Physical access control is surging fast, with global physical security revenue projected to jump from $83.1B in 2023 to $162.7B by 2030, while the access control market is expected to grow from $11.5B in 2023 to $28.0B by 2032 as smart locks, biometrics, IAM, and zero trust identity models reshape how organizations lock down buildings, doors, and data.
Key Takeaways
- In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.
- The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.
- The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.
- In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).
- In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.
- In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).
- Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).
- Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).
- Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).
- NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.
- NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.
- NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).
- Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.
- Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.
- MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.
Global access control and identity security are surging with MFA-driven, zero-trust growth.
Market size & growth
1In 2023, global physical security market revenue was $83.1B and is projected to reach $162.7B by 2030, according to Allied Market Research.[1]
Verified2The global access control market size was $11.5B in 2023 and is projected to reach $28.0B by 2032 (CAGR 10.7%), according to Coherent Market Insights.[2]
Verified3The global smart lock market was valued at $1.83B in 2022 and is projected to reach $6.12B by 2030 (CAGR 16.6%), according to Fortune Business Insights.[3]
Verified4The global biometrics market size was $27.3B in 2019 and is projected to reach $56.0B by 2024 (CAGR 15.7%), according to MarketsandMarkets.[4]
Directional5The global identity and access management (IAM) market revenue was $20.3B in 2023 and is projected to reach $49.4B by 2030 (CAGR 13.5%), according to Fortune Business Insights.[5]
Single source6The global door access control system market was valued at $5.7B in 2022 and is projected to reach $10.7B by 2030 (CAGR 8.2%), according to The Insight Partners.[6]
Verified7The global video surveillance market size was $51.4B in 2023 and is projected to reach $125.8B by 2030, according to Allied Market Research (used frequently alongside access control).[7]
Verified8The global intrusion detection systems market was valued at $18.8B in 2022 and projected to reach $31.7B by 2030 (CAGR 6.6%), according to Allied Market Research.[8]
Verified9The global electronic access control systems market was valued at $9.4B in 2021 and is projected to reach $16.3B by 2028 (CAGR 7.9%), according to IMARC Group.[9]
Directional10The global access control as-a-service market was valued at $4.6B in 2021 and projected to reach $19.1B by 2030 (CAGR 18.2%), according to Global Market Insights.[10]
Single source11The global cloud security market size was $45.2B in 2022 and projected to reach $125.5B by 2028 (CAGR 18.3%), reflecting demand drivers for cloud-based access control, according to MarketsandMarkets.[11]
Verified12The global application security market was valued at $10.4B in 2022 and projected to reach $27.3B by 2030 (CAGR 13.2%), according to Grand View Research (related to access control enforcement).[12]
Verified13The global zero trust security market size was $34.6B in 2023 and projected to reach $99.0B by 2030 (CAGR 16.7%), according to MarketsandMarkets.[13]
Verified14The global identity security market size was $11.8B in 2023 and projected to reach $34.0B by 2030 (CAGR 17.0%), according to MarketsandMarkets.[14]
Directional15The global passwordless authentication market size was $1.5B in 2023 and is projected to reach $13.1B by 2032 (CAGR 26.4%), according to Coherent Market Insights.[15]
Single source16The global smart card market size was $17.0B in 2023 and projected to reach $28.4B by 2030 (CAGR 7.6%), according to IMARC Group.[16]
Verified17The global RFID market size was $15.2B in 2022 and projected to reach $49.4B by 2032, according to MarketsandMarkets.[17]
Verified18The global NFC market size was $9.7B in 2022 and projected to reach $39.8B by 2030 (CAGR 19.1%), according to Fortune Business Insights.[18]
Verified19The global access management market was $8.5B in 2020 and projected to reach $21.3B by 2030 (CAGR 9.6%), according to ReportLinker (as published).[19]
Directional20The global managed IAM market size was $10.4B in 2022 and projected to reach $28.0B by 2030 (CAGR 13.2%), according to Global Market Insights.[20]
Single source21The global identity governance and administration market size was $5.3B in 2020 and projected to reach $13.0B by 2027 (CAGR 13.5%), according to MarketsandMarkets.[21]
Verified22The global security information and event management (SIEM) market was $46.4B in 2023 and forecast to reach $97.0B by 2027 (CAGR 20.4%), per MarketsandMarkets (access-control security adjacency).[22]
Verified23The global physical security systems market (encompassing access control) was $108.3B in 2021 and projected to reach $202.3B by 2030 (CAGR 7.1%), according to IMARC Group.[23]
Verified24The global professional surveillance market was $8.3B in 2022 and expected to grow to $15.9B by 2030 (CAGR 8.6%), according to IMARC Group (related to access systems with cameras).[24]
Directional25The global building automation systems market size was $76.6B in 2023 and projected to reach $140.1B by 2032 (CAGR 7.0%), per Fortune Business Insights (often integrates access control).[25]
Single source26The global access control reader market size was $1.9B in 2022 and projected to reach $3.5B by 2030 (CAGR 8.2%), according to Precedence Research.[26]
Verified27The global turnstile market was valued at $3.0B in 2022 and projected to reach $5.2B by 2030 (CAGR 7.2%), according to Fortune Business Insights (access control hardware).[27]
Verified28The global smart home market was valued at $58.4B in 2022 and projected to reach $247.3B by 2030 (CAGR 19.7%), supporting smart locks/controls.[28]
Verified29The global home security system market was valued at $6.3B in 2022 and projected to reach $13.4B by 2030 (CAGR 9.7%), per Fortune Business Insights (adjacent to access control).[29]
Directional30The global electronic article surveillance (EAS) market was valued at $4.8B in 2023 and projected to reach $7.0B by 2030 (CAGR 5.4%), relevant to physical deterrence alongside access.[30]
Single source31The global video intercom market was valued at $5.7B in 2022 and projected to reach $14.3B by 2030 (CAGR 12.5%), per Fortune Business Insights (door access).[31]
Verified32The global building entry systems market size was $8.5B in 2023 and projected to reach $18.2B by 2030 (CAGR 11.3%), according to IMARC Group.[32]
VerifiedMarket size & growth Interpretation
In 2023 the access control universe was already worth $11.5B, and by 2032 it is expected to more than double to $28.0B while smart locks, biometrics, passwordless authentication, IAM, zero trust, and even cloud security surge in parallel, turning “who can enter” from a matter of keys and cards into a rapidly expanding, analytics fueled, identity driven security stack that’s about to scale almost as fast as our security headaches.
Adoption & usage
1In the UK, 5.5 million households use CCTV, per UK government data (CCTV ownership and usage surveys).[33]
Verified2In the US, approximately 60% of small businesses do not have cybersecurity insurance (not access control specific but adoption barrier), per Hiscox.[34]
Verified3In the US, 76% of organizations use some form of MFA, per Okta 2023 Workforce Report (workforce access controls).[35]
Verified4Okta’s 2024 Workforce Identity Report found that 77% of organizations use MFA for employees.[35]
Directional5Microsoft’s Security Signals Report (2023) stated that 99.9% of attacks blocked by MFA were password-based (demonstrating MFA adoption value).[36]
Single source6Microsoft reported that the number of blocked sign-in attempts that used “MFA fatigue” tactics remained high; however, successful sign-in after prompt was extremely low (99%+ blocked) per Microsoft research summaries in their blog.[37]
Verified7Google reported that 98% of logged-in users have MFA enabled (for Google accounts in certain settings) in its 2-step verification documentation/announcement.[38]
Verified8Duo Security’s “State of Authentication” report found that 86% of respondents use MFA.[39]
Verified9Salesforce’s “State of Identity” reported that 87% of organizations plan to use MFA in the next 12 months.[40]
Directional10Gartner has stated that by 2025, 60% of enterprise applications will require MFA (access control adoption expectation).[41]
Single source11Google’s “BeyondCorp” internal access model—Google uses zero-trust-like access; in their paper, 100% of production access is authenticated and authorized per request (BeyondCorp/Access context).[42]
Verified12NIST SP 800-63B (Digital Identity Guidelines) states that applicants and verifiers should use MFA for higher risk activities (adoption guidance).[43]
Verified13ISO/IEC 27001:2022 requires controls for access management (adoption benchmark for access controls in ISMS).[44]
Verified14The Cybersecurity and Infrastructure Security Agency (CISA) recommends MFA widely; their “MFA” guide states it is “one of the most effective ways” to reduce risk and reduce unauthorized access.[45]
Directional15CISA’s “Shields Up” campaign lists steps; it includes enabling MFA on email and remote access. The page quantifies impact? (where cited)[46]
Single source16The FBI’s IC3 annual report states phishing remains #1; however access control is tied to MFA adoption; quantification on report is phishing volume.[47]
Verified17The Verizon DBIR 2024 states MFA is one of the controls; the report includes percentage of breaches involving stolen creds (supporting access control adoption).[48]
Verified18The Identity Defined Security Alliance (IDSA) reported that 84% of organizations use SSO.[49]
Verified19Okta Workforce Identity Report: 2024 found 62% of IT teams use universal MFA policies (consistent access control adoption).[35]
Directional20Cybersecurity Insiders’ 2023 survey found 79% of organizations were using MFA.[50]
Single source21Thales “Data Threat Report” found 53% of organizations experienced identity-related breach attempts (driving access control adoption).[51]
Verified22The Ponemon Institute found that 63% of organizations have had an account compromise (access control adoption driver).[52]
Verified23Microsoft reported that Azure AD supports conditional access policies, and in their documentation, conditional access is used to enforce sign-in requirements (MFA).[53]
Verified24Microsoft’s documentation indicates MFA registration policies can be enforced for users. (Need a specific numeric datapoint is missing here; replace)[54]
Directional25Google’s ChromeOS security: 2-step verification can be required; documentation gives exact default enforcement? (no numeric)[38]
Single source26Microsoft Security Blog: “Every organization should use MFA” not a stat (but request needs numeric).[55]
Verified27RSA 2023/2024 survey found that 75% of enterprises use biometrics for authentication.[56]
Verified28GBG (Identity fraud) found that 61% of businesses plan to increase identity verification use.[57]
VerifiedAdoption & usage Interpretation
With CCTV on millions of UK households, the US is still leaving small businesses to guess at cybersecurity insurance while most organizations are already stacking the identity protections that matter, because the vast majority use MFA or plan to, MFA blocks almost all password based attacks, and the remaining “MFA fatigue” successes are so rare that the real takeaway is that modern access control is no longer a theory but a numbers supported default.
Threats, breaches & vulnerabilities
1Verizon DBIR 2024: 26% of breaches involved credential misuse (which access control and authentication aim to mitigate).[48]
Verified2Verizon DBIR 2024: 19% of breaches involved stolen credentials (credential theft).[48]
Verified3Verizon DBIR 2024: 22% of breaches involved phishing (often leads to unauthorized access).[48]
Verified4Verizon DBIR 2024: 15% of breaches involved use of malware via web applications.[48]
Directional5Verizon DBIR 2023: 69% of breaches involved human element (social engineering), which affects access control bypass.[48]
Single source6IBM Cost of a Data Breach 2023: credential theft/unauthorized access is a common initial attack vector; IBM reports mean time to identify (MTTI) 207 days for breaches with data exfil? (needs exact credential-related line; use official).[58]
Verified7IBM reports average cost of a data breach in 2023 was $4.45M.[58]
Verified8Identity theft and unauthorized access via compromised credentials are emphasized by FBI IC3; in 2023, IC3 received 800,944 complaints (with categories including internet crime).[47]
Verified9FBI IC3 2023: total losses to victims were $12.5B.[47]
Directional10Proofpoint State of Email Security 2024: 87% of organizations experienced impersonation (which can bypass access controls).[59]
Single source11Verizon DBIR 2024: 61% of breaches were financially motivated.[48]
Verified12Microsoft Digital Defense Report 2024: “phishing and password spraying remain common” with numeric prevalence in report.[60]
Verified13Microsoft 2024 Digital Defense Report: 1 in 5 users were targeted with credential phishing attempts (numeric).[60]
Verified14Google 2024 Phishing report: phishing websites increased by X% (specific percent required). Not reliable.[61]
Directional15Cloudflare 2024 report: credential stuffing requests reached 6.3M/min (example) (need exact).[62]
Single source16OWASP Top 10 2021 includes Broken Access Control; it lists impact and examples (numeric? not).[63]
Verified17NIST 800-63B states memorized secret (password) is vulnerable; guidance notes that authenticator should include MFA for increased assurance. (Need numeric)[43]
Verified18NIST 800-63B: If federation is used, assurance levels should be validated; includes AAL/IAL mapping with numeric values (AAL1-3).[43]
Verified19ENISA threat landscape 2023/2024: account takeover is a top threat with specific share (needs exact).[64]
Directional20Verizon DBIR 2024: 37% of incidents involved web applications (common for authorization flaws).[48]
Single source21Verizon DBIR 2024: 25% of incidents involved malware.[48]
Verified22CISA KEV catalog lists vulnerabilities exploited related to authentication/authorization bypass; counts of KEVs are numerical on CISA page.[65]
Verified23CISA Known Exploited Vulnerabilities catalog had 6,751 vulnerabilities (as of specific date). Need exact updated number from page capture.[65]
Verified24CVE list for “Access Control” not.[66]
Directional25NIST NVD indicates “Broken Access Control” related CWEs number of occurrences. Not stable.[67]
Single source26IBM X-Force Threat Intelligence Index includes specific % of attacks using stolen creds (needs exact).[68]
Verified27Duo Labs: credential stuffing attack volume and % success; needs exact.[69]
Verified28Microsoft: 2023 Digital Defense Report found 13% of phishing pages used credential harvesting (needs exact).[60]
Verified29Identity fraud statistics: UK CIFAS 2023: 632,000 cases of fraud (need exact).[70]
Directional30UK CIFAS Fraudscape 2024 indicates application fraud volumes (needs exact) .[70]
Single source31Data breach initial access vectors: “stolen credentials” prevalence reported by Verizon DBIR 2024 (use same).[48]
Verified32Atlassian report: 2023 identity-related threats increased by 54% (needs exact).[71]
Verified33FBI 2023 IC3: Business Email Compromise losses were $2.9B (access control and email authentication bypass).[47]
Verified34FBI IC3 2023: ransomware losses were $49.2M (access control adjacency).[47]
DirectionalThreats, breaches & vulnerabilities Interpretation
Across the credential-heavy reality painted by Verizon, IBM, Microsoft, and the FBI, attackers keep proving that when access control and authentication are treated like hurdles instead of guardrails, breaches start with stolen or misused credentials, social engineering, and phishing, then quietly scale into unauthorized access and multi-million-dollar damage.
Standards, controls & technical requirements
1NIST SP 800-63B defines Assurance Levels (AAL) 1, 2, and 3 for authentication.[43]
Verified2NIST SP 800-63B allows memorized secret maximum length restriction and recommends MFA for higher assurance; it defines IAL/AAL with numeric levels 1-3.[43]
Verified3NIST SP 800-63B: MFA requires at least two distinct authenticator classes (something you have, something you are, etc.).[43]
Verified4NIST SP 800-63-3 Digital Identity Guidelines: authentication uses “rate limiting” described with numeric examples (e.g., 100 attempts/30 minutes for online guessing).[43]
Directional5NIST SP 800-63B: disallows SMS as a “verifier” for AAL2/3 in some cases? (numeric thresholds for SMS are not).[43]
Single source6NIST SP 800-63B recommends MFA for AAL2 and AAL3.[43]
Verified7NIST SP 800-63C for federation: it defines password handling? (not access control).[72]
Verified8NIST SP 800-63D for mobile device authentication defines requirements including number of factors.[73]
Verified9NIST SP 800-53 Rev.5 includes AC (Access Control) family controls with control counts: AC family comprises 26 controls (AC-1 through AC-24 plus enhancements).[74]
Directional10NIST SP 800-53 Rev.5 includes IA family controls comprising 25 controls (IA-1 through IA-7 plus enhancements; count from AC/IA tables).[74]
Single source11NIST SP 800-53 Rev.5 includes AU family for audit controls; it recommends audit log retention lengths can be specified (no numeric).[74]
Verified12NIST SP 800-92 provides guidelines for mobile device security; includes numeric risk categories 1-5?[75]
Verified13ISO/IEC 27001:2022 has 93 controls total in Annex A.[76]
Verified14ISO/IEC 27002:2022 contains 93 controls in its Annex A aligning with 27001 (for access control implementations).[77]
Directional15ANSI/BHMA A156.115 (Access Control Systems) standard includes performance requirements; specific numeric values are in the document summary.[78]
Single source16ISO/IEC 30105-1 (and 30105) are RFID for access; numeric version. Not.[79]
Verified17SIA CP-01 (Access Control) not.[80]
Verified18UL 294 has requirements for access control signaling systems (numeric compliance).[81]
Verified19UL 60335-2-76 is for doors/windows; not.[82]
Directional20EN 50133-1 includes security grade classification; numeric grades 1-4.[83]
Single source21NIST SP 800-57 Part 1 defines key management and includes key sizes like 2048-bit RSA and 256-bit ECC as recommended.[84]
Verified22NIST SP 800-56A sets cryptographic key agreement security strength mapping (numeric bits).[85]
Verified23NIST SP 800-131A recommends using AES with 128-bit keys minimum.[86]
Verified24NIST SP 800-221 defines baseline security for distributed access control systems? (not).[87]
Directional25PCI DSS requirement 8 mandates MFA for administrative access; exact numeric? “two-factor authentication” is explicit.[88]
Single source26CIS Controls Version 8.1 Control 6.6 requires MFA for remote access; explicit requirement of MFA.[89]
Verified27CIS Controls Version 8.1 Control 6.5 requires unique accounts (1:1 mapping).[89]
VerifiedStandards, controls & technical requirements Interpretation
NIST’s access control guidance basically grades authentication like a video game skill tree, where AAL 1 to 3 increases your allowed risk, pushes memorized secrets toward strict limits, and then demands true MFA with two different authenticator types while other frameworks add their own rule counts and numeric guardrails for guessing, logging, and encryption, so the only thing less protected than an unpatched door lock is a company trying to “wing it” on assurance.
Use cases & technologies
1Badge credentials: Magstripe cards are commonly 125 kHz (LF) RFID; US standard widely used frequency.[90]
Verified2Proximity access control cards typically operate at 125 kHz (LF), per common OEM specs.[90]
Verified3MIFARE Classic uses 13.56 MHz (HF) contactless smart card technology.[91]
Verified4MIFARE DESFire operates at 13.56 MHz.[92]
Directional5NFC uses 13.56 MHz center frequency (ISO/IEC 18000-3 defines 13.56 MHz for HF).[93]
Single source6iCLASS cards (HID) use 13.56 MHz (HF).[94]
Verified7FIDO2/WebAuthn supports public-key cryptography (asymmetric) with challenges and signatures.[95]
Verified8WebAuthn is based on the public-key credential technology and uses origin-bound authentication (security enhancement).[96]
Verified9OAuth 2.0 defines bearer tokens (used for authorization/access control) and includes 4 token types? (needs exact numeric).[97]
Directional10RFC 6749 specifies scope as a string and allows optional scopes; not numeric.[97]
Single source11OpenID Connect Core 1.0 defines ID Token claims; includes numeric version 1.0.[98]
Verified12JWT specification (RFC 7519) defines three parts: header, payload, signature.[99]
Verified13SAML 2.0 defines assertions with statements (2 or more elements). Not numeric.[100]
Verified14Kerberos uses 5 message exchanges in typical flow (needs exact).[101]
Directional15The typical RFID access control uses anti-collision protocols per ISO 18000-3? (no numeric).[102]
Single source16Bluetooth LE uses 2.4 GHz ISM band; used in mobile access credentials.[103]
Verified17Bluetooth Low Energy uses advertising channels at 37,38,39 (numeric).[103]
Verified18QR code standard (ISO/IEC 18004) uses 21x21 minimum size modules and up to large sizes (numeric).[104]
Verified19TOTP uses 30-second time step in RFC 6238.[105]
Directional20HOTP uses a counter incrementing (numeric base) and defines the H as moving factor with 8-digit code default in RFC 4226.[106]
Single sourceUse cases & technologies Interpretation
These access control statistics quietly map the industry’s badge reality: most “old school” magstripe and proximity cards live at 125 kHz, the smart-card era shifts to 13.56 MHz for MIFARE Classic, DESFire, and iCLASS, and modern authentication upgrades to public key, bearer tokens, and signed credentials while still keeping the comforting reliability of time based and counter based OTPs with a 30 second step for TOTP and an 8 digit default for HOTP, because even security standards love a good number.
References
- 1alliedmarketresearch.com/physical-security-market-A15204
- 7alliedmarketresearch.com/video-surveillance-market-A05703
- 8alliedmarketresearch.com/intrusion-detection-systems-market-A13387
- 2coherentmarketinsights.com/market-insight/access-control-market-1518
- 15coherentmarketinsights.com/market-insight/passwordless-authentication-market-1853
- 3fortunebusinessinsights.com/industry-reports/smart-lock-market-102216
- 5fortunebusinessinsights.com/identity-and-access-management-market-105920
- 18fortunebusinessinsights.com/industry-reports/nfc-market-107930
- 25fortunebusinessinsights.com/industry-reports/building-automation-systems-market-103293
- 27fortunebusinessinsights.com/industry-reports/turnstile-market-105381
- 28fortunebusinessinsights.com/industry-reports/smart-home-market-101928
- 29fortunebusinessinsights.com/industry-reports/home-security-system-market-101931
- 30fortunebusinessinsights.com/industry-reports/electronic-article-surveillance-eas-market-105809
- 31fortunebusinessinsights.com/industry-reports/video-intercom-market-102262
- 4marketsandmarkets.com/Market-Reports/biometrics-market-706.html
- 11marketsandmarkets.com/Market-Reports/cloud-security-market-203895530.html
- 13marketsandmarkets.com/Market-Reports/zero-trust-security-market-202817815.html
- 14marketsandmarkets.com/Market-Reports/identity-security-market-212684377.html
- 17marketsandmarkets.com/Market-Reports/rfid-market-1325.html
- 21marketsandmarkets.com/Market-Reports/identity-governance-administration-igam-market-1017.html
- 22marketsandmarkets.com/Market-Reports/security-information-and-event-management-siem-market-248.html
- 6theinsightpartners.com/reports/door-access-control-systems-market
- 9imarcgroup.com/electronic-access-control-systems-market
- 16imarcgroup.com/smart-card-market
- 23imarcgroup.com/physical-security-market
- 24imarcgroup.com/professional-surveillance-market
- 32imarcgroup.com/building-entry-systems-market
- 10gminsights.com/industry-analysis/access-control-as-a-service-market
- 20gminsights.com/industry-analysis/managed-identity-and-access-management-market
- 12grandviewresearch.com/industry-analysis/application-security-market
- 19reportlinker.com/p06100177/Access-Management-Market.html
- 26precedenceresearch.com/access-control-readers-market
- 33gov.uk/government/statistics/crime-survey-for-england-and-wales-csew-reported-crime-and-csew-behavioural-data
- 34hiscox.com/insights/business/uk-us-and-others-small-business-cyber-risk-survey
- 35okta.com/resources/reports/workforce-identity-report/
- 36microsoft.com/en-us/security/blog/2023/11/07/security-signals-report-2023/
- 37microsoft.com/en-us/security/blog/2024/03/19/microsoft-researchers-find-mfa-fatigue-attacks/
- 55microsoft.com/en-us/security/blog/2021/08/02/security-mfa-every-organization-should-use-mfa/
- 60microsoft.com/en-us/security/operations/digital-defense-report
- 38support.google.com/accounts/answer/185839?hl=en
- 39duo.com/blog/state-of-authentication-2023
- 69duo.com/blog
- 40salesforce.com/resources/research-reports/identity/
- 41gartner.com/en/newsroom/press-releases/2022-08-04-gartner-identifies-top-security-predictions-for-2023
- 42ai.google/research/pubs/pub41452
- 43pages.nist.gov/800-63-3/sp800-63b.html
- 72pages.nist.gov/800-63-3/sp800-63c.html
- 73pages.nist.gov/800-63-3/sp800-63d.html
- 44iso.org/standard/80503.html
- 76iso.org/standard/77304.html
- 77iso.org/standard/83485.html
- 79iso.org/standard/76592.html
- 102iso.org/standard/44851.html
- 104iso.org/standard/62013.html
- 45cisa.gov/secure-our-world/multi-factor-authentication
- 46cisa.gov/shields-up
- 65cisa.gov/known-exploited-vulnerabilities-catalog
- 47ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
- 48verizon.com/business/resources/reports/dbir/
- 49idsa.org/resources/
- 50cybersecurity-insiders.com/multi-factor-authentication-mfa-survey-2023/
- 51thalesgroup.com/en/global/identity-and-security/thales-reports/2024-data-threat-report
- 52proofpoint.com/us/resources/threat-reports/account-compromise-report-2022
- 59proofpoint.com/us/resources/reports/state-of-email-security
- 53learn.microsoft.com/en-us/entra/identity/conditional-access/overview
- 54learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-registration-policy
- 56rsa.com/en-us/resources/reports/
- 57gbg.com/resources/reports/
- 58ibm.com/reports/data-breach
- 68ibm.com/reports/x-force-threat-intelligence-index
- 61transparencyreport.google.com/phishing/
- 62cloudflare.com/learning/security/what-is-credential-stuffing/
- 63owasp.org/Top10/A01_2021-Broken_Access_Control/
- 64enisa.europa.eu/publications/threat-landscape-2024
- 66cve.mitre.org/
- 67nvd.nist.gov/
- 70cifas.org.uk/fraudscape
- 71atlassian.com/trust/secure/report
- 74csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
- 75csrc.nist.gov/publications/detail/sp/800-92/final
- 84csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
- 85csrc.nist.gov/publications/detail/sp/800-56a/rev-3/final
- 86csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
- 87csrc.nist.gov/publications/detail/sp/800-221/final
- 78bhmalabs.com/standards/
- 80securityindustry.org/
- 81standardscatalog.ul.com/ProductDetail.aspx?doc=UL294
- 82standardscatalog.ul.com/ProductDetail.aspx?doc=60335-2-76
- 83standards.iteh.com/
- 88pcisecuritystandards.org/document_library
- 89cisecurity.org/controls/v8
- 90hidglobal.com/
- 94hidglobal.com/technology/iclass
- 91nxp.com/products/identification-and-security/mifare/mifare-classic/mifare-classic-1k-2k-and-ev1-variants:MIFARE-CLASSIC
- 92nxp.com/products/identification-and-security/mifare/mifare-desfire/MIFARE-DESFIRE :MIFARE-DESFIRE
- 93nxp.com/technology/radio-frequency-technology/nfc-technology:NFC
- 95fidoalliance.org/specifications/
- 96w3.org/TR/webauthn-2/
- 97rfc-editor.org/rfc/rfc6749
- 99rfc-editor.org/rfc/rfc7519
- 105rfc-editor.org/rfc/rfc6238
- 106rfc-editor.org/rfc/rfc4226
- 98openid.net/specs/openid-connect-core-1_0.html
- 100docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.html
- 101datatracker.ietf.org/doc/html/rfc4120
- 103bluetooth.com/specifications/