Ask any facilities manager about their worst security moment, and you’ll rarely hear about a heist. You’ll hear about the fire door someone propped open with a bin for a week, or the contractor whose badge still worked six months after the job ended.
Small stuff, mostly. The kind that piles up.
Access control has spent the last few years turning from hardware into software, and lately into AI. Cameras now raise alarms without anyone watching the screen. Readers make split-second calls on whether a face is real. A lot of that is genuinely useful, though not all of it lives up to the sales deck.
Plenty of organizations have already jumped. According to research for ASIS International, two-thirds of organizations brought in new technology over five years so they could cut or reassign frontline security staff. Usually the first step is replacing aging hardware with building access control systems that tie readers, controllers and mobile credentials together. The AI layer tends to come later, once the basics behave.
So which pieces actually matter? Eight, by my count.
1. Biometrics are strong, until someone fakes a face
Badges get lost. Fingerprints don’t. That’s the whole pitch for biometrics, and it’s a good one, because face, iris, fingerprint and palm-vein readers make badge-sharing very hard.
Machine learning does the heavy lifting inside most modern readers. It’s why a camera can recognize you in a gloomy corridor wearing glasses you didn’t have last week.
It’s also why the threat picture changed. Back in 2024, Gartner predicted that deepfake attacks would lead 30% of enterprises, by 2026, to stop trusting face-based identity checks as a standalone control. Gartner was mostly talking about remote verification, the selfie-in-an-app kind, where attackers pipe synthetic video straight into the camera feed. Those injection attacks jumped 200% in 2023, it said.
A physical door faces cruder tricks, like a printed photo, a phone video, or occasionally a mask. Still, the fix rhymes. Ask vendors for liveness detection tested by an outside lab, not just their own marketing team. For rooms that really matter, pair the face with something else. AI that can simulate real people convincingly isn’t getting worse.
2. Phones replaced the plastic card
This one barely needs selling. People already pay, board planes and log in to work from their phones, so tapping a door with one feels natural.
What actually sells it to security teams is control. A digital credential can be cancelled from a laptop before the person who quit has reached the car park. For companies spread across several sites, one admin team can manage everyone’s access without a drawer full of spare cards.
Expect pushback on personal devices. Some staff simply won’t put work credentials on their own phone, and somebody will always forget theirs at home. Decide in advance what happens then.
3. Cameras stopped just recording
Here’s where AI earns its keep most visibly. Old CCTV was a time machine at best. You went back and looked after something happened. Analytics change the timing. They spot tailgating (two people through on one badge), somebody lingering by a side door, a door forced open, or someone wandering where nobody should be.
Hook the cameras into the access system and they can confirm the person tapping in matches the credential. They can also show where a visitor actually went, which isn’t always where they were supposed to go.
Bad tuning ruins all of it, though. If operators get two hundred alerts a shift, they’ll mute most of them, and then you’ve paid for an expensive way to be ignored. Test on a few doors first and count how many alerts were real. There’s a privacy angle as well, covered further down.
4. One dashboard for every building
Anyone responsible for more than one site will appreciate cloud-hosted control quickly. Changing a door schedule used to mean a drive, or at least a phone call to someone on site. Now it’s a login.
Integration is the quieter benefit. Cloud platforms connect more readily to HR systems and identity providers, along with whatever sensors you’ve installed, and AI analytics need exactly that pooled data to be any use.
Before signing, ask one uncomfortable question: when the internet goes down, do the doors still work? They should. Logs should sync up later too.
5. A second check for rooms that deserve one
Multi-factor authentication isn’t new to IT people. Okta’s figures for its workforce customers show MFA adoption reached 70% of users logging in to work apps by January 2025. Doors are catching up. Pharmacies, labs, and server rooms increasingly ask for a phone credential plus a PIN, or a card plus a fingerprint.
That 70% is about software sign-ins, to be clear. Still, more organizations now run physical and digital access off one identity platform, so the same rules can follow a person from laptop to lab.
AI’s contribution is judgment about when to ask. A normal Tuesday entry might sail through on one factor. A credential that has never touched the server room, trying it at 2 a.m., probably shouldn’t.
6. Wireless locks fill the gaps
Every older building has doors nobody ever wired. Think of the paint store, the spare classroom, a cupboard full of laptops. Wireless locks bring them into the system without an electrician spending a week inside the walls.
Treat each one like a tiny networked computer, because that’s what it is. Without encryption and regular firmware updates, a convenient lock can become the easiest way in.
7. Visitors who leave no loose ends
Guests should get in quickly and leave nothing behind. Good visitor platforms handle the whole loop. Guests pre-register, scan a QR code at a kiosk, and get a credential that only opens certain rooms and dies at a set time.
AI adds watchlist screening and pattern-spotting, plus links to video, so security can see a guest’s real route through the building. Resist the urge to hoover up data, though. Collect what you need, delete it when you said you would. Regulators under GDPR or HIPAA will thank you, and so will your visitors.
8. Logs that hold up later
Access logs feel like admin trivia right up until an investigation, when they suddenly become evidence. Some vendors now push blockchain-backed logs to prove nobody edited them.
My honest take? Most buildings don’t need it. Write-once storage, locked-down admin rights and routine exports give you tamper-resistant records without the complexity. Blockchain might make sense for a few regulated, multi-party setups. It shouldn’t be anyone’s first upgrade.
Biometrics come with legal strings
Buyers sometimes learn about biometric privacy law from a lawsuit. Better to learn it here.
Illinois sets the tone in the US. Its Biometric Information Privacy Act demands notice and written consent before an employer collects fingerprints or face scans, and it has led to settlements in the tens or hundreds of millions of dollars. A 2024 amendment capped damages at one recovery per person rather than one per scan. Even so, at up to $1,000 per negligent violation and $5,000 per intentional one, multiply by a few thousand employees, and the number gets uncomfortable fast. Other states have rules of their own.
Europe is moving too. Under the EU AI Act, emotion recognition at work has been banned since February 2025. Biometric identification counts as high-risk, with most obligations landing in December 2027. Plain verification, which just confirms you are who you claim to be, sits outside that bucket, though data protection law still applies.
So bring a lawyer in before the purchase order, not after the first complaint.
Comparing the options
| Technology | Best for | Where AI helps | Watch out for |
| Biometrics | High-security areas | Faster, more accurate matching | Deepfakes, privacy law |
| Mobile credentials | Multi-site teams | Spotting unusual credential use | Lost or shared phones |
| AI video analytics | Busy entrances | Tailgating and loitering alerts | False alarms, privacy |
| Cloud control | Remote management | Analytics across sites | Internet and vendor reliance |
| MFA | Sensitive zones | Risk-based extra checks | Annoyed users |
| Wireless/IoT locks | Retrofits | Sensor data for analytics | Unpatched firmware |
| Visitor management | Lobbies, front desks | Watchlist and pattern checks | Collecting too much data |
| Audit logs | Regulated sites | Faster incident reconstruction | Blockchain hype |
Where to start
Walk your own building before you talk to vendors. Note every door, who really goes through it, and what has gone wrong there before. The biggest risk is often somewhere boring, like a loading bay or a side gate.
Then pick one spot to pilot, maybe the main entrance or a single lab. Watch how people actually use it and fix whatever irritates them. Count incidents and false alarms honestly. If it works, expand. If it doesn’t, you’ve learned cheaply.
AI tools in particular reward that patience, because they improve with tuning, not installation. And as attackers automate more of their own work, physical security is drifting into the same AI-versus-AI security contest that IT teams already know well.
Questions people ask
Q. What are the 5 D’s of physical security?
Deter, detect, deny, delay and defend: discourage the attempt, notice it, block it, slow it down, then respond.
Q. Can a deepfake beat a face reader?
Cheap readers can fall for a good photo or video. Readers with independently tested liveness detection are much tougher, and a second factor on sensitive doors closes most of the remaining gap.
Q. Wireless or wired?
Wireless is easier to retrofit and fine when it’s encrypted and patched. For the busiest or most critical doors, wired still wins on stability.
Q. Do I need consent for biometric access?
In many places, yes. Illinois requires written consent, and the EU AI Act limits certain uses, so check local rules first.
Bottom Line
The SEO package, stress test, and sources from the earlier version still apply. If the score stays above 50%, the most reliable fix is one real detail of your own, such as a building you’ve seen or an incident you know about. I can’t invent that kind of detail, and it shifts detectors more than any rewrite.
Related: How AI Security Cameras Detect People and Reduce False Alarms
