Lee Odess and his team brought industry leaders to ACS25 in San Sebastian, Spain for focused conversations on the future of access and security.  Mohamed Atif Shehzad attended and shares key insights on how the sector must rethink value, collaboration, and user experience.

It’s both and it’s cyclical. People are reluctant to change because they’re comfortable, it’s working, it may not be perfect but it’s working, or they’ve tried it, and they’ve met resistance or they have met roadblocks. So that’s the first resistance.

The second resistance is they don’t understand it. How would it benefit them? Or why would it benefit the security program at large or initiative at large? So that’s the typical initial resistance or reluctance.

Once you get through to that, now you have deployed this, executed the program, you’re managing it, and now there’s actually things that are changing with it. So if you put very rigid controls, if you didn’t have a good change management process that was fluid and flexible and dynamic, you’re not going to know how to address those changes. So typically when that starts to happen, if you don’t have good principles in place, now things are going to start happening ad hoc. People are going to start improvising, your program now starts to fray at the edges, and ten years later, you are back at square one where things are not working and everybody’s resistant to the new program.

So when we say 10 to 20 years, obviously we’re not developing a 20-year program. What we’re trying to do is put a framework of best practices in place for end users who are now able to follow that framework to say, okay, as technology is changing or whatever environment is changing within my organization, I know who the roles and responsibilities are. I know what the process is to get in front of it to become proactive about it. And that’s the 10-year longevity that we look at and talk about – how to give them the tools to basically keep refreshing their security program and keep staying ahead of it as opposed to reacting to it.

Data is the core of your campus security business case. It is not only the most effective way to communicate value, but it is also indisputable. Think of it as the language of the C-suite, who are more likely to make decisions based on facts rather than feelings.

“This access control system can reduce tailgating by 30%” is a much more compelling argument than “This new access control system will help prevent unauthorized entry.”

As organizations increasingly rely on data-driven decision-making, having specific, actionable, and relevant data points is essential to securing buy-in. Begin by ensuring that the data you use applies to your campus security program. This means using data sources that match the goals and challenges you identified earlier. The data presented should answer questions like: “How will this data impact the security program? How will it reduce risks?”

Now that you’ve demonstrated how data can address security challenges, it’s time to shift the focus and explore how security data can be leveraged to drive operational improvements. If high energy costs are a concern shared by stakeholders, highlight how access control data can identify underutilized spaces to reduce unnecessary energy consumption. Explain how license plate recognition tools can not only enhance parking security but also optimize parking lot usage. Or advocate for the adoption of video analytics that provide data to guide future event planning, such as determining where to add new entry points or when to adjust staffing levels.

These examples showcase the broader value of data collected through security systems. When leadership and campus security are aligned, available data points can be a powerful tool for demonstrating value, creating operational efficiencies, and reducing risks across campus.

It is possible to over-engineer a system for the sake of functional design, where too much time is spent on how a design looks on paper rather than how it performs.  Instead of getting bogged down in the details, consider implementing UAT early and often. It is also equally important to engage appropriate stakeholders in the UAT process: system administrators, area owners, facility owners, audit or reporting entities, etc. Testing workflows in a live environment with input from actual users drives better system adoption and uncovers potential problems before solutions are implemented at scale. Iterative UAT conducted throughout each workflow also allows you to visualize the progress being made within the context of your environment. 

Even if your security project focuses on a single system, it is unlikely to operate in isolation. Let’s say you’re installing a new access control system. Have you thought about how your HR team will enroll new employees? Or how your IT department will manage network security? Could operations, who value occupancy data, share the budget for the new system? A skilled project manager sees beyond the immediate security impact and considers how the project will impact the organization as a whole.