Australia’s commercial security system market was valued at $3.16 billion in 2022, and is projected to reach $7.72 billion by 2032, growing at a compound annual growth rate (CAGR) of 9.37 percent from 2023 to 2032, according to market research firm Apollo Reports.
Smart locks, sensors, security cameras, biometric readers and software, including cloud-based controls, are all part of the mix. For facility managers, one of the starting points for installing modern access control systems is to ensure that the hardware fitted on-premises seamlessly integrates with software solutions, many of which are now hosted on cloud services.
“Integration is key. We are seeing growing demand for hybrid systems where mechanical hardware, electronic locks and cloud-based credentials all work together,” Access Hardware general manager for security solutions Mike Stevens says.
“This allows facilities to retain the robustness of physical infrastructure while gaining the flexibility, auditability and remote management that digital platforms offer.”
While standalone physical hardware was typically the legacy security system at most commercial facilities, such as offices, malls and mixed-use complexes, the uptake of digital solutions is progressing at pace.
Physical ID is still used within the access control industry, although mobile access credentials along with digital IDs are now being increasingly adopted, according to a report by HID Global.
With mobile access, facility tenants expect to tap their phone or smartwatch instead of carrying a card. HID’s 2024 State of Physical Access Control Report found nearly two in five organisations (39 percent) actively use mobile identities.
The majority of respondents adopted touchless/contactless solutions (48 percent) and mobile access (44 percent), making these two the largest trends shaping the access control sector.
The company’s State of Security and Identity Report from last year noted that demand for biometric technologies, such as fingerprint, iris and facial recognition, is increasing, with around 35 percent of respondents using biometric technology, while another 13 percent plan to do so. The majority of security leaders (67 percent) are making moves to adopt software-driven security solutions.
Challenges in access control
Integrating and incorporating access control capabilities to work in tandem with mechanical key systems is a major risk management area for facility managers and presents unique stumbling blocks.
“A common challenge we find that facility managers face is balancing their security requirements with the convenience of an integrated solution, particularly in large, multi-site or multi-tenant facilities,” Stevens says. “Whether it’s a hospital needing to secure sensitive areas or a university managing hundreds of doors across a sprawling campus, the complexity of access permissions and key control can quickly become unmanageable.”
A workaround is to offer products ranging from electronic audit-controlled key cabinets to lockdown control for internal or external security events, as well as tools that link both the access control and mechanical key systems through online registers. “We design systems that are easy to manage, meet compliance requirements, and can scale as sites grow or change,” Stevens adds.
There are legitimate concerns around privacy and the security of captured biometric data. After all, Australia is now the fourth-most targeted country for cyberattacks behind Japan, Germany and Brazil, according to Nozomi Networks Labs’ OT & IoT Security Report.
“In security, the ‘tech’ is only as strong as the rules around it,” Kastle Systems strategic partnerships manager Connor Chavarria says. “That’s why we work with facility managers to set clear permission levels so only the right people can access data – and for the right amount of time.
“With mobile credentials like Apple Wallet, your actual ID isn’t stored on the phone. It’s a secure token, so if the phone’s lost, there’s nothing for someone to steal. All data is encrypted from the door reader to the cloud, and we patch vulnerabilities before they become a problem. And every access event is logged.”
Salto Systems, a Spanish access, identity management and electronic locking technology company that also has extensive operations in Australia, has instituted similar stringent checks to safeguard access and privacy.
Salto technical sales manager for Oceania Mike Clews says the security of the company’s hardware and IoT products is a top priority. “We follow internationally recognised standards, such as ETSI EN 303 645 for IoT security, to ensure our devices meet stringent protection requirements,” he says.
“We believe that software security begins with secure hardware, so every product we create is designed with built-in safeguards to protect against physical and cyber threats from the ground up.
“Salto also only uses data carriers, such as keycards, mobile phones, fobs, smart watches, that hold higher-level encryption. This includes the Mifare Desfire standard.”
The Mifare Desfire contactless card technology used by companies such as HID and Salto offers advanced encryption and mutual authentication technologies. Clews adds that when it comes to storing customer data, customers can opt for wholly cloud-based solutions or for the option of saving the data on-premises. “One of the key security considerations our clients make when deciding between Salto’s ProAccess Space on-premise software and Salto KS (Keys as a Service) cloud-hosted solutions is how much control they want over their data,” Clews explains.
He says by selecting Salto Space, clients have full control of their data and where it’s stored. The software has built-in security features, including encryption for data at rest. If, instead, a client would like a cloud solution, their data is hosted in compliance with the European Union’s General Data Protection Regulation laws.
Access control providers in the country, especially those working across sensitive sites, are now progressively required to comply with Australian-specific laws. “We’re seeing facility managers impacted by regulations around cybersecurity, data privacy and government-grade security requirements,” Stevens says.
“For example, in government and defence settings, Security Construction and Equipment Committee (SCEC)-endorsed systems are often mandatory – not just for locks, but for access control panels, readers and software.”
The SCEC is part of the Australian federal government’s Protective Security Policy Framework (PSPF). It’s responsible for endorsing and evaluating security equipment and systems that are used in defence, government facilities and other critical infrastructure.
Stevens says standards like ISO 27001 and frameworks like the PSPF or Essential Eight – a cybersecurity mitigation strategy created by the Australian Cyber Security Centre – are now driving key requirements within integrated systems.
Emerging tech trends
Stevens notes that there are some clear trends facility managers opting for access control systems are now actively considering.
These include increased demand for cloud-based management and remote monitoring, greater integration between physical security and IT systems, a heightened focus on cybersecurity for access control networks, and mobile credentials and biometrics replacing traditional keys and cards.
There are also numerous advantages for facility managers looking to migrate their access control services to the cloud.
Kastle’s Chavarria outlines immediate pain points that are eased with the integration of cloud-based systems. “When a building moves to the cloud, the first thing facility managers notice is how much more seamless their job gets. No more calling IT every time a server needs a reboot or finding space for racks of equipment – it’s all managed off-site. If a tenant loses their pass or needs afterhours access, you can make the change from your phone without driving in.”
Chavarria goes on to add that the integration of AI into systems, especially CCTV cameras, has been a major boon for facility managers. Now, for example, instead of scrubbing through hours of footage to find when a package went missing, using natural language prompts, they can search for ‘red backpack’ and get the required footage in seconds.
Systems are also becoming more interconnected, so access control might talk to lift controls, desk booking or HVAC. “Because updates and patches happen in the background, you’re not left with outdated security or long maintenance windows,” Chavarria says. “And when access control, CCTV, and visitor systems talk to each other, you’re not double-handling tasks. One update takes care of everything. I’ve seen sites cut hours of admin each week just by eliminating those manual processes.”
Beyond making sure that the access control systems ‘talk’ to other operational controls of the building, facility managers also now want an all-in-one solution rather than solutions managed by multiple contractors. “We’ve worked in just about every type of building in Australia – heritage sites, high-rise towers, mixed-use precincts – and we know the unique challenges of each,” Chavarria says. “We’re seeing more buildings move to fully managed services. So, instead of juggling different contractors for cameras, access and alarms, it’s one integrated service with everything updated and
monitored for you.”
That desire to offer integrated services led to the family-owned Melbourne business Access Hardware becoming Australia’s largest commercial locksmith provider in July when it announced its acquisition of API Access & Security. “Access Hardware brings deep experience in commercial door hardware, master key systems and project delivery, while API adds national expertise in electronic security, access control and systems integration,”
Stevens says. “For facility managers, this means one trusted partner who can manage everything from mechanical hardware and compliance requirements to electronic access systems, cloud integration and ongoing support.”
The tipping factor for facility managers deciding on access systems providers often comes down to the sustainability
offerings of the vendor.
Companies such as Salto tout their ISO 14001 certification, which allows bragging rights that the company operates with
environmental sustainability at the core of its operations. “Our manufacturing headquarters is 100 percent carbon neutral,” Clews says. “Salto Oceania is also a B-Cycle-Accredited Battery Steward, via the Battery Stewardship Council, and working with B-Cycle-Accredited Battery Recycler Ecobatt, a company that specialises in the safe collection, processing and recycling of battery products.”
With the aim of ensuring local relevance, Clews adds that some of Salto’s products are specifically compliant with local sustainability frameworks. “Locally, our XS4 Original, XS4 Original+ and XS4 One series of locks have been given a Green Building Council of Australia (GBCA) Green Star Responsible Product Value rating of 5,” he says.
Green Star is the GBCA’s sustainability rating system for the built environment, used to rate new and existing buildings, new fitouts and new precinct developments. The GBCA’s Green Star Responsible Products rates building products on the basis of their transparency, sustainability and ethical sourcing.
The next generation of access security controls will be sustainable, largely impenetrable, auditable and cyber-resilient.
Facility managers are now riding the wave.
This article first appeared in the October edition of FM magazine. To download the entire edition for free, click here.
Read more: Access Entry completes rebrand to Gilgen
