There was a time when physical security and cybersecurity occupied two very different worlds. One was concerned with the nuts and bolts of locks, doors and perimeter protection. The other focused on networks, software and digital threats.
Today’s modern access control systems – used in everything from offices and hotels to hospitals and data centres – combine the two, fusing mechanical engineering and cloud platforms. That means that a door is no longer simply a physical barrier. Instead, it’s a connected endpoint within a much wider digital ecosystem. And it’s changing expectations across the industry.
Increasingly, developers, architects and operators are turning their backs on separate products in favour of integrated access solutions that combine doors, locks, access controls, environmental monitoring and digital management into a single, connected system.
A new connected approach to security
This change is part of a wider shift in the way that security itself is perceived
This change is part of a wider shift in the way that security itself is perceived. Traditionally, physical security was about keeping unauthorized people out. Today, it’s about making sure the right people have the freedom to move within a restricted space.
That is particularly important in places such as hospitals, data centres and other critical infrastructure, where security helps protect essential services while minimizing disruption. And it’s why our Research & Security Center (R&S) in Berlin, Germany, brings together both disciplines under one roof. Their job is to test products against both physical attacks and cyber threats.
Employing unconventional tactics
Sometimes, that means employing unconventional tactics, such as using professional lockpickers to test the security and resilience of new physical products. While modern locks are still based on mechanical engineering, they are more advanced than they look. Improvements in design, materials, and manufacturing mean they are stronger, more reliable, and harder to tamper with. But there’s more to locks than just security.
Some systems can even use the motion of inserting and turning a key to generate a small amount of electrical energy, which provides energy to power extra functions without wiring or batteries. This means they are not just standalone locks but can also be used as part of wider digital access systems.
Bridging physical and digital security
For instance, great strides have been made recently in terms of biometric authentication
However, as everyone knows, digital systems have their own security risks, especially now that artificial intelligence (AI) is part of the emerging threat. This means the cybersecurity team needs to ensure that systems are robust enough to withstand a wide range of risks – from attempts to breach access platforms to phishing attacks – as well as other tactics designed to exploit human behavior.
It’s here that researchers adopt a ‘hacker’s mindset’ to keep systems safe. And that means continuously testing, probing, and strengthening systems to identify vulnerabilities against existing real-world threats while also anticipating what might be around the corner.
Mobile-based access control systems
For instance, great strides have been made recently in terms of biometric authentication, including facial recognition and fingerprint scanning. Similarly, smartphones are increasingly being used to secure credentials for mobile-based access control systems.
But improvements in technology also come with their own risks. For instance, For instance, AI-generated deepfake videos and voices are becoming more convincing, making it easier to trick people into giving access, sharing information or approving actions they should not.
And as I alluded to earlier, criminals are now using AI and automated tools to identify weaknesses and exploit them much faster than before, sometimes with little or no human involvement. But it’s also true that it’s being used to bolster defences. Work is currently underway to use AI to analyze data in real time to identify unusual entry times, identify multiple failed authentication attempts, or spot any other anomalies that might suggest someone is trying to gain entry illegally.
Modern access control
Cloud-based platforms allow security teams to issue and revoke credentials remotely
Increasingly, the value of modern access control lies not just in the hardware, but in the software that sits behind it. Cloud-based platforms allow security teams to issue and revoke credentials remotely, monitor activity across multiple sites and respond quickly to emerging threats.
This makes security a real-time, always-on, continuously managed service rather than a collection of standalone products installed and largely forgotten about.
The importance of regulation and compliance
This is something that policymakers are aware of. In the European Union, for example, the EU’s NIS2 Directive relates to cybersecurity protecting network and information systems and significantly broadens both the scope and the obligations for compliance. It also takes an “all-hazard” approach to security, which means protecting not just digital networks and systems, but also the physical environments in which they operate.
Similarly, the EU’s Cyber Resilience Act is designed to ensure that all digital products are safe from cyber threats. Its goal is to ensure that connected devices and software are built, updated, and maintained with security in mind, helping protect users in an increasingly connected world. And by introducing clearer requirements and standards, the CRA will help consumers and organizations identify products with strong security features and configure them more securely from the outset.
Security by design
Security can no longer be treated as something that is bolted on at the end of the development process
In both cases, it is incumbent on vendors not only to meet or exceed these rules and regulations but also to keep customers, the wider industry, and other stakeholders informed about developments.
For me, these regulations also reflect a broader shift in thinking. Security can no longer be treated as something that is bolted on at the end of the development process or addressed only after a vulnerability has been identified. Instead, it needs to be considered from the very beginning and maintained throughout a product's lifecycle. For manufacturers, that means continuously assessing risks, testing products against emerging threats and ensuring they remain resilient as technology and the threat landscape evolve.
As I said at the beginning, the reason is simple. Today's buildings are no longer just bricks and mortar. They are connected environments where doors, locks, cameras, sensors and access control systems increasingly communicate with one another and with cloud-based platforms. You might want to think about that the next time you walk into a secure building.
