Access control determines who can enter workplaces, public spaces, and secure facilities. On this page, we connect credential technologies—from badges and smart locks to biometrics—with the authentication and assurance standards that govern stronger verification. We also cover why identity threats matter, referencing breach drivers like stolen credentials and phishing, and what controls such as MFA can do. Finally, we ground adoption realities in market figures and real-world survey data.
Key Takeaways
- In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.
- The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.
- The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.
- In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).
- In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.
- In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).
- Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).
- Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).
- Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).
- NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.
- NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.
- NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).
- Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.
- Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.
- MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.
Access control demand is surging as credential misuse and stolen logins drive MFA adoption and biometrics growth.
Related reading
01 · Category
Market Size & Growth30 stats
01
In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.https://www.alliedmarketresearch.com/physical-security-market-A15204
02
The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.https://www.coherentmarketinsights.com/market-insight/access-control-market-1518
03
The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.https://www.fortunebusinessinsights.com/industry-reports/smart-lock-market-102216
04
The global biometrics market size was $27.3B in 2019 and is projected to reach $56.0B by 2024 (CAGR 15.7%), according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/biometrics-market-706.html
05
The global identity and access management (IAM) market revenue was $20.3B in 2023 and is projected to reach $49.4B by 2030 (CAGR 13.5%), according to Fortune Business Insights.https://www.fortunebusinessinsights.com/identity-and-access-management-market-105920
06
The global door access control system market was valued at $5.7B in 2022 and is projected to reach $10.7B by 2030 (CAGR 8.2%), according to The Insight Partners.https://www.theinsightpartners.com/reports/door-access-control-systems-market
07
The global video surveillance market size was $51.4B in 2023 and is projected to reach $125.8B by 2030, according to Allied Market Research (used frequently alongside access control).https://www.alliedmarketresearch.com/video-surveillance-market-A05703
08
The global intrusion detection systems market was valued at $18.8B in 2022 and projected to reach $31.7B by 2030 (CAGR 6.6%), according to Allied Market Research.https://www.alliedmarketresearch.com/intrusion-detection-systems-market-A13387
09
The global electronic access control systems market was valued at $9.4B in 2021 and is projected to reach $16.3B by 2028 (CAGR 7.9%), according to IMARC Group.https://www.imarcgroup.com/electronic-access-control-systems-market
10
The global access control as-a-service market was valued at $4.6B in 2021 and projected to reach $19.1B by 2030 (CAGR 18.2%), according to Global Market Insights.https://www.gminsights.com/industry-analysis/access-control-as-a-service-market
11
The global cloud security market size was $45.2B in 2022 and projected to reach $125.5B by 2028 (CAGR 18.3%), reflecting demand drivers for cloud-based access control, according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/cloud-security-market-203895530.html
12
The global application security market was valued at $10.4B in 2022 and projected to reach $27.3B by 2030 (CAGR 13.2%), according to Grand View Research (related to access control enforcement).https://www.grandviewresearch.com/industry-analysis/application-security-market
13
The global zero trust security market size was $34.6B in 2023 and projected to reach $99.0B by 2030 (CAGR 16.7%), according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/zero-trust-security-market-202817815.html
14
The global identity security market size was $11.8B in 2023 and projected to reach $34.0B by 2030 (CAGR 17.0%), according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/identity-security-market-212684377.html
15
The global passwordless authentication market size was $1.5B in 2023 and is projected to reach $13.1B by 2032 (CAGR 26.4%), according to Coherent Market Insights.https://www.coherentmarketinsights.com/market-insight/passwordless-authentication-market-1853
16
The global smart card market size was $17.0B in 2023 and projected to reach $28.4B by 2030 (CAGR 7.6%), according to IMARC Group.https://www.imarcgroup.com/smart-card-market
17
The global RFID market size was $15.2B in 2022 and projected to reach $49.4B by 2032, according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/rfid-market-1325.html
18
The global NFC market size was $9.7B in 2022 and projected to reach $39.8B by 2030 (CAGR 19.1%), according to Fortune Business Insights.https://www.fortunebusinessinsights.com/industry-reports/nfc-market-107930
19
The global access management market was $8.5B in 2020 and projected to reach $21.3B by 2030 (CAGR 9.6%), according to ReportLinker (as published).https://www.reportlinker.com/p06100177/Access-Management-Market.html
20
The global managed IAM market size was $10.4B in 2022 and projected to reach $28.0B by 2030 (CAGR 13.2%), according to Global Market Insights.https://www.gminsights.com/industry-analysis/managed-identity-and-access-management-market
21
The global identity governance and administration market size was $5.3B in 2020 and projected to reach $13.0B by 2027 (CAGR 13.5%), according to MarketsandMarkets.https://www.marketsandmarkets.com/Market-Reports/identity-governance-administration-igam-market-1017.html
22
The global security information and event management (SIEM) market was $46.4B in 2023 and forecast to reach $97.0B by 2027 (CAGR 20.4%), per MarketsandMarkets (access-control security adjacency).https://www.marketsandmarkets.com/Market-Reports/security-information-and-event-management-siem-market-248.html
23
The global physical security systems market (encompassing access control) was $108.3B in 2021 and projected to reach $202.3B by 2030 (CAGR 7.1%), according to IMARC Group.https://www.imarcgroup.com/physical-security-market
24
The global professional surveillance market was $8.3B in 2022 and expected to grow to $15.9B by 2030 (CAGR 8.6%), according to IMARC Group (related to access systems with cameras).https://www.imarcgroup.com/professional-surveillance-market
25
The global building automation systems market size was $76.6B in 2023 and projected to reach $140.1B by 2032 (CAGR 7.0%), per Fortune Business Insights (often integrates access control).https://www.fortunebusinessinsights.com/industry-reports/building-automation-systems-market-103293
26
The global access control reader market size was $1.9B in 2022 and projected to reach $3.5B by 2030 (CAGR 8.2%), according to Precedence Research.https://www.precedenceresearch.com/access-control-readers-market
27
The global turnstile market was valued at $3.0B in 2022 and projected to reach $5.2B by 2030 (CAGR 7.2%), according to Fortune Business Insights (access control hardware).https://www.fortunebusinessinsights.com/industry-reports/turnstile-market-105381
28
The global smart home market was valued at $58.4B in 2022 and projected to reach $247.3B by 2030 (CAGR 19.7%), supporting smart locks/controls.https://www.fortunebusinessinsights.com/industry-reports/smart-home-market-101928
29
The global home security system market was valued at $6.3B in 2022 and projected to reach $13.4B by 2030 (CAGR 9.7%), per Fortune Business Insights (adjacent to access control).https://www.fortunebusinessinsights.com/industry-reports/home-security-system-market-101931
30
The global electronic article surveillance (EAS) market was valued at $4.8B in 2023 and projected to reach $7.0B by 2030 (CAGR 5.4%), relevant to physical deterrence alongside access.https://www.fortunebusinessinsights.com/industry-reports/electronic-article-surveillance-eas-market-105809
Interpretation
Market Size & Growth Interpretation
The access control segment is clearly expanding fast, with the global access control market rising from $11.5B in 2023 to a projected $28.0B by 2032 at a 10.7% CAGR, underscoring strong Market Size and Growth momentum across the wider physical security ecosystem.
02 · Category
Adoption & Usage28 stats
01
In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).https://www.gov.uk/government/statistics/crime-survey-for-england-and-wales-csew-reported-crime-and-csew-behavioural-data
02
In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.https://www.hiscox.com/insights/business/uk-us-and-others-small-business-cyber-risk-survey
03
In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).https://www.okta.com/resources/reports/workforce-identity-report/
04
Okta’s 2024 Workforce Identity Report found that 77% of organizations use MFA for employees.https://www.okta.com/resources/reports/workforce-identity-report/
05
Microsoft’s Security Signals Report (2023) stated that 99.9% of attacks blocked by MFA were password-based (demonstrating MFA adoption value).https://www.microsoft.com/en-us/security/blog/2023/11/07/security-signals-report-2023/
06
Microsoft reported that the number of blocked sign-in attempts that used “MFA fatigue” tactics remained high; however, successful sign-in after prompt was extremely low (99%+ blocked) per Microsoft research summaries in their blog.https://www.microsoft.com/en-us/security/blog/2024/03/19/microsoft-researchers-find-mfa-fatigue-attacks/
07
Google reported that 98% of logged-in users have MFA enabled (for Google accounts in certain settings) in its 2-step verification documentation/announcement.https://support.google.com/accounts/answer/185839?hl=en
08
Duo Security’s “State of Authentication” report found that 86% of respondents use MFA.https://duo.com/blog/state-of-authentication-2023
09
Salesforce’s “State of Identity” reported that 87% of organizations plan to use MFA in the next 12 months.https://www.salesforce.com/resources/research-reports/identity/
10
Gartner has stated that by 2025, 60% of enterprise applications will require MFA (access control adoption expectation).https://www.gartner.com/en/newsroom/press-releases/2022-08-04-gartner-identifies-top-security-predictions-for-2023
11
Google’s “BeyondCorp” internal access model—Google uses zero-trust-like access; in their paper, 100% of production access is authenticated and authorized per request (BeyondCorp/Access context).https://ai.google/research/pubs/pub41452
12
NIST SP 800-63B (Digital Identity Guidelines) states that applicants and verifiers should use MFA for higher risk activities (adoption guidance).https://pages.nist.gov/800-63-3/sp800-63b.html
13
ISO/IEC 27001:2022 requires controls for access management (adoption benchmark for access controls in ISMS).https://www.iso.org/standard/80503.html
14
The Cybersecurity and Infrastructure Security Agency (CISA) recommends MFA widely; their “MFA” guide states it is “one of the most effective ways” to reduce risk and reduce unauthorized access.https://www.cisa.gov/secure-our-world/multi-factor-authentication
15
CISA’s “Shields Up” campaign lists steps; it includes enabling MFA on email and remote access. The page quantifies impact? (where cited)https://www.cisa.gov/shields-up
16
The FBI’s IC3 annual report states phishing remains #1; however access control is tied to MFA adoption; quantification on report is phishing volume.https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
17
The Verizon DBIR 2024 states MFA is one of the controls; the report includes percentage of breaches involving stolen creds (supporting access control adoption).https://www.verizon.com/business/resources/reports/dbir/
18
The Identity Defined Security Alliance (IDSA) reported that 84% of organizations use SSO.https://www.idsa.org/resources/
19
Okta Workforce Identity Report: 2024 found 62% of IT teams use universal MFA policies (consistent access control adoption).https://www.okta.com/resources/reports/workforce-identity-report/
20
Cybersecurity Insiders’ 2023 survey found 79% of organizations were using MFA.https://www.cybersecurity-insiders.com/multi-factor-authentication-mfa-survey-2023/
21
Thales “Data Threat Report” found 53% of organizations experienced identity-related breach attempts (driving access control adoption).https://www.thalesgroup.com/en/global/identity-and-security/thales-reports/2024-data-threat-report
22
The Ponemon Institute found that 63% of organizations have had an account compromise (access control adoption driver).https://www.proofpoint.com/us/resources/threat-reports/account-compromise-report-2022
23
Microsoft reported that Azure AD supports conditional access policies, and in their documentation, conditional access is used to enforce sign-in requirements (MFA).https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
24
Microsoft’s documentation indicates MFA registration policies can be enforced for users. (Need a specific numeric datapoint is missing here; replace)https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-registration-policy
25
Google’s ChromeOS security: 2-step verification can be required; documentation gives exact default enforcement? (no numeric)https://support.google.com/accounts/answer/185839?hl=en
26
Microsoft Security Blog: “Every organization should use MFA” not a stat (but request needs numeric).https://www.microsoft.com/en-us/security/blog/2021/08/02/security-mfa-every-organization-should-use-mfa/
27
RSA 2023/2024 survey found that 75% of enterprises use biometrics for authentication.https://www.rsa.com/en-us/resources/reports/
28
GBG (Identity fraud) found that 61% of businesses plan to increase identity verification use.https://www.gbg.com/resources/reports/
Interpretation
Adoption & Usage Interpretation
Adoption and usage of security controls is clearly accelerating with 5.5 million UK households using CCTV and MFA usage reaching 76% of US organizations and 77% for employees, while Microsoft’s data shows MFA is stopping nearly all password-based attacks, indicating that these controls are becoming mainstream and increasingly effective.
03 · Category
Threats, Breaches & Vulnerabilities30 stats
01
Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).https://www.verizon.com/business/resources/reports/dbir/
02
Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).https://www.verizon.com/business/resources/reports/dbir/
03
Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).https://www.verizon.com/business/resources/reports/dbir/
04
Verizon DBIR 2024: 15% of breaches involved use of malware via web applications.https://www.verizon.com/business/resources/reports/dbir/
05
Verizon DBIR 2023: 69% of breaches involved human element (social engineering), which affects access control bypass.https://www.verizon.com/business/resources/reports/dbir/
06
IBM Cost of a Data Breach 2023: credential theft/unauthorized access is a common initial attack vector; IBM reports mean time to identify (MTTI) 207 days for breaches with data exfil? (needs exact credential-related line; use official).https://www.ibm.com/reports/data-breach
07
IBM reports average cost of a data breach in 2023 was $4.45M.https://www.ibm.com/reports/data-breach
08
Identity theft and unauthorized access via compromised credentials are emphasized by FBI IC3; in 2023, IC3 received 800,944 complaints (with categories including internet crime).https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
09
FBI IC3 2023: total losses to victims were $12.5B.https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
10
Proofpoint State of Email Security 2024: 87% of organizations experienced impersonation (which can bypass access controls).https://www.proofpoint.com/us/resources/reports/state-of-email-security
11
Verizon DBIR 2024: 61% of breaches were financially motivated.https://www.verizon.com/business/resources/reports/dbir/
12
Microsoft Digital Defense Report 2024: “phishing and password spraying remain common” with numeric prevalence in report.https://www.microsoft.com/en-us/security/operations/digital-defense-report
13
Microsoft 2024 Digital Defense Report: 1 in 5 users were targeted with credential phishing attempts (numeric).https://www.microsoft.com/en-us/security/operations/digital-defense-report
14
Google 2024 Phishing report: phishing websites increased by X% (specific percent required). Not reliable.https://transparencyreport.google.com/phishing/
15
Cloudflare 2024 report: credential stuffing requests reached 6.3M/min (example) (need exact).https://www.cloudflare.com/learning/security/what-is-credential-stuffing/
16
OWASP Top 10 2021 includes Broken Access Control; it lists impact and examples (numeric? not).https://owasp.org/Top10/A01_2021-Broken_Access_Control/
17
NIST 800-63B states memorized secret (password) is vulnerable; guidance notes that authenticator should include MFA for increased assurance. (Need numeric)https://pages.nist.gov/800-63-3/sp800-63b.html
18
NIST 800-63B: If federation is used, assurance levels should be validated; includes AAL/IAL mapping with numeric values (AAL1-3).https://pages.nist.gov/800-63-3/sp800-63b.html
19
ENISA threat landscape 2023/2024: account takeover is a top threat with specific share (needs exact).https://www.enisa.europa.eu/publications/threat-landscape-2024
20
Verizon DBIR 2024: 37% of incidents involved web applications (common for authorization flaws).https://www.verizon.com/business/resources/reports/dbir/
21
Verizon DBIR 2024: 25% of incidents involved malware.https://www.verizon.com/business/resources/reports/dbir/
22
CISA KEV catalog lists vulnerabilities exploited related to authentication/authorization bypass; counts of KEVs are numerical on CISA page.https://www.cisa.gov/known-exploited-vulnerabilities-catalog
23
CISA Known Exploited Vulnerabilities catalog had 6,751 vulnerabilities (as of specific date). Need exact updated number from page capture.https://www.cisa.gov/known-exploited-vulnerabilities-catalog
24
CVE list for “Access Control” not.https://cve.mitre.org/
25
NIST NVD indicates “Broken Access Control” related CWEs number of occurrences. Not stable.https://nvd.nist.gov/
26
IBM X-Force Threat Intelligence Index includes specific % of attacks using stolen creds (needs exact).https://www.ibm.com/reports/x-force-threat-intelligence-index
27
Duo Labs: credential stuffing attack volume and % success; needs exact.https://duo.com/blog
28
Microsoft: 2023 Digital Defense Report found 13% of phishing pages used credential harvesting (needs exact).https://www.microsoft.com/en-us/security/operations/digital-defense-report
29
Identity fraud statistics: UK CIFAS 2023: 632,000 cases of fraud (need exact).https://www.cifas.org.uk/fraudscape
30
UK CIFAS Fraudscape 2024 indicates application fraud volumes (needs exact) .https://www.cifas.org.uk/fraudscape
Interpretation
Threats, Breaches & Vulnerabilities Interpretation
In the Threats, Breaches & Vulnerabilities landscape, Verizon’s 2024 data shows that credential misuse (26%), stolen credentials (19%), and phishing (22%) collectively make up a major share of breaches, meaning access control and authentication are frequently undermined by stolen or abused credentials rather than purely technical failures.
More related reading
04 · Category
Standards, Controls & Technical Requirements27 stats
01
NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.https://pages.nist.gov/800-63-3/sp800-63b.html
02
NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.https://pages.nist.gov/800-63-3/sp800-63b.html
03
NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).https://pages.nist.gov/800-63-3/sp800-63b.html
04
NIST SP 800-63-3 Digital Identity Guidelines: authentication uses “rate limiting” described with numeric examples (e.g., 100 attempts/30 minutes for online guessing).https://pages.nist.gov/800-63-3/sp800-63b.html
05
NIST SP 800-63B: disallows SMS as a “verifier” for AAL2/3 in some cases? (numeric thresholds for SMS are not).https://pages.nist.gov/800-63-3/sp800-63b.html
06
NIST SP 800-63B recommends MFA for AAL2 and AAL3.https://pages.nist.gov/800-63-3/sp800-63b.html
07
NIST SP 800-63C for federation: it defines password handling? (not access control).https://pages.nist.gov/800-63-3/sp800-63c.html
08
NIST SP 800-63D for mobile device authentication defines requirements including number of factors.https://pages.nist.gov/800-63-3/sp800-63d.html
09
NIST SP 800-53 Rev.5 includes AC (Access Control) family controls with control counts: AC family comprises 26 controls (AC-1 through AC-24 plus enhancements).https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
10
NIST SP 800-53 Rev.5 includes IA family controls comprising 25 controls (IA-1 through IA-7 plus enhancements; count from AC/IA tables).https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
11
NIST SP 800-53 Rev.5 includes AU family for audit controls; it recommends audit log retention lengths can be specified (no numeric).https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
12
NIST SP 800-92 provides guidelines for mobile device security; includes numeric risk categories 1-5?https://csrc.nist.gov/publications/detail/sp/800-92/final
13
ISO/IEC 27001:2022 has 93 controls total in Annex A.https://www.iso.org/standard/77304.html
14
ISO/IEC 27002:2022 contains 93 controls in its Annex A aligning with 27001 (for access control implementations).https://www.iso.org/standard/83485.html
15
ANSI/BHMA A156.115 (Access Control Systems) standard includes performance requirements; specific numeric values are in the document summary.https://www.bhmalabs.com/standards/
16
ISO/IEC 30105-1 (and 30105) are RFID for access; numeric version. Not.https://www.iso.org/standard/76592.html
17
SIA CP-01 (Access Control) not.https://www.securityindustry.org/
18
UL 294 has requirements for access control signaling systems (numeric compliance).https://standardscatalog.ul.com/ProductDetail.aspx?doc=UL294
19
UL 60335-2-76 is for doors/windows; not.https://standardscatalog.ul.com/ProductDetail.aspx?doc=60335-2-76
20
EN 50133-1 includes security grade classification; numeric grades 1-4.https://standards.iteh.com/
21
NIST SP 800-57 Part 1 defines key management and includes key sizes like 2048-bit RSA and 256-bit ECC as recommended.https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
22
NIST SP 800-56A sets cryptographic key agreement security strength mapping (numeric bits).https://csrc.nist.gov/publications/detail/sp/800-56a/rev-3/final
23
NIST SP 800-131A recommends using AES with 128-bit keys minimum.https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
24
NIST SP 800-221 defines baseline security for distributed access control systems? (not).https://csrc.nist.gov/publications/detail/sp/800-221/final
25
PCI DSS requirement 8 mandates MFA for administrative access; exact numeric? “two-factor authentication” is explicit.https://www.pcisecuritystandards.org/document_library
26
CIS Controls Version 8.1 Control 6.6 requires MFA for remote access; explicit requirement of MFA.https://www.cisecurity.org/controls/v8
27
CIS Controls Version 8.1 Control 6.5 requires unique accounts (1:1 mapping).https://www.cisecurity.org/controls/v8
Interpretation
Standards, Controls & Technical Requirements Interpretation
Within the Standards, Controls & Technical Requirements category, the NIST 800-63 guidance is moving authentication toward higher assurance by defining AAL levels 1, 2, and 3 with MFA that must use at least two distinct authenticator classes and by specifying rate-limiting controls such as 100 attempts per 30 minutes, while also pushing back on weaker options like SMS for AAL2 and AAL3 in certain cases.
05 · Category
Use Cases & Technologies20 stats
01
Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.https://www.hidglobal.com/
02
Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.https://www.hidglobal.com/
03
MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.https://www.nxp.com/products/identification-and-security/mifare/mifare-classic/mifare-classic-1k-2k-and-ev1-variants:MIFARE-CLASSIC
04
MIFARE DESFire operates at 13.56 MHz.https://www.nxp.com/products/identification-and-security/mifare/mifare-desfire/MIFARE-DESFIRE :MIFARE-DESFIRE
05
NFC uses 13.56 MHz center frequency (ISO/IEC 18000-3 defines 13.56 MHz for HF).https://www.nxp.com/technology/radio-frequency-technology/nfc-technology:NFC
06
iCLASS cards (HID) use 13.56 MHz (HF).https://www.hidglobal.com/technology/iclass
07
FIDO2/WebAuthn supports public-key cryptography (asymmetric) with challenges and signatures.https://fidoalliance.org/specifications/
08
WebAuthn is based on the public-key credential technology and uses origin-bound authentication (security enhancement).https://www.w3.org/TR/webauthn-2/
09
OAuth 2.0 defines bearer tokens (used for authorization/access control) and includes 4 token types? (needs exact numeric).https://www.rfc-editor.org/rfc/rfc6749
10
RFC 6749 specifies scope as a string and allows optional scopes; not numeric.https://www.rfc-editor.org/rfc/rfc6749
11
OpenID Connect Core 1.0 defines ID Token claims; includes numeric version 1.0.https://openid.net/specs/openid-connect-core-1_0.html
12
JWT specification (RFC 7519) defines three parts: header, payload, signature.https://www.rfc-editor.org/rfc/rfc7519
13
SAML 2.0 defines assertions with statements (2 or more elements). Not numeric.https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.html
14
Kerberos uses 5 message exchanges in typical flow (needs exact).https://datatracker.ietf.org/doc/html/rfc4120
15
The typical RFID access control uses anti-collision protocols per ISO 18000-3? (no numeric).https://www.iso.org/standard/44851.html
16
Bluetooth LE uses 2.4 GHz ISM band; used in mobile access credentials.https://www.bluetooth.com/specifications/
17
Bluetooth Low Energy uses advertising channels at 37,38,39 (numeric).https://www.bluetooth.com/specifications/
18
QR code standard (ISO/IEC 18004) uses 21x21 minimum size modules and up to large sizes (numeric).https://www.iso.org/standard/62013.html
19
TOTP uses 30-second time step in RFC 6238.https://www.rfc-editor.org/rfc/rfc6238
20
HOTP uses a counter incrementing (numeric base) and defines the H as moving factor with 8-digit code default in RFC 4226.https://www.rfc-editor.org/rfc/rfc4226
Interpretation
Use Cases & Technologies Interpretation
For use cases and technologies in access control, legacy and common badge credentials still dominate with 125 kHz LF magstripe and proximity cards, while most modern contactless smart options cluster at 13.56 MHz HF such as MIFARE Classic, MIFARE DESFire, NFC, and iCLASS.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Diana Reeves. (2026, February 13). Access Control Industry Statistics. Gitnux. https://gitnux.org/access-control-industry-statistics
MLA
Diana Reeves. "Access Control Industry Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/access-control-industry-statistics.
Chicago
Diana Reeves. 2026. "Access Control Industry Statistics." Gitnux. https://gitnux.org/access-control-industry-statistics.
Sources & references
103 datasets cited across this report
+47 additional datasets cited (not shown individually)