Volume 126

Reminder to JOIN the The PhySec Collective community Slack channel to network, engage, and be part of something big! You can sign up here.

This is the first Brief of 2026, and I want to start the year with a story about an outcome we can still choose (and some already have).

This story was sparked by multiple discussions I’ve had with many of you over the past month, and reinforced over the winter break during conversations with someone who spent their career in the PBX industry.

And WOW do things sounds familiar.

First, a quick history of PBX (and why it matters).

PBX, or Private Branch Exchange, was once must-have critical infrastructure for all commercial companies. From the late 1970s through the 1990s, it was unquestioned. Every office had a phone system. The only discussion was which one and how big was.

PBX lived on proprietary, on-prem hardware with high margins and predictable refresh cycles. Dealers owned the customer relationship, and telecom managers controlled the domain.

It was all stable, felt inevitable, and more like an annuity business. Lots of people made lots of money. The getting was good.

Then, IP networks improved, and VoIP emerged. At first, it was dismissed as interesting but inadequate. Voice was “different” and too important to trust to data networks. It wasn’t “enterprise” enough. (My favorite btw.)

Incumbents responded logically by adding IP cards and building “hybrid.” They protected the box and explained why outsiders didn’t understand the problem. They, of course, were the certified experts, right?

What most didn't do was move the center when the center moved without them. Fact, the center moves with or without you. Even if you are certified experts.

By the mid-2000s, hosted PBX and cloud voice services fundamentally shifted buyer behavior, beginning with small and medium businesses (SMB) and ultimately everyone. Subscription models (opex) replaced large capital expenditures (capex), deployments became faster and simpler, and the physical hardware that once defined the category started to fade into the background (still there just not the driver).

Then unified communications (aka platforms) arrived and changed everything.

Voice stopped being the reason buyers bought. It became a feature inside a much larger value proposition. Decision-making shifted from telecom experts to IT departments.

PBX didn’t fail. It just became irrelevant on its own.

Then came the legacy voices doing legacy things: Manufacturers defended hardware margins. Dealers continued to sell installations of the legacy. Telecom managers protected expertise. Carriers sold minutes.

Everyone stayed frozen where they were while the inevitable was right in front of them. But by the time certainty arrived, the center had already moved.

PBX still exists today. It’s a shell of itself with phones still ringing and boxes still running.

The industry just no longer defines the conversation. Not because it was wrong, but because it stayed small while the world got bigger.

If this feels familiar, it should. This is exactly what is happening right now in access control and the broader physical security industry. Globally, just at different wave patterns. And here’s the key difference from PBX: We are still early enough to choose differently.

It is a choice.

This is why I want us to look back and say “2026 was our PBX moment and we moved the center.” Not the year the center moved without us. This is the year we did something about it.

Why 2026?

Every long transformation has a year where momentum becomes obvious in hindsight. For PBX, it wasn’t the first VoIP call. It was the moment the voice stopped being the reason for the purchase. For access control, 2026 will be that year for three reasons imo:

1. Buyer expectations have outrun vendor narratives. Not because vendors convinced them, but because that’s how every other system they run already works.

   The question will no longer be: “Do we trust cloud access control?” It will be: “Why does this still work differently from everything else we operate?” That expectation gap is when change is obvious.

2. Identity has become the center, not access control. Access control is not going away, but it is no longer the system of record. Sorry. Been thinking about this. It’s not. Identity is. Identity platforms that do access control (and more) are.

   Access control becomes an execution layer, not the decision layer. The decision and automation layers are a bigger market. And a deeply uncomfortable shift for those whose power came from owning the decision. Want to see it in living color? Watch how insignificant the flow of goods through PACs who haven’t turned the corner gets this year.

3. The economic math has flipped. Transformations like this don’t stall because of disbelief. They stall because incentives lag reality.

   This is when behavior changes. Not because leaders become visionary, but the numbers finally allow them to. The incentives change, so they have permission to go all in. This is exactly what happened in UCaaS.

Remember, though, this is an 'and' vs. 'or' story. This is not about replacement but about expansion. The future does not eliminate hardware, integrators, on-prem systems, or hybrid architectures. It de-centers them. The new gravity is identity, software, platforms, and data.

That creates continuous engagement instead of episodic projects, services instead of installs, enterprise relevance beyond security, cross-functional value, and outcomes doors alone could never deliver.

That is growth. That is 2026. It can be.

The hard truth is, this challenges a lot of what we’ve come to know as the physical security and access control industry.

This shift challenges who controls the architecture, who owns the customer, who defines success, and who holds influence.

For decades, power flowed from hardware expertise, installation complexity, proprietary knowledge, control of physical systems, and legacy media and institutions.

The emerging model shifts power toward software fluency, identity, and IT alignment, lifecycle services, platform thinking, and honest media and modern education.

That’s not just business change. That’s an “how I identify my self worth” reckoning. Discomfort is real, but it is not a strategy.

The train has left the station. That does not mean there is no room left. It means standing still is no longer viable. PBX vendors who survived did not all become cloud natives. Some became edge specialists. Others service leaders. Most are integrated deeply into platforms. What they shared was simple: They accepted that the center had moved. Access control is at that exact moment.

I’m not saying that 2026 is the year access control disappears. It is the year pretending the old center still holds stops.

For companies, the opportunity is to redefine their role, expand their relevance, and grow with customers rather than wait for refresh cycles.

For individuals, the opportunity is to evolve expertise, increase influence, and participate in a bigger conversation.

This is not doom. This is a widening of the market. PBX didn't lose because it was wrong. It lost because it stayed small while the world got bigger. Access control can chose differently. 2026 will make that choice unavoidable. And for those willing to be uncomfortable, it will also make it full of opportunity.

Final thought and my mention of hope. Please do something with this. Declare it. Challenge it. Hold it accountable. Adopt it. Build toward it. Whatever you need. Just don’t pretend it isn’t happening.

Let’s make 2026 the year we look back and say, “That’s when we did it.”

11 months and a handful of days to go. 

PS: I am sure some of you may forward this, but please do so sparingly and encourage others to sign up here. Thank you!