Is Seamless Access Within Reach?

A future where there is seamless access control from home to the office and everywhere in between is not so far-fetched, as technology is taking us to places that we only used to dream of in science fiction. Today we can control pretty much everything with our phones, from banking and purchasing to access control and identity management, and biometrics unlocks even more options, whether used alone or in tandem with the phone.

Currently about two-thirds of security leaders have either deployed (37%) or plan to deploy (32%) mobile credentials for access control, with 61% of security leaders noting that mobile identity proliferation  or the shift from traditional physical credentials to mobile-based identities — is among the top three trends, according to an HID report from earlier this year. Add to that the continued adoption of biometrics, from facial and iris to fingerprint and palm, the past five years have brought about an acceleration toward the holy grail for most, which is secure, yet seamless access control.

To take a deeper dive into the future of touchless access control, Ledger caught up with Sanjit Bardhan, the VP and head of Mobile for HID, who talks about what’s driving the use of the phone and other wearables as a credential, the role of biometrics, and what impact all this new tech is having on the security industry.

Ledger: The HID report notes that two-thirds of security leaders have either deployed or plan on deploying mobile credentials for access control. Do you see this as something that is just going to continue to proliferate?

Bardhan: Those numbers are not surprising to me, but I'm a little surprised with how low those numbers are and would have expected the percentages to be a lot higher. And the reason is, if you look at any kind of technology that mobile is currently replacing — credit cards from back in the day, transit applications, even other non-access kinds of things —the adoption is a lot quicker, which tells you a few things. First, the access control industry is generally slow as you compare it to some of the other industries.

Secondly, access control industries are very institutionalized, which basically means the demand is generated by the organizations. Organizations create demand, often led by the CIOs and the CSOs, or the chief security and the chief information officers, who have an idea of what they want and then they drive the demand for access control, whereas all these other industries, which are B to C, primarily the demand is generated by the users. So now we're seeing that shift happen in the world of access where the users are now driving demand.

Students are going to institutions and are saying give me a mobile credential. Young Gen. Z workers and millennials who are coming into the workforce are asking for digital first, mobile first applications. So as a result, the demand is now shifting from organizations to the user of the actual device, which is what is driving adoption.

Over the next five years, we see that the market for mobile access will grow at a compound growth rate of more than 20%, whereas plastic is going to dip into the negative, which means there's an augmentation of plastic users to mobile as well as mobile coming in with brand new opportunities.

Plastics continue to be the top modality as of today, but mobile is by far the fastest growing modality that exists. And it's not just because of the phones; it's also because of the technology giants like Apple, Google, Samsung, etc., who are providing services on wallet platforms, etc., and driving adoption.

Ledger: What are some of the factors driving this shift to mobile credentials and identity?

Bardhan: I speak a lot about a concept called the macro trends that are driving the adoption of digital identities. The first thing is the new generation of workers, and these younger people come in from universities today, from higher-ed institutions are essentially one of the first adopters of mobile technologies. In fact, there are some studies that were done which basically said that more than 40% of students today make their higher-ed choice based on the technologies that the higher-ed institution provides to them. So, it starts from there and then these new workers enter the workforce, and they expect their employers to provide that same kind of experience.

The second thing is there is a drive from companies trying to hit their environmental, social and governance goals. I can give you examples of companies in Europe that have a 0-carbon footprint policy, and some of our largest adopters have gone down the path of saying that they are never going to use plastic. As a green organization, they want to show themselves as an environmentally conscious and focused organization.

The third thing is decision making is moving to IT. And now with the world of mobile, there are lots of other platforms and software systems that are coming into play. When a credential is touching all these various software systems, IT needs to get involved in decision making, so they are driving a lot of decisions around mobile adoption.

And one of the most important things as I said was the relevance of the tech giants, who are driving this significantly. In 2016, Apple introduced the iPhone 6, which gave you the capability of using your credit card on your phone for the first time. And ever since that day, they haven’t stopped. They completely went out on a rampage to get all kinds of use cases and applications that use cards to convert to using a mobile device. Google followed suit and so did Samsung. So today a lot of those card heavy applications like banking, transit, loyalty, all that ticketing, have now moved to mobile. Access control has stayed behind a little bit, but it's quickly jumping on the bandwagon. But this is only because Apple and the technology giants are driving this.

The last thing involves governments. In Europe, there's something called EUDI, a digital initiative that all European citizens or citizens of countries in Europe are supposed to carry their ID, which is in a digital format. And as a result, this is driving more phones and because they are driving more phones that are much smarter than before, mobile identities become an extremely important element of that.

Ledger: Which areas or verticals do you see the most adoption?

Bardhan: As we spoke about earlier, some of the early adopters are obviously higher-ed. We spoke about that because that's where it starts with the students. Commercial real estate is also a very big area because it involves the tenant and landlord situation where if you walk in through an access control system at the base building and you want to go up to the 4th floor, you've got to carry two cards and multiple credentials. Mobile just makes it so easy, which is a very conducive vertical for that specific area.

Enterprise technology companies are also one of the earliest adopters as well as banking and finance. In fact, there are four banks on our top 10 customers list. Banks don't want to spend millions and millions of dollars on issuing plastic cards and managing plastic cards and inventorying them. So, banks have figured out that it's cheaper for them operationally to issue mobile credentials because it's a simple recurring revenue service and they don't have to deal with inventorying cards or putting someone at a card desk managing plastic cards.

In the world of hospitality, it's all mobile enabled. I can get my digital room key card before I land into the city, take an Uber to my hotel and check in on my phone and I have received my key. I don't need to stand at reception to get my card room key. I walk into the hotel, press the elevators, tap my phone and get that seamless experience, and that is where the industry is going to move toward.

Ledger: What role does biometrics play in the future of access control?

Bardhan: I deal with biometrics from a complementary standpoint because biometrics and mobile are going to coexist, such as with two-factor authentication. It's an additional level of modality that leads to seamless access. So, there is going to be a coexistence in certain markets and in certain industries. But there are industries, for example, like healthcare, that are not super keen on capturing any face because of privacy concerns. And in Europe, for example, there is the GDPR regulation which prohibits certain applications of capturing faces. So that's why [facial and other] biometrics works in some institutions or countries and not in others. For example, if you go down to the Far East, it is extremely biometrics dominated.

The best way is when you have biometrics and mobile together. Biometrics to enter the door, but your mobile device that has your credential which does continuous authentication as needed throughout the access control process.

Ledger: What are some other trends you are seeing around mobile in relation to security and access control?

Bardhan: There are a few upcoming technologies, and one is the rise of wearables, which are becoming a very big thing and changes how you handle your credential. People want choice and they don't want to carry their phones around or take them out, so they now have an Apple Watch or a fitness tracker that has the ability of carrying a credential.

Smart rings are becoming a very big thing as well and they’re a small form factor and you don't have to carry your devices anywhere. And you can go into areas which are typically prohibited for you to carry your phones into because of the camera and prohibiting photos. Rings and other wearables take that problem away. Smart glasses, for example, are also a very big rising industry. It hasn't come to the world of mobile yet, but I wouldn't be surprised if some manufacturers came up with the ability to use your glasses as your credential. So, as you walk up to a door, the reader recognizes your glasses and opens the door for you. It's all science fiction, right? But in the world of technology, anything is possible.

We’ve also got these new trends around new modalities or communication protocols. RFID is what you'd use on cards. From RFID it went to a mobile device which has Bluetooth and NFC and very soon there is going to be a change to where the industry will start asking for UWB or Ultra-Wideband, which is the technology that's used in your air tags that gives you very precise location. That is the true art of seamless access as you don't even have to take your phone out of your pocket. The phone starts speaking to the reader, understanding that Sanjit is coming close to the device with the intention of opening the door and the door automatically opens. So, we are working on these types of projects from a research and innovation standpoint, and we are looking at these types of technologies as well.

Ledger: I know you’ve covered some of this already, but where do you see touchless access control going in the next 5-10 years?

Bardhan: One thing that I will add is mobile access or mobile credentials are just one small part of the overall digital ecosystem, and the world of access control from the stakeholder’s perspective is going to change as well. The current value chain is very simple. There's a manufacturer, there is a distributor, there's a systems integrator and installer, and there's an end user. Today it's different. There are a few more players that have come into the value chain. Five years from today, there will be more players in the value chain.

And AI is going to disrupt a lot of things going on in the industry — the way code is written, the way integrations are done. All of that is going to change things around, which basically means the traditional players in the value chain will get disrupted because of these new upcoming technologies and new players coming up.

Who would have thought that eight years ago, Apple and Google would have come into the access control industry? Nobody, right? Now they are a very inherent, integral part of the value chain of mobile solutions.

So, with this change to the value chain, the hope is that everybody plays together such that the end users get a very seamless and safe and secure solution.