Volume 47

For years, physical access software has been positioned as a convenience tool.

A better spreadsheet.
A cleaner key list.
A way to document who has what.

That framing worked when access was local, static, and largely informal. Mechanical keys were managed by people who “just knew how things worked”, and the consequences of drift were rarely examined.

The problem is that the operating environment changed.

Physical access management mostly didn’t.

Tracking access is not the same as governing it

Most organisations today can track physical access to some degree.

They can usually tell you:

• who was issued a key or credential

• what system it belonged to

• when it was last recorded

What they often cannot reliably prove is:

• whether access is still valid today

• whether issuing followed policy at the time

• whether returns actually happened

• whether access reflects current organisational real

Tracking describes history.

Governance enforces correctness over time.

That distinction becomes critical once organisations scale, operate across sites, or face audit, safety, or regulatory pressure.

Mechanical access is persistent by design

Mechanical keys don’t expire.

They outlive contracts, restructures, role changes, and projects.

As a result, access slowly drifts.

Not because teams are careless, but because the systems in place were never designed to:

• enforce policy at the point of issue

• maintain chain of custody over years

• survive staff turnover

• produce defensible evidence under scrutiny

Finance, HR, and IT solved this decades ago by establishing systems of record.

Physical access largely never did.

In hybrid environments, this weakness matters even more: mechanical access often bypasses electronic controls entirely.

Why the “better spreadsheet” model breaks at scale

Selling access software as a tool optimises for:

• usability

• local efficiency

• feature comparison

• fast buying decisions

It breaks down when:

• audits require proof, not screenshots

• incidents demand reconstruction, not assumptions

• responsibility shifts from individuals to the organisation

• automation enters the picture

Automation built on informal or weakly governed data doesn’t remove risk.

It amplifies it.

Governance has to come first.

The uncomfortable shift the industry is now facing

Across the industry, there is visible tension as physical access software starts being repositioned.

Not as tooling.

Not as admin support.

But as infrastructure.

That shift forces harder questions:

• Who actually owns physical access risk?

• What constitutes an authoritative source of truth?

• What evidence would stand up in court, audit, or investigation?

• What happens when automation acts on bad assumptions?

For teams used to selling or buying “tools”, this feels uncomfortable.

For organisations accountable for outcomes, it is overdue.

Not every environment needs this. That’s fine.

If an organisation just needs a list of keys, spreadsheets may be enough.

If responsibility includes:

• safety

• compliance

• long-lived access risk

• regulated operations

Then physical access can no longer be treated as a side task.

The industry is slowly acknowledging what has been true for a while:

physical access is one of the last unmanaged enterprise risks.

Correcting that requires more than better interfaces.

It requires governance, enforced at the point of operation, and provable over time.

That may be an uncomfortable conversation.

But it’s one worth having.

What’s the purpose of a tripod? If you said “to take pictures” or “to put a camera on it,” you’re focusing on the end result. We see that a lot in our  industry—a focus on the end product or the final solution. What we  don’t see as often is the balance that it takes to provide the right solution. 

Back to the tripod—what’s its real purpose? Ultimately, it’s there to provide a  balanced platform for a camera to take a perfect picture. If one leg on the tripod  is higher or lower than the others, you may be off balance—or perfectly  balanced—depending on the application! 

Let’s talk about the three legs of our industry’s tripod, and how each one plays a critical role in providing stability and balance. 

Safety.  

Depending on who you are, your job title, or where you got your start in this  industry, this might be the most important leg to you—and arguably, it should  be. Safety is the reason most of us do what we do. Protecting lives, protecting  assets, and protecting peace of mind are all paramount when choosing the right  products for the right applications. 

Think about it—would you want to drive a car without airbags? Or live in a house  without a breaker panel? Probably not. Safety features are the backbone of  every good security solution. 

That said, when safety is overdone, it can start to affect security and simplicity. You could argue it would be safer if nobody had doors—during a fire, you could  just run straight out without touching a handle or swinging a door. But that  comes at the expense of security and practicality. 

So while safety is foundational and critically important, it works best when viewed as one leg of the tripod—not the only variable. 

Security.  
Security is always the fun one to talk about. When we think of security, we think  about the what-ifs, the how-tos, and preventing break-ins. But the answer to what security means will be different for every single person. 

At its core, security is a mindset. Why? Because the answer to the question  “what does security mean to you?” will be different for every single person you  ask it to. Everyone has a different view of how secure an application should or  shouldn’t be, and that’s totally fine. To be practical, when balancing safety and security, we often have to dive into the nuances of a solution and put the  customer’s mindset first. We ask questions like, “What’s most valuable here?” and “What are the gotchas of this or that product vs the application?” 

One common challenge we all can face is over excitement to sell our personal favorite solutions. It’s easy to get very focused on a specific feature or solution  and lose sight of the other great opportunities an application presents. Security,  while extremely critical, should be balanced with how people will ultimately interact with it. 

Simplicity.  
This one gets overlooked—don’t let it be. Simplicity can be your closer in a  project! 

Seriously. 

When simplicity is properly balanced as a tripod leg, create more opportunities  for repeated clients. Why? They feel understood. They feel like you did right by  them! We can get together and talk all day about the intricacies of different  solutions, but at the end of the customer's journey with you, they usually care  about one thing: How does this work, and how do I use it? 

If it takes three credit hours to explain, you’ve fully telescoped the simplicity leg.  And sometimes that’s okay depending on how complicated the solution NEEDS  to be for that specific client. 

Applications can still be secure and safe when we prioritize understanding the customer's ease-of-use as much as we care about any of the three legs. 

How we make a difference.  

Let’s end with this: you have a life-changing and important job. Whether  you’re corporate, part of a firm, a business owner, or an installer, this tripod  should stand on all three legs evenly for all of us to succeed. 

In your mission to improve lives through safety, security, and simplicity,  remember—we should all provide a balanced view so people get the full picture.

Podcast | Secured: Episode 3

In Episode 3 of Secured, Lee Odess breaks down the shift toward identity-driven security platforms, discusses the “sailing ship syndrome,” and highlights upcoming events for the broader security community. . Listen to episode 3 now.

Podcast | Secured: Live from Intersec Dubai 2026: Allan Chester, Juergen Sept, and Tünay Karatekin

Recorded live at Intersec Dubai, Lee, Allan, Juergen, and Tünay discuss how the region has moved into a more mature market, why interoperability and ecosystem thinking are replacing point solutions, and how Intersec Dubai is becoming a unique environment where collaboration is happening faster than many people would expect. Listen now.

Podcast | Secured: Live from Intersec Dubai 2026: James Clark, AMAG Technology

Recorded live at Intersec Dubai, James Clark discusses how 2025 accelerated the shift from product-led selling to end-user–driven problem solving, why identity is now the starting point for access control, and how private cloud is gaining real momentum across the region. Listen now.

Breaking News | PSA Network and The Access Control Collective release State of Security Integrators 2026 Report

The State of Security Integrators 2026 report, built from PSA’s Financial Metrics Survey and insights from 116 integrators, offers a rare, data-driven look at where the industry is growing, and where it still needs to evolve. Access the report here.

The PhySec Collective Breakfast is a community-first gathering bringing 300+ physical security operators, builders, and leaders together before ISC West, with proceeds benefiting FAST. Sponsored by Grid Squared Systems, YourSix, Sharlic, PDQ, PassiveBolt, Acre Security, Brivo, Connectivity Standards Alliance, HID, and SwiftConnect. Register here.

ACS26, The Access Control Summit, is heading to New Zealand in 2026, hosted in collaboration with our city-host, Gallagher Security. Join us October 7–8, and sign up here to be notified first when registration goes live.