggle to address emerging threats. Those that recognise it as a business-critical cyber-physical platform will be far better positioned to manage risk and build resilience.
The future of security is not physical security or cybersecurity.
It is both.
And nowhere is that convergence more evident than at the door.
