ISC East named Digital Trust and Identity as its theme. The hard part is not the access decision. It is the record that decision reads.
ISC East ran November 3 to 5. The organizers reported more than 6,100 security professionals and over 200 exhibiting brands.
One disclosure before we start. What follows is a read of the public record rather than a report from the aisle — the announcements, the press releases and the post-show write-ups we could find. We link the sources so you can check the reasoning rather than take our word for the conclusion. That is a different thing from walking the floor. We would rather say so.
The public record turns out to be enough, because the most interesting thing about this show is visible in what was announced.
SIA’s education program at ISC East carried a stated theme: Digital Trust and Identity. The framing was about verified identities and continuous authentication becoming the foundation of trust and access in a converging physical and digital world.
This was not a one-off. ISC West in April was positioned around digital trust and converged security as well. Two shows in one year. The industry has named the same thing as its centre of gravity. It named the right thing.
The product news was strong. It also clustered.
Luminys demonstrated AI video alongside a facial recognition terminal. Synology showed AI-powered monitoring with previews of upcoming cameras and access control. March Networks and VIVOTEK demonstrated Command Enterprise, integrating C•CURE access control with video. ASSA ABLOY showed its digital access portfolio, including the Control iD iDFace Max and the DoorBird D22 video intercom. Allegion showed the Schlage XE360 with RealSync, the Zentra multifamily platform and Schlage mobile credentials. NAPCO showed MVP Access with biometric and multifactor authentication added, plus a cloud version for smaller sites. Sielox showed AnyWare edge for one to eight doors. Altronix showed power and networking infrastructure.
These are serious products from teams who know the problem well. Taken together they say something encouraging: the industry has largely solved a hard problem.
Facial recognition terminals, video analytics, weapon detection, biometric readers, multifactor authentication. Every one of those is an answer to who is this? — and the answers have become fast, accurate and affordable in a way they simply were not five years ago. That is a genuine achievement and it took a decade of work.
It is also the first half.
The distinction. The access decision is instant and almost always right. The record it checks against is the part that decays.
A facial recognition terminal that identifies a contractor with high confidence has told you something true and useful. It has not told you whether that contractor should still have access, whether their project ended in August, whether they also exist as three separate records in three other systems, or what happens to all of those the day they are let go.
Access control has answered the door question for fifty years. Card, reader, panel, access level, schedule. The decision takes milliseconds and it is almost always correct, given what it has been told.
The unsolved half is what it has been told. Whether this is one person or five records. Whether the grant was ever looked at again after the day it was made. Whether it ends everywhere when the relationship ends. And now, whether any of that machinery applies at all when the thing asking is not a person and wants information rather than a door.
That is the half the show’s own theme was pointing at.
SIA ran its first-ever StartUps in Security Pitch Competition at the show. Seven companies pitched on the Bridge Stage on November 4. Three advanced to a live championship the following morning, judged in front of an audience.
Two of the winners are worth looking at closely, because of a design decision they share.
Angel Protection Systems took second place. Founded in 2022 after Uvalde, the company built around a finding from its own research: in the mass shootings it studied, the average gap between the first shot and the first 911 call was ninety seconds. Its system detects a brandished firearm on cameras a facility already owns. Then a licensed analyst verifies every detection before a single alert reaches the facility, 911 dispatch and, where applicable, the nearest hospital at the same moment. It protects 19 paying customers across more than 1,850 camera streams.
Rapidflare took third. It builds agentic AI for technical sales and support teams across manufacturers, integrators and distributors — agents that read a company’s datasheets, install guides and catalogs, then answer the way a senior sales engineer would. Every answer arrives with a citation.
Two early-stage companies, in unrelated markets, with no particular reason to be thinking about access control governance, both chose to build the verification step into the product rather than treat it as overhead. One put a person in the loop by design. The other made every output traceable to the document behind it.
When that happens independently, it is usually a signal about where a category is heading rather than a coincidence.
An AI that perceives is judged on accuracy. An AI that acts is judged on accountability. Those are different disciplines. The second one is where this is going.
The moment a system can do something — unlock a door, suspend a credential, dispatch an elevator, escalate to police — the questions change. Not was it right? but who authorized this, what was it allowed to do and what record did it leave? A detection nobody can verify puts the burden straight back on the operator. An answer with no citation is a confident guess.
This is why we keep saying that a model which can reason should not automatically be able to act. It is why every outcome in our own architecture has to close on evidence rather than on a conversation. When something goes wrong in a building, “the AI said so” does not survive a tenant conversation, an insurance question or a deposition. “Here is who asked, what they were cleared for, what was approved and what the system did” does.
We hold ourselves to that unevenly and have said so publicly: some of what we have built ships today, some is in active development and continuous self-initiated agents remain the roadmap rather than the pitch.
The industry has now named digital trust and identity as its theme across two consecutive shows. The product category that answers it is still forming, which is not a criticism of anyone’s engineering. It is sequencing. Recognition had to get good first. It did.
The next stretch belongs to whoever treats the identity record as the product — keeping it singular, current and accountable — rather than as the thing the door decision happens to read.
So the question worth taking into next year’s buying cycle is no longer how accurately does it identify people? Nearly everyone’s answer to that is converging on very accurate.
It is this: when it acts, what approved the action and what record does it leave behind?
Ask it of every vendor who will answer. Ask it of us.
