Access Control Faces Crossroads as Cloud and M&A Surge

The third barrier is uneven software integration. API maturity varies enough that many larger organizations still rely on PSIM tools or custom middleware to normalize events across PACS, PIAM and building systems.

As a result, Kell says end users are following a pragmatic middle path. Many embed support for open standards, open controller architectures and documented APIs into specifications, but still choose semi-proprietary platforms when those deliver stronger mobile capabilities, analytics and user experience. They do so as long as they can negotiate “credible exit options around credential migration, data portability, and future integrations,” he says.

AI for noise reduction and investigations

Memoori’s research also highlights emerging artificial intelligence (AI) use cases inside access control workflows. Kell stresses that the most meaningful advances address operational overload rather than complexity for its own sake.

“Our view is that the AI functions most likely to gain real traction in access control are those that relieve operational pressure rather than simply adding more ‘smart’ alarms,” he says. One key theme is alert reduction, where anomaly detection models learn baseline behavior across users and sites and surface only “out-of-pattern events.”

Kell says tailgating prevention is another growth area. At the intersection of access and video, AI analytics can count people per credential and flag “probable piggybacking events in real time,” which is especially important in regulated environments.

Interest is also growing in context-aware authentication that blends biometric checks, liveness detection and IT risk signals. On the investigative side, Kell notes that natural-language and pattern-based search tools show potential but remain in early stages, with momentum still “driven by vendor R&D and marketing rather than end-user pull.”

Across all use cases, he says end users want “specific reductions in alarm noise, quicker investigations, and more reliable enforcement of access policies, not AI for its own sake.”

Consolidation shifts market dynamics

Kell says recent M&A activity focuses on three critical segments in the access stack: controller platforms, credential technologies and cloud-based software. “Owning these control points allows larger groups to coordinate product roadmaps across locks, readers, controllers and software,” he says. “This can accelerate innovation in unified platforms, mobile identity and analytics, and give integrators clearer integration paths and support models.”

At the same time, he cautions that much of this innovation is now delivered through vertically integrated, subscription based ecosystems, which raises switching costs and concentrates pricing power. The market, he explains, is beginning to split as sophisticated buyers favor consolidated platforms with deep features and global support, while more price-sensitive customers turn to simpler hardware and lighter cloud services.

For integrators and enterprise buyers navigating this shift, Kell emphasizes the importance of understanding which companies now steer key elements of their access control architecture and tracking how post-acquisition changes may affect long-term interoperability and support.

“They should watch how post-acquisition product rationalization affects openness and support windows, and pay close attention to licensing terms, price escalators, and data and credential portability, so that today’s platform choice does not become tomorrow’s constraint.”