Volume 14

6 years ago, on March 3, 2020, Allegion Ventures announced an investment in Openpath. Was this a sign of things to come? A company built on Schlage and Von Duprin put money into a cloud-based access control startup and planned a strategic technology partnership with it at a time when most incumbents were still deciding whether the cloud and mobile were real (and I give Allegion a lot of credit for that).

I keep coming back to that deal because of how few have followed it. For as long as I have been in this industry, physical security companies, specifically manufacturers of hardware and Physical Access Control Systems (PACS), have had two moves when something new shows up. They build it, or they buy it and fold it in. If neither works, they compete with it until it goes away (or until it doesn't, and then they explain why it was never a real threat).

I believe we need a third move, and we had an example of it play out recently. In November 2024, HID participated in SwiftConnect's $37 million Series B. In February 2026, dormakaba became a strategic investor in the same company. Then, in July 2026, HID agreed to transfer its Workforce Business Unit (HID SAFE, HID Visitor Manager, EasyLobby, and HID Integration Services) to SwiftConnect and took additional equity as consideration. HID holds a minority, non-controlling interest, and SwiftConnect stays independent and is run by its own leadership team.

You had two companies that fight each other in the market every day own a piece of the same "connective layer," and the second time HID invested, it traded with a product instead of cash. That should be a model, not a one-off.

I believe Allegion, ASSA ABLOY, dormakaba, Genetec, JCI, Gallagher, Hirsch, Honeywell, and the rest of the PACS should be investing aggressively in startups, midsize companies, and late-stage companies (including the ones they think they compete with) instead of trying to do it all themselves. And yes, Verkada, DMP, and even Alarm.com should get in this business, too. It is time to open your pocketbooks and put capital to use externally, not just internally.

To be fair, nobody is starting from zero. Here is how I see the field today…

dormakaba is the clearest convert. Safetrust in February 2025, RealSense in November 2025, SwiftConnect in February 2026, and 6 bolt-on acquisitions plus 2 venture investments in fiscal 2025/26, all while holding leverage at 0.8x net debt to adjusted EBITDA. Clearly, this company has a thesis.

Allegion has the most mature program in the industry. Allegion Ventures launched in 2018, added a $100 million Fund II in 2021, and, two weeks ago, led Ambient.ai's Series C, with Rob Martens joining the board. Credit where it is due (although I do wish they were more aggressive).

ASSA ABLOY is the best acquirer in our industry, with more than 400 acquisitions. Minority investing is a side dish next to that machine, which is what makes HID and SwiftConnect so interesting.

JCI and Honeywell both know how to do this. JCI Ventures has a long record, and both companies participated in Nozomi Networks' 2024 Series E. Neither is treating access control startups as a priority right now (and JCI is busy selling its intrusion business).

Gallagher made a strategic investment in Kenai, became its exclusive global distributor, and launched a visitor management solution on it. That is the right step, and I want to see more of it.

Genetec is the one where I can't point to a comparable public program. Like Gallagher, it is privately held, which means it doesn't even have a quarterly EPS excuse. It comes down to vision, strategy, and desire.

Hirsch has been built through acquisition, including the $145 million purchase of Identiv's security business in 2024. It has the portfolio to play this game, but less free capital to do so, which is why HID's approach of trading product for equity matters.

So what is the problem? Scale.

Fund II at Allegion Ventures was $100 million, announced in December 2021, with a stated range of $500,000 to $10 million per deal. In the third quarter of 2026 alone, Allegion spent about $120 million buying back its own stock. That is more than the entire fund in 90 days. Through 9 months, it has repurchased $280.3 million of shares.

JCI completed a $5.0 billion accelerated share repurchase (funded with proceeds from selling its Residential & Light Commercial business), then repurchased another $635 million on the open market in the quarter ending June 30.

For perspective, Verkada's last private mark was $5.8 billion, and SwiftConnect has raised about $76 million in its entire life. JCI's open-market buybacks in 1 quarter are more than 8x everything SwiftConnect has ever raised.

Honeywell repurchased $3.8 billion of stock in 2025 (it has since paused to pay down debt, and it hasn't repurchased a share since the first quarter).

I am not anti-buyback. In Brief 141, Tony Dong walked through Allegion's levers: acquisitions, buybacks, and dividends. A buyback is a clean, certain return when the stock is fairly priced, the cash flow is real, and Allegion's adjusted EPS grew 13% last quarter. Shareholders are not wrong to like that.

And this isn't a critique that applies evenly: ASSA ABLOY and dormakaba put their capital into M&A, not repurchases. I am saying there is a fourth lever, and we are barely pulling it.

Here is some back-of-the-napkin math. If Allegion redirected 1 quarter of buybacks (about $120 million, or 0.8 million shares), it would have about 1% more shares outstanding. On adjusted EPS guidance of $9.05 to $9.10, that is less than a dime. Less than a dime per share, and Allegion Ventures gets a brand-new Fund II every year.

Now imagine doing it across the industry. Add up recent repurchases at just Allegion, JCI, and Honeywell (mixed periods, I know), and you get close to $5 billion. 10% of that is about $500 million a year, or everything SwiftConnect has ever raised, 6 times over, annually.

What would the market look like? In short: ALL GAS. A sophisticated industry. The mainstream opportunity met.

It looks like… a couple dozen well-capitalized, independent companies building the identity layer, the agent layer, the integrator tools, and the vertical applications the market needs. Founders who see a real path to a real outcome, so more of them pick our industry. Fewer companies dying at $15 million in revenue because they couldn't raise a Series C from someone who knows what a door is. An ecosystem that looks like enterprise software, where the big platforms feed the small ones and the small ones make the big ones more valuable.

Which brings me to the uncomfortable part.

Clay Christensen wrote The Innovator's Dilemma almost 30 years ago, and most people remember it as a story about dumb management. I look at it differently. It is a story about smart management, frankly, leadership, doing exactly what its best customers and its P&L tell it to do.

I see that play out every day inside these organizations. A product leader asks for $5 million to build "the cloud thing," and that request sits next to a line extension with a proven spec, a proven channel, and a sales team already paid to sell it. The cloud thing cannibalizes, confuses the dealer, and carries a lower margin for 3 years. Nobody was necessarily wrong. The line extension wins, and on that math, it should.

That is Sailing Ship Syndrome with a very nice spreadsheet.

Investing gets around the dilemma. An outside company doesn't go through your stage gate or your channel committee, and it doesn't cannibalize your P&L because it isn't on your P&L. You are buying an option on a future your own org chart can't approve. (This is the same logic behind breaking off a division in Brief 155, except someone else recruits the 7' center.)

So, why now?

First, the capital is there, just not where people think. Look outside our industry and imagine what's happening in it. According to PitchBook data cited by Global Corporate Venturing, corporates accounted for a record 82.6% of US venture deal value in the first half of 2026. By the end of the first quarter, 5 US managers had raised $34.9 billion across 12 funds, more than half of global venture fundraising.

Most of that is chasing AI, and outside the top tier, many managers are struggling to raise their next fund. So capital is abundant at the top and scarce in the middle. The middle is exactly where a good access, identity, or integrator-tools company lives. Our entire industry has been "the middle." Meanwhile, some of the most patient capital our industry will ever see is sitting on the balance sheets I listed above.

Second, very few institutional investors understand our business. I say this with love. Most generalists don't understand spec cycles, retrofit, certifications, or why a dealer's loyalty matters more than a feature. So they pass, or they price it as "proptech," or they only show up when the deck says AI, or they pass because "hardware is hard."

CapitalG and Nvidia are in Verkada. Andreessen Horowitz is in Ambient. Great. Who is funding the rest?

A strategic can do diligence in a week what a generalist can't figure out in 6 months, and it can offer something no fund can: distribution. A sales org. Specifications. Existing installs.

Third, the market's structure is being decided right now. In Brief 156, I called Genea's MCP server a starting gun. And it is. The Platform Squeeze is compressing traditional PACS from every direction, and the layers above the door are forming quickly.

Outside capital is also starting to pick up pieces: Vista Equity Partners agreed to buy HID's PKI business last month. Notice the contrast. HID sold PKI for an exit and rolled Workforce into SwiftConnect. Both are legitimate. Only 1 keeps you in the room, though.

There is no better time to be in our industry than now! We need to act.

If we do this, here is what we get…

A cheap option on the future. You don't have to be right about which architecture wins. You have to own a piece of a few that might.

A better view. A board seat or observer role shows you what customers are buying 2 years before it shows up in an RFP.

Speed. Partnering with a portfolio company lets you market faster than developing in-house, which has been part of Allegion Ventures' logic from the beginning.

A financial return. Motorola paid $298 million for Openpath. Mitsubishi Electric valued Nozomi at nearly $1 billion. Minority investors in both saw a return. People like to call these outliers, but are they if they keep happening?

A bigger market. Neutral layers make every door more valuable, and they help us move from the $10 billion room to the $100 billion room faster than any 1 company can on its own.

A healthier industry. More founders, more talent, more exits, and more capital recycled into companies that understand what we do.

And to be fair, there are negatives and risks for everyone (just like there are when you try to build it all yourself). Here are some of them…

Upset partners. Invest in a company and some of your other ecosystem partners will get upset. You will hear it all: "You're backing our competitor," "Why not us?" Does it really matter, or is that just a bunch of feelings? Mostly feelings (and they tend to pass once a customer asks for the integration). As an example, with HID and dormakaba both on SwiftConnect's cap table, AMAG still expanded its partnership in April and put SwiftConnect behind Apple Wallet and Google Wallet across its portfolio.

Founder risk. A strategic investor on the cap table can scare off other partners and acquirers. The best companies may not want your money, and if you don't follow on, you signal something that hurts them.

Information walls. Competitors on a cap table, board seats, and shared roadmaps could raise questions.

The mothership. Large companies love to "help." Too many requests, too many integrations, and too much process will kill the thing you invested in for being different.

Earnings optics. A buyback shows up in EPS right away. Venture shows up as write-downs, noise, and questions on the earnings call. Corporate venture programs also tend to get cut exactly when they should be leaning in.

Foreign ownership. ASSA ABLOY is Swedish, dormakaba is Swiss, Gallagher is from New Zealand, Genetec is Canadian, and Hirsch is French. Identiv needed US Treasury approval to sell its security business to Vitaprotech. If a startup sells into federal, its investors' nationality matters.

Mandate drift. Is the fund chasing financial return or strategic value? If you can't answer that in 1 sentence, you end up with neither.

You may fund your own replacement. Some of these companies will take your customers. It's OK. Someone was going to fund them. You may as well own a piece.

All that said, these are known, manageable risks, and the alternative has its own risk… sitting out while someone else decides what the next layer looks like. I tend to lean towards action.

I do not think this replaces building or buying. ASSA ABLOY should keep acquiring. Allegion should keep buying back stock. The high security market will keep working the way it always has, and that's fine. But no single company will build everything the Intelligence Era needs. Either we do it as an industry, or we let external forces enter and sweep it all up.

It is time to invest.

The hospitality industry stands at a critical juncture, driven by a growing demand for seamless, secure, and personalized experiences. From smart rooms and contactless check-ins to automated systems, hotels are rapidly embracing technology to remain competitive. However, amidst this pursuit of convenience, a fundamental aspect often receives insufficient attention: security. Access control solutions, forming the bedrock of these innovations, are of paramount importance.

Hoteliers, ahead of The Hospitality Show, take note: in an era of heightened guest expectations and complex operational challenges, access transcends its status as a mere feature—it has become an indispensable necessity. It serves as the linchpin for guest protection, operational safeguarding, and staying ahead of evolving threats.

Why Access Security Matters More Than Ever

The repercussions of neglecting access security can be severe, impacting both reputation and profitability. Guests expect unwavering protection of their personal safety and data during their stay. A lapse in this regard is not merely an inconvenience; it constitutes a significant deterrent. Moreover, guests equate security with service quality. When they check into a hotel equipped with secure, intuitive systems—such as keyless mobile entry—it conveys a clear message:

“Your comfort and safety are our priority.” Many prominent chains have been adopting mobile keys for some time, and the evolution of the digitized guest experience enhances convenience for both guests and staff without compromising security. These innovations facilitate personalized, fluid experiences, mirroring the expectation of today’s guests accustomed to
in-home technologies.

Apple Wallet further propels this advancement by offering a highly secure, frictionless means for guests to access their rooms. With encrypted digital keys stored directly on a guest’s personal device, Apple Wallet eliminates the need for physical keycards—a common vulnerability in traditional access systems. This integration not only mitigates the risk of lost or stolen keys but also streamlines the guest experience. Checking in, unlocking a room, and accessing other hotel amenities can all be accomplished with a simple tap, providing a level of convenience and security that today’s travelers demand. Furthermore, Apple Wallet is emerging as the new
standard for mobile key implementations at a lower cost than previous versions, as hotels are no longer required to develop a dedicated mobile application. Through web-provisioning, hotels can transmit mobile credentials directly to the guest’s mobile device, reducing barriers to mobile key adoption.

Operational Efficiency Through Smarter Security

For hotels, access control transcends a mere security measure—it empowers business operations by leveraging connected systems that are intuitive for operations and facilitate seamless guest flow and property utilization, enhancing productivity while minimizing labor expenses. Additionally, collaborating with partners who prioritize flexibility of integration over a single-provider approach empowers operators to select and integrate the partners and touchpoints within the technology stack that are most valuable to their guests and overall business.

But the benefits extend beyond this. Access control technology provides valuable data insights. Hotels can identify high-traffic areas, optimize staffing, and even anticipate maintenance needs proactively. This level of insight empowers operators to make more informed, expeditious decisions, maximizing both productivity and guest satisfaction.

Supporting Sustainability Goals

Sustainability is no longer an optional consideration—it has become a core expectation for travelers. Access control systems can contribute to these goals in ways that traditional security measures cannot. By integrating with energy management systems, they enable more efficient resource utilization. For example, they can automatically adjust lighting and temperature based on room occupancy or signal when amenities can be powered down. This reduces energy consumption, lowers costs, and aligns with guests’ values. Moreover, an increasing number of hotels can leverage their existing infrastructure to enhance the connectivity of their IoT devices, making it more cost-effective to capitalize on these features.
making it more cost-effective to capitalize on these features.

The Path Forward: Prioritize Security, Build Trust

The future of hospitality lies in proactive—not reactive—approaches. Hoteliers who prioritize access control solutions today will be better positioned to handle tomorrow’s challenges. Beyond safeguarding assets and guests, these investments foster trust and loyalty. They also differentiate brands in a competitive market where travelers have an abundance of choice. Access security is not merely a technical upgrade; it represents a strategic imperative. By adopting robust, integrated systems, hotels can offer safer, smarter, and more sustainable experiences that resonate with modern guests. For an industry founded on service, there is no better investment than the peace of mind and confidence that comes with enhanced security.

This article originally appeared in Hospitality Technology.

The first question an integrator asks after watching a door open for a government-issued ID is a practical one. What is required of my access control system to support this? Less than you might expect, because the architecture keeps the access decision in the panel.

Today, a reader processes the credential and passes a number to the panel. The panel matches it against the internal list, and the panel makes the decision. The PACS sets the rules, and the panel enforces them. None of those changes. The only thing that changes are what the reader hands to the panel.

With a mobile driver’s license, the reader conducts the ISO 18013-5 engagement with the phone and passes the resulting identity elements to the panel over the wire it already uses. The panel then verifies the issuer’s signature, resolves trust through the Foundation’s registry, produces an attestation of what it verified, and makes the decision. Matching and decision stay in the panel, where they belong. There is one place to update trust anchors and rotate keys. Where architecture requires it, a standalone lock can do the verification itself. However, this requires more management overhead. Figure 5 in the paper traces the full flow: issuance, presentation, attestation, resolution, decision, and audit.

As for the PACS, it has two ways to take part, and the difference between them is whether it wants to be in the story.

The first option asks nothing about the PACS. In the panel, the verified identity resolves to a credential number in a format the PACS already understands. The PACS never knows the number came from a government ID. All the intelligence lives in the panel and the reader. The trade-off is that the end user is responsible for enrollment through third-party middleware.

The second option is integration. Here the PACS knows the credential is a government-issued identity. Enrollment becomes a single toggle on the person’s profile “allow this person to use their mobile driver’s license”. The PACS pushes what the panel needs and owns the authorization. Now the end user has a seamless enrollment process with their existing PACS.

The point to hold onto is that the PACS is an enhancer, not a requirement. A panel that can verify a government-issued ID is useful on day one with any PACS, and more useful with one that has integrated. A pilot does not have to wait on a PACS vendor’s roadmap.

On the hardware side, the panel needs two things: an application environment where verification logic can run, and a way to receive identity elements from the reader. Panels with a modern embedded environment already have both. Older hardware may need an add-on module or may need the reader to carry more of the work.

The reader is where the market is thinnest today. A wall reader has to conduct the ISO 18013-5 engagement with the phone and carry the resulting identity elements to the panel over OSDP, and few readers on the market do this yet. As mobile driver’s licenses spread across US states, this is the gap most worth closing, and nobody wants it closed by a single reader vendor. The OSDP technical subcommittee is looking at how this kind of reader-to-panel transfer should be specified. The reader manufacturers that implement the engagement and carry the elements over standard transport will be the ones integrators can specify.

That leaves the question a customer will eventually ask. Is this a single-vendor product, or an open standard with a choice of suppliers? The answer is both, and the boundary between them is what matters. The attestation format, the registry, and the trust governance form the Foundation’s open layer, which anyone can implement. How a verified identity maps to a legacy credential number is an implementation choice, and there will be several. An integrator who understands that boundary can specify the open parts and evaluate the rest on their merits.

For manufacturers operating in the physical security industry, certification is often viewed as a technical requirement. A process to demonstrate product performance, satisfy a specification or achieve compliance with a recognised standard.

But certification can represent something far more valuable: a gateway to commercial opportunity.

The right certification can help manufacturers access new markets, qualify for major projects, build credibility with customers and establish relationships with distribution partners who might otherwise be difficult to reach.

However, identifying the right certification is not always straightforward.

A complex landscape

Across the security industry, manufacturers face a complex landscape of national and international standards, third-party certification schemes, regulatory requirements and customer-specific approvals.

In the UK, for example, schemes such as LPCB's LPS certification programmes and BSI Kitemark can provide independent assurance of product performance and support access to markets where recognised third-party certification is valued or specified.

But different sectors, customers and countries may have entirely different expectations.

A product accepted within one market may require additional testing, certification or regulatory approval before it can be sold, installed or specified elsewhere.

Importantly, compliance with a standard, independent product certification and regulatory approval are not necessarily the same thing.

Understanding these distinctions is fundamental to developing an effective market-entry strategy.

Lessons from experience

Having spent more than 20 years working across the security and access management industries, I've seen how certification decisions can influence commercial strategy.

One particularly valuable experience was leading a certification initiative designed to open opportunities in the critical national infrastructure sector.

What became clear was that the challenge extended well beyond achieving the technical requirements.

It involved understanding customer expectations, identifying the appropriate certification route, aligning internal stakeholders and ensuring the business was commercially prepared to pursue the opportunities that certification could create.

The technical achievement was important, but its real significance lay in the markets and customer conversations it could unlock.

That experience reinforced something I believe strongly today: certification should be considered at the beginning of commercial planning, not as an afterthought.

The cost of choosing the wrong path

Certification programmes can demand considerable investment in testing, product development, documentation, internal resources and ongoing compliance.

Choosing the wrong route can therefore have significant commercial consequences.

Manufacturers may invest in achieving a recognised certificate only to discover that it isn't the one required by their target customers, that additional approvals are necessary, or that their chosen scheme has limited recognition in the market they intend to enter.

The result can be delayed launches, duplicated testing, additional expenditure and missed commercial opportunities.

These challenges become even more significant when manufacturers are looking to expand internationally.

Start with the market, not the certificate

Perhaps the most important question manufacturers should ask is not simply:

Which certification should we achieve?

But rather:

Which markets and customers do we want to access, and what evidence do they require?

This change in perspective can fundamentally alter how a certification programme is approached.

Before committing to a particular scheme, manufacturers should understand their target markets, relevant regulatory obligations, customer specifications, procurement requirements and the recognition of available certification routes.

Engaging with certification bodies, technical specialists, customers and commercial partners early in the process can help establish a clearer route forward.

It can also reveal opportunities to align product development, certification planning and commercial strategy, rather than treating them as separate activities.

Beyond the certificate

Achieving certification is an important milestone, but it shouldn't be regarded as the finish line.

Its commercial value depends on how effectively it is integrated into the wider business strategy.

Can it support entry into new geographical markets? Does it help qualify the product for previously inaccessible projects? Can it strengthen relationships with specifiers, consultants and distribution partners?

And crucially, is the organisation prepared to turn that technical achievement into commercial growth?

For manufacturers prepared to take a strategic approach, certification can become much more than a compliance exercise.

It can become a competitive advantage.