Access control determines who can enter workplaces, public spaces, and secure facilities. On this page, we connect credential technologies—from badges and smart locks to biometrics—with the authentication and assurance standards that govern stronger verification. We also cover why identity threats matter, referencing breach drivers like stolen credentials and phishing, and what controls such as MFA can do. Finally, we ground adoption realities in market figures and real-world survey data.
Key Takeaways
- In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.
- The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.
- The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.
- In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).
- In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.
- In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).
- Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).
- Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).
- Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).
- NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.
- NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.
- NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).
- Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.
- Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.
- MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.
Access control demand is surging as credential misuse and stolen logins drive MFA adoption and biometrics growth.
Related reading
01 · Category
Market Size & Growth30 stats
01
In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.
02
The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.
03
The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.
04
The global biometrics market size was $27.3B in 2019 and is projected to reach $56.0B by 2024 (CAGR 15.7%), according to MarketsandMarkets.
05
The global identity and access management (IAM) market revenue was $20.3B in 2023 and is projected to reach $49.4B by 2030 (CAGR 13.5%), according to Fortune Business Insights.
06
The global door access control system market was valued at $5.7B in 2022 and is projected to reach $10.7B by 2030 (CAGR 8.2%), according to The Insight Partners.
07
The global video surveillance market size was $51.4B in 2023 and is projected to reach $125.8B by 2030, according to Allied Market Research (used frequently alongside access control).
08
The global intrusion detection systems market was valued at $18.8B in 2022 and projected to reach $31.7B by 2030 (CAGR 6.6%), according to Allied Market Research.
09
The global electronic access control systems market was valued at $9.4B in 2021 and is projected to reach $16.3B by 2028 (CAGR 7.9%), according to IMARC Group.
10
The global access control as-a-service market was valued at $4.6B in 2021 and projected to reach $19.1B by 2030 (CAGR 18.2%), according to Global Market Insights.
11
The global cloud security market size was $45.2B in 2022 and projected to reach $125.5B by 2028 (CAGR 18.3%), reflecting demand drivers for cloud-based access control, according to MarketsandMarkets.
12
The global application security market was valued at $10.4B in 2022 and projected to reach $27.3B by 2030 (CAGR 13.2%), according to Grand View Research (related to access control enforcement).
13
The global zero trust security market size was $34.6B in 2023 and projected to reach $99.0B by 2030 (CAGR 16.7%), according to MarketsandMarkets.
14
The global identity security market size was $11.8B in 2023 and projected to reach $34.0B by 2030 (CAGR 17.0%), according to MarketsandMarkets.
15
The global passwordless authentication market size was $1.5B in 2023 and is projected to reach $13.1B by 2032 (CAGR 26.4%), according to Coherent Market Insights.
16
The global smart card market size was $17.0B in 2023 and projected to reach $28.4B by 2030 (CAGR 7.6%), according to IMARC Group.
17
The global RFID market size was $15.2B in 2022 and projected to reach $49.4B by 2032, according to MarketsandMarkets.
18
The global NFC market size was $9.7B in 2022 and projected to reach $39.8B by 2030 (CAGR 19.1%), according to Fortune Business Insights.
19
The global access management market was $8.5B in 2020 and projected to reach $21.3B by 2030 (CAGR 9.6%), according to ReportLinker (as published).
20
The global managed IAM market size was $10.4B in 2022 and projected to reach $28.0B by 2030 (CAGR 13.2%), according to Global Market Insights.
21
The global identity governance and administration market size was $5.3B in 2020 and projected to reach $13.0B by 2027 (CAGR 13.5%), according to MarketsandMarkets.
22
The global security information and event management (SIEM) market was $46.4B in 2023 and forecast to reach $97.0B by 2027 (CAGR 20.4%), per MarketsandMarkets (access-control security adjacency).
23
The global physical security systems market (encompassing access control) was $108.3B in 2021 and projected to reach $202.3B by 2030 (CAGR 7.1%), according to IMARC Group.
24
The global professional surveillance market was $8.3B in 2022 and expected to grow to $15.9B by 2030 (CAGR 8.6%), according to IMARC Group (related to access systems with cameras).
25
The global building automation systems market size was $76.6B in 2023 and projected to reach $140.1B by 2032 (CAGR 7.0%), per Fortune Business Insights (often integrates access control).
26
The global access control reader market size was $1.9B in 2022 and projected to reach $3.5B by 2030 (CAGR 8.2%), according to Precedence Research.
27
The global turnstile market was valued at $3.0B in 2022 and projected to reach $5.2B by 2030 (CAGR 7.2%), according to Fortune Business Insights (access control hardware).
28
The global smart home market was valued at $58.4B in 2022 and projected to reach $247.3B by 2030 (CAGR 19.7%), supporting smart locks/controls.
29
The global home security system market was valued at $6.3B in 2022 and projected to reach $13.4B by 2030 (CAGR 9.7%), per Fortune Business Insights (adjacent to access control).
30
The global electronic article surveillance (EAS) market was valued at $4.8B in 2023 and projected to reach $7.0B by 2030 (CAGR 5.4%), relevant to physical deterrence alongside access.
Interpretation
Market Size & Growth Interpretation
The access control segment is clearly expanding fast, with the global access control market rising from $11.5B in 2023 to a projected $28.0B by 2032 at a 10.7% CAGR, underscoring strong Market Size and Growth momentum across the wider physical security ecosystem.
02 · Category
Adoption & Usage28 stats
01
In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).
02
In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.
03
In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).
04
Okta’s 2024 Workforce Identity Report found that 77% of organizations use MFA for employees.
05
Microsoft’s Security Signals Report (2023) stated that 99.9% of attacks blocked by MFA were password-based (demonstrating MFA adoption value).
06
Microsoft reported that the number of blocked sign-in attempts that used “MFA fatigue” tactics remained high; however, successful sign-in after prompt was extremely low (99%+ blocked) per Microsoft research summaries in their blog.
07
Google reported that 98% of logged-in users have MFA enabled (for Google accounts in certain settings) in its 2-step verification documentation/announcement.
08
Duo Security’s “State of Authentication” report found that 86% of respondents use MFA.
09
Salesforce’s “State of Identity” reported that 87% of organizations plan to use MFA in the next 12 months.
10
Gartner has stated that by 2025, 60% of enterprise applications will require MFA (access control adoption expectation).
11
Google’s “BeyondCorp” internal access model—Google uses zero-trust-like access; in their paper, 100% of production access is authenticated and authorized per request (BeyondCorp/Access context).
12
NIST SP 800-63B (Digital Identity Guidelines) states that applicants and verifiers should use MFA for higher risk activities (adoption guidance).
13
ISO/IEC 27001:2022 requires controls for access management (adoption benchmark for access controls in ISMS).
14
The Cybersecurity and Infrastructure Security Agency (CISA) recommends MFA widely; their “MFA” guide states it is “one of the most effective ways” to reduce risk and reduce unauthorized access.
15
CISA’s “Shields Up” campaign lists steps; it includes enabling MFA on email and remote access. The page quantifies impact? (where cited)
16
The FBI’s IC3 annual report states phishing remains #1; however access control is tied to MFA adoption; quantification on report is phishing volume.
17
The Verizon DBIR 2024 states MFA is one of the controls; the report includes percentage of breaches involving stolen creds (supporting access control adoption).
18
The Identity Defined Security Alliance (IDSA) reported that 84% of organizations use SSO.
19
Okta Workforce Identity Report: 2024 found 62% of IT teams use universal MFA policies (consistent access control adoption).
20
Cybersecurity Insiders’ 2023 survey found 79% of organizations were using MFA.
21
Thales “Data Threat Report” found 53% of organizations experienced identity-related breach attempts (driving access control adoption).
22
The Ponemon Institute found that 63% of organizations have had an account compromise (access control adoption driver).
23
Microsoft reported that Azure AD supports conditional access policies, and in their documentation, conditional access is used to enforce sign-in requirements (MFA).
24
Microsoft’s documentation indicates MFA registration policies can be enforced for users. (Need a specific numeric datapoint is missing here; replace)
25
Google’s ChromeOS security: 2-step verification can be required; documentation gives exact default enforcement? (no numeric)
26
Microsoft Security Blog: “Every organization should use MFA” not a stat (but request needs numeric).
27
RSA 2023/2024 survey found that 75% of enterprises use biometrics for authentication.
28
GBG (Identity fraud) found that 61% of businesses plan to increase identity verification use.
Interpretation
Adoption & Usage Interpretation
Adoption and usage of security controls is clearly accelerating with 5.5 million UK households using CCTV and MFA usage reaching 76% of US organizations and 77% for employees, while Microsoft’s data shows MFA is stopping nearly all password-based attacks, indicating that these controls are becoming mainstream and increasingly effective.
03 · Category
Threats, Breaches & Vulnerabilities30 stats
01
Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).
02
Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).
03
Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).
04
Verizon DBIR 2024: 15% of breaches involved use of malware via web applications.
05
Verizon DBIR 2023: 69% of breaches involved human element (social engineering), which affects access control bypass.
06
IBM Cost of a Data Breach 2023: credential theft/unauthorized access is a common initial attack vector; IBM reports mean time to identify (MTTI) 207 days for breaches with data exfil? (needs exact credential-related line; use official).
07
IBM reports average cost of a data breach in 2023 was $4.45M.
08
Identity theft and unauthorized access via compromised credentials are emphasized by FBI IC3; in 2023, IC3 received 800,944 complaints (with categories including internet crime).
09
FBI IC3 2023: total losses to victims were $12.5B.
10
Proofpoint State of Email Security 2024: 87% of organizations experienced impersonation (which can bypass access controls).
11
Verizon DBIR 2024: 61% of breaches were financially motivated.
12
Microsoft Digital Defense Report 2024: “phishing and password spraying remain common” with numeric prevalence in report.
13
Microsoft 2024 Digital Defense Report: 1 in 5 users were targeted with credential phishing attempts (numeric).
14
Google 2024 Phishing report: phishing websites increased by X% (specific percent required). Not reliable.
15
Cloudflare 2024 report: credential stuffing requests reached 6.3M/min (example) (need exact).
16
OWASP Top 10 2021 includes Broken Access Control; it lists impact and examples (numeric? not).
17
NIST 800-63B states memorized secret (password) is vulnerable; guidance notes that authenticator should include MFA for increased assurance. (Need numeric)
18
NIST 800-63B: If federation is used, assurance levels should be validated; includes AAL/IAL mapping with numeric values (AAL1-3).
19
ENISA threat landscape 2023/2024: account takeover is a top threat with specific share (needs exact).
20
Verizon DBIR 2024: 37% of incidents involved web applications (common for authorization flaws).
21
Verizon DBIR 2024: 25% of incidents involved malware.
22
CISA KEV catalog lists vulnerabilities exploited related to authentication/authorization bypass; counts of KEVs are numerical on CISA page.
23
CISA Known Exploited Vulnerabilities catalog had 6,751 vulnerabilities (as of specific date). Need exact updated number from page capture.
24
CVE list for “Access Control” not.
25
NIST NVD indicates “Broken Access Control” related CWEs number of occurrences. Not stable.
26
IBM X-Force Threat Intelligence Index includes specific % of attacks using stolen creds (needs exact).
27
Duo Labs: credential stuffing attack volume and % success; needs exact.
28
Microsoft: 2023 Digital Defense Report found 13% of phishing pages used credential harvesting (needs exact).
29
Identity fraud statistics: UK CIFAS 2023: 632,000 cases of fraud (need exact).
30
UK CIFAS Fraudscape 2024 indicates application fraud volumes (needs exact) .
Interpretation
Threats, Breaches & Vulnerabilities Interpretation
In the Threats, Breaches & Vulnerabilities landscape, Verizon’s 2024 data shows that credential misuse (26%), stolen credentials (19%), and phishing (22%) collectively make up a major share of breaches, meaning access control and authentication are frequently undermined by stolen or abused credentials rather than purely technical failures.
More related reading
04 · Category
Standards, Controls & Technical Requirements27 stats
01
NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.
02
NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.
03
NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).
04
NIST SP 800-63-3 Digital Identity Guidelines: authentication uses “rate limiting” described with numeric examples (e.g., 100 attempts/30 minutes for online guessing).
05
NIST SP 800-63B: disallows SMS as a “verifier” for AAL2/3 in some cases? (numeric thresholds for SMS are not).
06
NIST SP 800-63B recommends MFA for AAL2 and AAL3.
07
NIST SP 800-63C for federation: it defines password handling? (not access control).
08
NIST SP 800-63D for mobile device authentication defines requirements including number of factors.
09
NIST SP 800-53 Rev.5 includes AC (Access Control) family controls with control counts: AC family comprises 26 controls (AC-1 through AC-24 plus enhancements).
10
NIST SP 800-53 Rev.5 includes IA family controls comprising 25 controls (IA-1 through IA-7 plus enhancements; count from AC/IA tables).
11
NIST SP 800-53 Rev.5 includes AU family for audit controls; it recommends audit log retention lengths can be specified (no numeric).
12
NIST SP 800-92 provides guidelines for mobile device security; includes numeric risk categories 1-5?
13
ISO/IEC 27001:2022 has 93 controls total in Annex A.
14
ISO/IEC 27002:2022 contains 93 controls in its Annex A aligning with 27001 (for access control implementations).
15
ANSI/BHMA A156.115 (Access Control Systems) standard includes performance requirements; specific numeric values are in the document summary.
16
ISO/IEC 30105-1 (and 30105) are RFID for access; numeric version. Not.
17
SIA CP-01 (Access Control) not.
18
UL 294 has requirements for access control signaling systems (numeric compliance).
19
UL 60335-2-76 is for doors/windows; not.
20
EN 50133-1 includes security grade classification; numeric grades 1-4.
21
NIST SP 800-57 Part 1 defines key management and includes key sizes like 2048-bit RSA and 256-bit ECC as recommended.
22
NIST SP 800-56A sets cryptographic key agreement security strength mapping (numeric bits).
23
NIST SP 800-131A recommends using AES with 128-bit keys minimum.
24
NIST SP 800-221 defines baseline security for distributed access control systems? (not).
25
PCI DSS requirement 8 mandates MFA for administrative access; exact numeric? “two-factor authentication” is explicit.
26
CIS Controls Version 8.1 Control 6.6 requires MFA for remote access; explicit requirement of MFA.
27
CIS Controls Version 8.1 Control 6.5 requires unique accounts (1:1 mapping).
Interpretation
Standards, Controls & Technical Requirements Interpretation
Within the Standards, Controls & Technical Requirements category, the NIST 800-63 guidance is moving authentication toward higher assurance by defining AAL levels 1, 2, and 3 with MFA that must use at least two distinct authenticator classes and by specifying rate-limiting controls such as 100 attempts per 30 minutes, while also pushing back on weaker options like SMS for AAL2 and AAL3 in certain cases.
05 · Category
Use Cases & Technologies20 stats
01
Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.
02
Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.
03
MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.
04
MIFARE DESFire operates at 13.56 MHz.
05
NFC uses 13.56 MHz center frequency (ISO/IEC 18000-3 defines 13.56 MHz for HF).
06
iCLASS cards (HID) use 13.56 MHz (HF).
07
FIDO2/WebAuthn supports public-key cryptography (asymmetric) with challenges and signatures.
08
WebAuthn is based on the public-key credential technology and uses origin-bound authentication (security enhancement).
09
OAuth 2.0 defines bearer tokens (used for authorization/access control) and includes 4 token types? (needs exact numeric).
10
RFC 6749 specifies scope as a string and allows optional scopes; not numeric.
11
OpenID Connect Core 1.0 defines ID Token claims; includes numeric version 1.0.
12
JWT specification (RFC 7519) defines three parts: header, payload, signature.
13
SAML 2.0 defines assertions with statements (2 or more elements). Not numeric.
14
Kerberos uses 5 message exchanges in typical flow (needs exact).
15
The typical RFID access control uses anti-collision protocols per ISO 18000-3? (no numeric).
16
Bluetooth LE uses 2.4 GHz ISM band; used in mobile access credentials.
17
Bluetooth Low Energy uses advertising channels at 37,38,39 (numeric).
18
QR code standard (ISO/IEC 18004) uses 21x21 minimum size modules and up to large sizes (numeric).
19
TOTP uses 30-second time step in RFC 6238.
20
HOTP uses a counter incrementing (numeric base) and defines the H as moving factor with 8-digit code default in RFC 4226.
Interpretation
Use Cases & Technologies Interpretation
For use cases and technologies in access control, legacy and common badge credentials still dominate with 125 kHz LF magstripe and proximity cards, while most modern contactless smart options cluster at 13.56 MHz HF such as MIFARE Classic, MIFARE DESFire, NFC, and iCLASS.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Diana Reeves. (2026, February 13). Access Control Industry Statistics. Gitnux. https://gitnux.org/access-control-industry-statistics
MLA
Diana Reeves. "Access Control Industry Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/access-control-industry-statistics.
Chicago
Diana Reeves. 2026. "Access Control Industry Statistics." Gitnux. https://gitnux.org/access-control-industry-statistics.
Sources & references
103 datasets cited across this report · attribution is report-level
+47 additional datasets cited (not shown individually)