Volume 20

Volume 20 | June 15, 2023

Welcome to Volume 20 of the Access Control Executive Brief! This Brief is titled "Access Control and Locks: A View of North America and Europe." The purpose of this Brief is to discuss the changes and trends in the access control industry on a global scale, focusing on North America and Europe. I am taking past and recent trips, many face to face conversations, and countless Zoom calls with many in and around our industry to try and synthesize what I believe we are all seeing today. The Brief explores the shift from a security-focused industry to one that includes the mainstream market, the adoption of software as a product, and the impact of digital transformation. You can expect to hear more about the industry-wide changes and the new opportunities and challenges that arise from these changes. It is only going to get louder in the market. The Brief also provides insights into how companies can embrace these changes and adapt to the evolving industry.

One thing to note. This is not in lieu of the traditional business. A lot of what has happened over the past 30 years is and will continue. While a lot of what I write is the minority, I do believe it will soon be the majority.

I hope you enjoy it and look forward to hearing what you think.

[Side note: I will be offline from June 17 to July 5th. See you when I return!]

As a reminder, please do not forget, two events coming up that I would love to see you attend and participate in.

First, the Access Control Summit 2023 is a one-day event being held on September 28th in Washington DC. I am bringing together the access control and smart lock industry's most influential executives and thought leaders at the premier event of the year. I have confirmed a growing list of speakers that includes Antony Slumbers (keynote speaker and coined “Space as a Service), Björn Lidefelt, Steve Van Till, Erica Grant, Mark Roberts, Kumar Sokka, Joni Lampinen, and many more. There are three reasons why you should attend: networking, exposure, and thought leadership. There will be no sponsors for this event, and it will be funded entirely by ticket sales. As members of the Access Control Executive Brief, you can get a 50% discount on the ticket cost by using the promo code ACSACEBMD at checkout.

Second, CREtech New York and the Access Control and Smart Lock Village by the Access Control Executive Brief. Based off the response we had in London, NY is lining up to be even bigger and better. We will have more show floor space and a stage to activate thought leadership and conversations. We have a limited amount of companies that can attend. If you sell into the commercial real estate or multifamily market, CREtech NY is a must attend show. Please let me know if you are

I hope you enjoy the Brief, and I am excited to get on Slack with you and discuss it!

Thank you,

PS: I am sure some of you may forward this on but please do so sparingly and encourage others to sign up here. Thank you!

Access Control and Locks: A View of North America and Europe

The access control industry is undergoing significant global changes for the first time since 1973. The introduction of the internet by Darpa, Software as a Service (SaaS) by Salesforce, and consumerization, thanks to the iPhone, have all contributed to this transformation. Due to the pandemic, changes in the global industry have accelerated at an unprecedented pace.

How we enter and leave buildings has evolved from mechanical to motorized and motorized to connected. With the introduction of software as a product, it is now on its way to becoming what many people have been wanting: smart.

As products become "smart" and more software-centric, we see the opportunity to address a broader market. This shift moves from mainly new construction and high-security cottage markets to include retrofit and mainstream markets.

In two words, the current trend can be summarized as "digital transformation."

Digital transformation integrates digital technology into all business areas, fundamentally changing how businesses operate and deliver customer value. It involves using technology to radically transform a business's operations, services, and products to engage customers better, improve efficiency, and increase revenue.

Digital transformation is happening globally, and it is especially prevalent in North America and Europe.

Despite the everyday talk that "other markets are more advanced than my home market" (I am looking at you, North America and Europe), global markets share more similarities than differences.

For Brief 20, I will focus on North America and Europe together. Subsequently, Brief 21 will focus on North America only, and Brief 22 on Europe only.

Let's look at some observations and thoughts on what is happening in both regions and the outcomes resulting from them. Some are established and obvious, while others are starting to impact our industry.

So without further delay, here are my North America and Europe industry-wide observations and thoughts…

There's a shift from a cottage industry focused only on high security to one that includes the mainstream market.

Since 1973, the security industry's sole responsibility and market expectations have been focused on keeping bad people out and locking and unlocking. Everything was considered good as long as the industry delivered on this promise. However, expectations have evolved after the pandemic to include letting the right people in and creating value beyond just locking and unlocking. A great example is visitor management. What once was more about compliance and the cool factor is now considered work tech focused on experience and workplace optimization. Visitor management is a shining example of how our global industry was asleep at the switch and concentrated on an incremental value proposition story, at best, and overlooked. Still, once embedded by a different industry with a broader technology and value creation story (that industry is the Enterprise Software industry), it was reimagined as the front-end digital, experiential tool, delivering the exponential value they are recognizing (and we are not). Visitor management has become a mainstream market tool that has security and safety at its core. This is not only a story about visitor management but one example of how our cottage industry is being shaped, morphed, and reimagined. The question is, will we lead this change and occupy the space we command, or will it be done to us?

The outcomes:

• Expectations are shifting. Expectations of how systems work and the value they deliver have fundamentally changed. We saw this shift years ago in the hospitality industry. Still, now it is becoming relevant in multifamily (see Allegion Zentra, Salto Homelok, dormakaba, and even Levelhome), higher education (see how Apple Wallet has been rolling out Student IDs), commercial real estate (track what Silverstein and others are doing), and the enterprise sector. It is also starting to show in life sciences. Most people I also talk to expect this shift to occur in K-12, hospitals, and airports. While there may be pockets where these trends are not evident, they will eventually become the norm. These changes are not a matter of if but when. Our systems must function like enterprise software to meet the mainstream market's demands and remain relevant in the industry.

• The opportunity to reconsider. Many companies need to consider the business implications of adopting new technologies. Most companies merely add incrementally to their technology or go to market motions instead of seeing this as a fundamental shift in conducting business. For instance, legacy access control companies are hiring "cloud" sales teams as though it is a unique business rather than a core part of their operations now and in the future. This reluctance is apparent because their incentives, traditional channels, and teams are based on yesterday's needs. There is a hesitancy to embrace change fully. This same reluctance is happening with legacy distributors, locksmiths, and integrators. Most are too busy serving the business signed over the past 6 to 12 months or want to avoid implementing the necessary changes. They may believe they will retire soon and, therefore, not have to go through such a cycle of transition this late in their career. However, every day that goes by is another chip placed on the scale of change, replacing the chips placed on the stability of yesterday's business. At some point, the new practices of tomorrow become today's norm.

The moat to "go global" is far reduced.

Whether European companies are expanding into North America, North American companies are expanding into Europe, or companies in the APAC region are growing in North America and Europe, what was once a regionally focused industry is truly global. Yes, there have been examples of companies expanding internationally before, but the relative ease in doing so, and being successful in doing so, is very different from years past. Entry into global markets has evolved from doing large installations for multinationals to attacking specific use cases, unique partnerships, and nuanced vertical solutions. This change makes investing broader in markets good business, less expensive, and it is much easier to rationalize a "land and expand" strategy.

The outcomes:

• The perfect storm for disruption. Software, cloud, and mobile-first technology companies and legacy businesses opening up their APIs and SDKs are making it easier for companies to enter and expand into new markets. See dormakaba's dKey and ABLOYs Cumulus offering. Customers are demanding better user experiences, access to their data, and more nuanced systems that go deep to satisfy their needs. Many companies are targeting niche markets first, such as critical infrastructure, retrofit markets, and areas where access control and smart locks can increase efficiency, assurance, or revenue generation. Examples of such companies include iLOQ, Bioconnect, BoxLock, OUTLOCKS, and InVue.

• Companies with different incentives, expectations, and metrics are challenging companies that have dominated global markets. Companies new to geographies see their opportunity for growth at the expense of the incumbents' market share and in net new verticals or customer sectors that have been underserved over the years. Examples are, Gallagher Security and Kaadas in North America, and Brivo in Japan.

• Pricing and margins. Specifically with locks, the large conglomerates set the bar on pricing. Being public companies meant they had to deliver quarter after quarter and the street, no matter what. Subsequently, the leadership teams and critical employee incentives (code for bonuses) are set to motivate them to match or exceed that growth. Pricing is a significant lever they use to bridge the gap of unit turnover. Cue the price increases. But while the market has absorbed these price increases year over year, the appetite and opportunity to do so are gone. Unfortunately, the value and functionality the product is returning have not kept up with the same level of increase in costs. People are asking, is "Brand A" still worth it when I have "Brand B," who used to be an OEM for "Brand A" and has the same quality at a lower price? Just because their dad bought the product years ago and enjoyed the donuts brought every other week to the office does not matter as much anymore.

Access control has shifted from a hardware-only industry also to being considered a software industry.

With cloud and mobile computing, the industry is being refactored beyond hardware products to include data, functionality, new channels, new definitions, and new business opportunities. The future of the access control industry is no longer dependent on the revenue generated as a distribution channel for readers and cards. The opportunity to generate revenue based on software and professional services is more significant now than ever. And all of this brings new and different expectations.

The outcomes:

• A new channel: The Systems Integrator refers to making multiple software and hardware vendors work cohesively. For example, a Systems Integrator could ensure that turnstiles, keyless access, visitor management, and security workflows work harmoniously with ERP, CRM, HR, data visualization systems, "single pane of glass," POS, PMS, and tenant engagement systems (Choose your own three letter acronym). This is crucial for modern buildings, which will likely procure these solutions individually. Check out companies like Soloinsight, SwiftConnect, Tapkey, IDCube, Cohesion, Sprngpod, and Bitwards, to name a few. You will find one in just about every market you go to globally. Since these companies are still at an early stage and their go-to-market strategies are opportunistic, they are still figuring out who they will be when they grow up. Ultimately, they will become applications, middleware, Systems Integrators, and a combination of those mentioned. For now, they need revenue, and customers are looking for them to fill the gaps legacy systems do not serve. Long-term, they will perform a significant part of the market and disrupt the market flow of how systems are specified, sold, and serviced. Every market and vertical in North America and Europe is working with this new channel.

• Every hardware company is in the API and digital enablement business. What was once a minority practice of offering APIs and digital enablement tools has become the norm. Companies such as ASSA ABLOY, dormakaba, HID, Genetec, Allegion, and LenelS2, among many other legacy access control systems, are now hiring product managers and business development representatives to focus on enabling the ecosystem. They take pride in promoting and marketing this feature, not just from a technical perspective. Additionally, every new hardware company that comes to market now includes API and digital enablement as standard features. However, there is still a long way to go. The industry has not yet fully figured out how to sell software enablement products and tools, and selling credentials alone does not suffice. Although there are slight differences in how companies bring APIs and digital enablement products and services to market in North America and Europe, the idea and permission to do so are consistent.

• Every software company needs every hardware company to be in the API and digital enablement business. Whether software companies like it or not, they need hardware to use, control, and integrate their solutions. Many software companies have entered the industry believing they can snap on, plug in, or replace existing hardware products. Still, they soon find out that they need the hardware to work with their software solution at a much deeper level. They do not have the luxury of playing the slow and no game of hardware manufacturers. They need to focus on their core business and go fast. Ultimately, software companies pretending to be in the hardware business to gain market acceptance are burning cash. We still see too many new software companies going the hardware route, but I suspect this trend will slow down. Europe does not need another e-cylinder or consumer smart lock that attaches to the back of the door, just like North America does not need another multifamily or single-family smart lock company or commercial reader company. Unless there is genuinely some mind-blowing innovation, and I believe there will be some in the future, for now...we are good. 

• Margin stacking. Just like we saw in consumer markets when consumers shifted from cable, also known as "cord cutting," to streaming services, over time, consumers added service on top of service on top of service. There were and still are attempts by aggregators like AppleTV, Hulu, Amazon Video, and Roku. Still, most people you talk to in North America and Europe are starting to notice that what was cheaper than cable has become as or more expensive. You also see this happen with enterprise SaaS products. There are companies whose entire business is to help you identify all the SaaS products purchased by an enterprise and help them reduce their expenses by canceling underutilized and duplicative services. (See Microsoft's play with Teams as it relates to Slack and Zoom). How does this connect to access control and smart locks? Currently, everyone is adding their software costs to other costs in commercial real estate, multifamily, and enterprise markets. You have a lock, access control, middleware, credentials, big tech, tenant engagement, and more, all adding their fees to get a piece. You even have some of those companies charging each other. This is not sustainable, and customers are starting to vocalize it. When customers start bringing it up, this is the beginning of the end of the current period and the start of a new one. 

• There's a new opportunity for the old channel: Despite many examples of integrators, locksmiths, and distributors holding onto legacy business mindsets, things are better than some would like to paint the picture. Legacy integrators, locksmiths, and distributors are facing a fork in the road: continue doing the same, risk being commoditized, or embrace some of the new and mix with the old. This is a global question, and the answer is personal. Many businesses ask themselves, "Do I have the energy and desire to transform my business?" PowerPoint presentations I am giving about "the future of security" won't help with such a personal question. However, those successfully riding the wave of change are doing both. Successful integrators, locksmiths, and distributors can incrementally shift their business to include the new without replacing the old. See Ricardo Jardim out of Portugal. Most integrators, locksmiths, and distributors globally seek binary answers when the reality is nuanced. They should occupy the space they command (safety and security) and bring technical advancements into their business, offering work tech, proptech, and enterprise tech. There is a global level of curiosity from successful integrators, locksmiths, and distributors that should be the norm. Finding them is a different discussion. They are out there. We just need to find them. 

• There's a new stakeholder: The introduction of the end user as a stakeholder brings an expectation for both convenience and security, reversing the historical view that comfort and security cannot coexist. In the industry, anything convenient was seen as insecure. As we advance, there's an expectation that the end-user experience delivers safety and delight. The access control companies leading this market opportunity understand and implement this as a core tenet. Being deeply rooted in security is a clear advantage. Globally, this focus is still in its infancy. Companies that take action on this focus - rather than just talking about it (or, in many cases, ignoring it) - will fare better.

The industry has shifted from known internal threats to unpredictable external threats in the form of "frenemies."

The increased opportunity sparked by mainstream markets means a fresh set of eyes on a typically dull utility of an industry. It also means that our industry is becoming much more unpredictable and challenged - new partners, new expectations, new opportunities, new voices and faces, and new money. Venture capital and private equity firms invest in and acquire companies in and around the access control and smart lock industry. This includes Andreessen Horowitz (a16z) investing in companies like Ambient.ai and companies like PE firms Thoma Bravo, and Insight Partners, acquiring companies like Proxyclick and Traction Guest. This influx of resources did not exist three to five years ago. There is both a change in behavior and value arbitrage. Regardless of a downturn or not, it will slow, but this trend will not go away. Our industry is seen as a good return on investment for the long term. 

The outcomes:

• Dizzy or denial. The rapid pace of change happening in some areas, while others show moderate growth (even if it means you hit your targets. Whatever they are, there is a much larger opportunity being missed), makes it difficult for individuals and companies to know where to focus their efforts and resources. I hear this in almost every one on one conversation I have globally. Unfortunately, our industry has long celebrated a slow and steady mentality. This has resulted in many people and companies needing more self-awareness and either having limited success or missing out entirely on new opportunities for innovation and growth. In the past, those in the industry have often dictated the pace and direction of change. However, in today's digital age, the speed of transformation is unprecedented, and we need to seek external examples, talent, and guidance to drive change proactively rather than simply reacting to it.

• A domino effect. The arrival of Apple Wallet puts keys in your phone, Microsoft has introduced Microsoft Places, which converges your virtual office and physical office, and Amazon has its access control product simplifying the delivery of goods to spaces such as multifamily and residential dwellings. Once Big Tech shows interest, it challenges the status quo - and they are doing it fast, without regard to industry norms, and being very disruptive (even just in mindshare and conversation). Resist at your parral. They are like water. Where they feel friction, they move forward to the left or right where there is none.

• Go to market. The way products are brought to market is shifting due to limited pre-existing relationships and the inability to wait for a channel to decide when and how to take products to market. Despite having time and money, these companies typically seek quick market validation. This lack of existing relationships and the need for market validation forces them to leverage online tools and go directly to customers. While some in our industry stick to its traditional methods and vocal complaints, the market is moving around it. For others in our industry, they now have permission and someone to blame for the changes in how they go to market. This list is long, but see Verkada, LenelS2, Genetec, and others investing heavily in business development resources. 

• Price and margin pressure. When your primary business becomes an add-on for someone else's core business, they challenge traditional pricing norms. For example, offering access control to an existing enterprise software tool usually costs only a few dollars/euros/pounds compared to our industry's offering of hundreds of dollars/euros/pounds. Or take Big Tech, who can rationalize subsidizing the cost of hardware that we charge thoughts of dollars/euros/pounds for to get a package delivered. Or enterprise software companies offering a full suite of operational and logical services bundled together at a fraction of the cost we traditionally sell for.

The Lack of Global Standards Gets in the Way of Broad Adoption

Many people in our industry desire the adoption of standards in hardware, credentialing, cloud services, firmware, and more. Currently, different groups of companies are working together in their respective regions, such as OSS in Europe and the CSA in North America (even car companies are doing it). However, there needs to be coordination globally. While the need and want for standards are aligned, the who, how, and when are still uncertain. Although most companies agree that the market needs standards, I do not see the same level of desire to implement them. The primary reason for this is incentives. The incentives to stop what is already in motion and adopt a standard do not exist deep in the organizations that can drive significant change. The work on standards is primarily a technical exercise, not a business one. Furthermore, leadership decision-makers are often incentivized based on incremental growth off of their core business, discouraging them from making massive changes that could impact their ability to meet their quotas and plans. This, in turn, would affect their bonuses. Changing the incentives could change the way our business is done. Otherwise, serious consideration and adoption of standards will likely occur before many of us retire or pass away. We also need more consensus, regionally and globally, on what the standards should be. Our industry needs to get it together and come together. If I had to choose one area of the world that will be the first to adopt standards, it would be Europe.

The outcomes:

• New companies are entering the industry, attracting customers, and showing strength in numbers. They do not adhere to the old ways. This pressures incumbents to open up their systems and offer more modern technical ways to integrate with traditional and non-traditional systems. Additionally, they must get data out to make it more actionable and bring a modern user experience to our legacy industry. It is no longer acceptable to say "no." The expectation is "yes." I recognize that this is not yet a "standard," but it is the first step in that direction. More integration leads to more standards. 

• Companies are Embracing APIs and SDKs. Not too long ago, APIs and SDKs were just ideas on PowerPoint slides or something only start-ups did. They are standard in the lexicon and business of any company being considered relevant for today's and tomorrow's businesses. APIs and SDKs are the gateway drug to standards and a more seamless industry that can capture the mainstream market opportunity. Whereas we used to be an industry of few partners and a "go at it alone" mentality, we are now one of many partners and an ecosystem.

• New Channels are emerging Middleware companies. The introduction of APIs and SDKs, increased demand from end users, and the presence of external entities in our industry have caused us to resemble the enterprise software industry more closely (in pockets, on paper, and in the minds of those that want it to be true). While many speak of the convergence between IT and the security industry, a deeper look reveals that enterprise software and security convergence drives this change. As a result, we are seeing the emergence of familiar attributes from the enterprise software industry, such as middleware companies. For more information, please refer to number 3 above with the sub-bullet labeled "There's a new channel."

• Applications and Platforms serving Vertical markets. With the availability of APIs and SDKs, also known as tools, third-party software companies can leverage our industry's expertise and depth to build specific products and services that serve verticals more thoroughly than horizontal solutions. Commercial real estate, enterprise, life sciences, and other verticals have nuances that generic offerings can no longer fit. It takes focus, deep sector knowledge, and expertise that we either need more or are unwilling to invest in. This concept and market motion have been introduced previously. We have seen it in hospitality and colleges and universities. However, we now see broader demand and acceptance criteria supporting deep software solutions. Access control and smart locks are utilities in the built environment and are now enablers as well.

In summary, the security industry is shifting from high-security to mainstream markets and hardware to software. This transition turns it into a global industry with emerging players and incumbent stakeholders dancing together. However, significant barriers to broad adoption still need to be addressed. Companies must reconsider their business implications and embrace change to remain relevant. There is more momentum for these changes to be the norms, and I am energized but what I see in North America and Europe. If these two regions figure it out, the spillover into other areas globally will follow fast. 

Brief 20 broadly views the similarities between North America and Europe in this three-part series. In Briefs 21 and 22, I dive deeper into each market.

Tickets Are Now On Sale for the Access Control Summit 2023!

What is ACS? Why should you go? Who is going to be there?

Click on the image below to find out.

Join the access control and smart lock industry's most influential executives and thought leaders at the premier event of the year!

Examples of the 40+ speakers scheduled to be there: