FIELD NOTE · PHYSICAL SECURITY · OCTOBER 2026 · 4 MIN
Ask a property manager who can open the doors in their building and they will usually describe residents, staff and guests. Ask who can change who opens the doors, and the answer is often a company they don't employ.
Access control is installed by an integrator. During commissioning, the integrator creates the administrator accounts it needs to configure readers, controllers and schedules. When the job is done, those accounts stay. Management is given an operator login that can issue and revoke cards. The administrator login, the one that can add other administrators, stays with the vendor.
Why it matters
An administrator account on an access control system is a key to every key. Whoever holds it can create credentials, change schedules and remove audit trails. If that account sits with a vendor, ownership's control of its own doors depends on that vendor's people, laptops and passwords.
Locks themselves are not immune either. In 2024, researchers showed that more than three million hotel door locks at over 13,000 properties could be opened, and eighteen months after disclosure only about 36% had been updated or replaced.[1] Patching depended on the operators and vendors of each property acting.
The broader pattern is familiar from IT. The 2013 Target breach began with network credentials stolen from an HVAC contractor.[2] Verizon's 2026 report found third parties involved in 48% of breaches.[3]
What to check this week
- Ask your integrator for a list of every administrator account on the access control and video systems, with the name of the person behind each one.
- Confirm that at least one administrator account belongs to ownership, and that someone at ownership has used it.
- Ask how remote access to the access control head-end works, and who can turn it off.
None of this needs new equipment. It needs ownership to hold the account that controls the rest.
SOURCES