David Vigor, End User Business Development Director for Europe, PACS, HID explains why security leaders should rethink identity management from the ground up

Building a stronger identity management strategy does not need to start with new technology.

It starts with understanding why existing systems no longer work as one.

Ask most security directors what keeps them up at night and you will hear variations of the same answer: too many systems, too little visibility and threats that move faster than the teams trying to stop them.

That response has been confirmed in HID’s 2026 State of Security and Identity Report, which gathered insights from over 1,500 security and IT professionals, end users and industry partners globally.

Nearly three-quarters of physical security respondents identified identity management as their top strategic priority for the year – the highest ranking across every category surveyed.

This number matters. Identity management has displaced perimeter defence, endpoint tools and access hardware as the discipline leaders are prioritising.

The question is no longer whether to invest in it, but how to strengthen what already exists without making a complex environment worse.

For most organisations, that does not mean replacing infrastructure, but making it work as a system.

The integration problem is the real story

Security organisations have spent years building out their technology stacks.

The result, for many, is a set of capable but disconnected systems: access control that does not talk to visitor management, digital authentication that operates apart from physical credentialing, HR provisioning that lags days or weeks behind real-world access changes.

Each system was a reasonable purchase. Together, they create the very gaps attackers now exploit most efficiently. The report is clear on where that complexity lands.

Managing multiple identity systems was cited as the primary challenge by 52% of respondents, ahead of budget constraints, regulatory compliance and user friction.

That finding is significant because it means the barrier to better security is not spending or intent. It is architecture.

The pressure to unify is coming from every direction. Security platforms across the industry are being redesigned to consolidate access logs, video feeds and sensor data into a single architecture.

The intention is not necessarily to create a “single pane of glass,” but to surface actionable intelligence that fragmented systems simply cannot provide.

Organisations that have not yet addressed data silos between physical and digital identity systems are building that intelligence gap in from the start. Malicious actors have noticed.

AI-generated deepfakes, automated credential stuffing attacks and synthesised biometric spoofs have become tools for adversaries operating at scale.

These attacks are most effective precisely where identity systems do not share data: where the person badging into a building and the user logging into enterprise software are treated as separate identities by separate systems.

This disconnect between physical and digital security has become an attack surface.

From access control to identity governance

For most of the past decade, identity management in physical access control meant managing who had a badge and where it worked. That definition has expanded considerably.

Organisations are now asking for their identity infrastructure to govern employee onboarding and offboarding, visitor access, multi-factor authentication, contractor credentialing and physical identity and access management (PIAM), many times simultaneously and across multiple facilities or geographies.

Operationally, this is an impactful shift.

When identity management functions as genuine governance rather than just access control, security teams gain the ability to enforce consistent policy across physical and digital environments, reduce the window between an employee status change and their actual access being updated and respond to incidents with full context rather than partial data from disconnected logs.

Industry partners appear to embrace this, according to the HID survey. About 61% of partners are prioritising identity management both for their own operations and for the customers they serve.

The alignment between end users and the channel is unusual and suggests the market has largely moved past the question of whether unified identity management is worth pursuing.

The regulatory dimension is no longer optional

The case for unified identity management in UK and European organisations is being made by legislators rather than vendors.

The UK government introduced the Cyber Security and Resilience Bill to Parliament in November 2025, a significant expansion of the country’s existing NIS Regulations.

If enacted, the bill would bring managed service providers, data centre operators and designated critical suppliers into direct regulatory scope for the first time, each of which typically interfaces with enterprise identity and access management systems.

The initial incident reporting window under the bill is proposed at 24 hours, with a full report due within 72 hours.

Organisations with disconnected identity infrastructure will struggle to meet that timeline.

Alongside the CS&R Bill, the UK’s Product Security and Telecommunications Infrastructure Act, in force since 2024, already mandates baseline cybersecurity requirements for connected devices, including prohibitions on universal default passwords and requirements for vulnerability disclosure.

Physical access control devices that connect to enterprise networks fall within this regulatory environment.

The cumulative compliance pressure from both pieces of legislation is pushing identity and physical access management toward the same conclusion the market reached independently: disconnected systems are a liability, not a cost-saving measure.

Investment is moving, but friction remains

The market seems to be largely committed to investing in identity management, with 60% of organisations surveyed reporting plans to increase spending on the category, despite operational challenges. User friction sits at the top of the implementation challenge list, cited by 42% of respondents.

In many cases, what presents as a technical friction problem turns out to be a change management challenge.

When security teams deploy new credentialing workflows without adequate communication, training or phased rollout, resistance follows regardless of how well the technology performs.

The implication for security leaders is that investment in deployment process and user education often determines adoption outcomes more than the technology selection itself.

Budget and resource constraints, cited by 41%, are a persistent reality for security teams that rarely have the organisational standing to compete with IT or digital transformation priorities for capital.

This makes the case for unified platforms more compelling: a consolidated identity management environment reduces administrative overhead and makes the total cost of ownership easier to justify than maintaining separate point solutions for each function.

Security leaders have a stronger business case to take into board conversations than they have had in years.

Across the industry, the language around return on security investment has shifted from an aspirational pitch to the baseline expectation in conversations between manufacturers, integrators and buyers.

Identity management, with its measurable impact on onboarding speed, incident response times and access governance audit outcomes, is well positioned to anchor that case.

Where identity management goes next

Identity management does not operate in isolation. Several adjacent trends in the report either accelerate or complicate its implementation.

Mobile credentialing has reached greater intent, with 74% of respondents having deployed or planning to deploy mobile credentials, a figure that reflects how thoroughly the technology has moved from pilot to baseline.

The convergence of physical and digital identity is following a similar trajectory, with 29% of organisations already implementing an integrated security posture and nearly half of the remaining organisations actively evaluating converged solutions.

The “buy and hold” mentality that kept access control hardware in place for 10-15 years is giving way to an IT-influenced cadence driven by cybersecurity demands, AI adoption and compliance requirements.

Outdated physical security endpoints that connect to enterprise networks are now treated by IT departments as lateral attack vectors, which means identity management infrastructure that was sized for yesterday’s threat model may not survive the next refresh cycle.

One development deserves close attention and will shape identity management conversations through the rest of the decade: privacy and ethical concerns around biometric authentication have risen sharply, from 31% in 2025 to 67% in 2026.

This major shift means organisations deploying fingerprint and facial recognition systems are doing so into an environment where end user concern has more than doubled in a single year.

How organisations communicate around biometric data collection, storage and use will become as important as the performance of these systems.

In the UK, this concern intersects directly with data protection obligations under GDPR, where biometric data is classified as a special category requiring explicit lawful basis and data protection impact assessments before deployment.

The operational case for convergence

The organisations making the most progress on identity management are not necessarily the ones with the largest budgets.

They are the ones that have stopped treating it as an access control problem and started treating it as an organisational data problem.

When identity information flows consistently across physical and digital environments, security teams spend less time reconciling discrepancies between systems and more time acting on the intelligence those systems provide.

The 2026 findings suggest a market at an inflection point. The commitment to unified identity management is widespread. The execution gap between intent and implementation is where the next phase of the industry’s development will be determined.