Skip to content
Four years into the hybrid experiment, the numbers have stopped moving.
JLL’s Global Occupancy Planning Benchmark Report for 2026, drawing on 84 organizations and 716 million square feet of portfolio, puts actual office utilization at 56% against a target of 74%. The gap has narrowed from 25 percentage points in 2025 to 18 in 2026 but it has not closed, and the direction of travel suggests it will not. Kastle Systems’ badge data across more than 2,600 buildings shows the same shape from a different angle: mid-week occupancy roughly double Monday and Friday, with Tuesday through Thursday carrying the load.
Hybrid is not a transition anymore. It is the operating model.
Which creates a problem that has landed, largely without discussion, on the physical security system.
The system of record nobody designated
Ask a corporate real estate team where their occupancy data comes from and a significant number will tell you it comes from badge swipes. Around 34% of employers now use badge or occupancy tracking to monitor attendance, and a meaningful proportion tie attendance to performance review.
Think about what that means operationally. A system procured to keep unauthorized people out of a building is now producing data used to make decisions about lease renewals, floor consolidations, desk ratios, and in some organizations, individual employees’ performance conversations.
That is a substantial promotion for a system that was specified, in most buildings, based on door count and reader cost.
The gap shows up in three specific places.
Problem one: the data is not as clean as the dashboard suggests
Access control logs measure credential events at doors. They do not measure people in buildings, and the difference matters more than most reporting acknowledges.
One person holding a door open for four colleagues generates one event. A visitor escorted through a turnstile on a host’s credential generates one event attributed to the host. Someone who badges into the lobby, works a full day, and leaves through a fire exit generates an entry with no exit. A contractor issued a temporary credential under a generic account appears as the same person for six weeks.
None of this is a fault. The system is doing exactly what it was designed to do. But an occupancy figure built on that data and presented to a real estate committee as a basis for surrendering a floor carries an error margin nobody has quantified.
Anti-passback, turnstiles or optical speed gates at the main entry point, and a properly integrated visitor management system are what convert credential events into something closer to a population count. If your occupancy reporting matters commercially, the controls that make it accurate are a data quality investment, not a security one and they should be justified that way when the budget conversation happens.
Problem two: the population is variable and the safety systems assume it is not
Evacuation procedures in most buildings were written for a predictable headcount. Hybrid has removed the predictability without removing the obligation.
On a Tuesday the building might hold 70% of its badge population. On a Friday, 25%. The fire wardens rostered for a full building are themselves hybrid. The person who holds the assembly point roster works from home on the day of the incident. The muster list is printed weekly and the population changes daily.
For a security integrator, this is the most consequential change hybrid has made, and it gets the least attention. A roll call that was adequate when the same 400 people came in every day is not adequate when the 400 becomes a different 180 each morning.
What closes the gap:
- Integration between access control and fire detection, so that an alarm produces a live occupancy list rather than a printed roster
- Visitor and contractor records included in that list, not held in a separate system at reception
- The list accessible from the assembly point, on a mobile device, when the building and its server room are both evacuated
- Anti-passback or equivalent, so the count reflects people rather than door openings
Every one of those is achievable on current platforms. Very few buildings have all four.
Problem three: badge data is employee data, and it is now being used in ways it was not collected for
This is the section US organizations tend to skip, and it is the one with the longest tail.
When access control data was used to investigate incidents, its purpose was narrow, its retention was defensible, and nobody outside security looked at it. Now it feeds attendance dashboards, real estate models and, in some organizations, performance management. The purpose has changed. In most cases the governance around it has not.
European operators have been through this. Under GDPR, using access control data for attendance monitoring is processing personal data for a purpose distinct from the one it was collected for, and that requires its own lawful basis, its own retention period, its own transparency to employees, and in many cases a documented assessment before it starts. Organizations that got this wrong did not usually get it wrong technically. They got it wrong by letting HR ask facilities for a report and facilities saying yes.
The US regulatory position is more fragmented, and this is not legal advice. But the direction is consistent: state privacy statutes continue to expand, biometric credentials carry specific exposure in several states, and employee monitoring is receiving legislative attention. An organization that documents its badge-data purposes now is doing work it will have to do eventually, at a moment of its own choosing rather than someone else’s.
Three questions worth putting to your own organization this quarter:
- Who receives reports derived from access control data, and what decisions are made from them?
- What is the retention period on badge event logs, and who set it?
- Have employees been told, in language they would recognize, what the system records and what it is used for?
If the answer to the third is a line in a handbook nobody has read since onboarding, that is worth knowing before someone else establishes it.
What changes in a specification
For anyone specifying or upgrading access control in a hybrid environment, the requirements have shifted in ways that a 2019 specification document does not capture.
Credential lifecycle matters more than credential technology
Hybrid organizations have higher turnover in access requirements including more contractors, more short-term visitors, more people whose access needs change with a project rather than with a job title. The system’s ability to issue, modify and revoke at scale, ideally driven from HR or identity systems rather than manually, is now a primary requirement rather than a nice-to-have.
Mobile credentials stop being a convenience
When people are in the building two or three days a week, physical cards get left at home at a rate that generates real reception workload. The temporary-pass process that was an occasional exception becomes a daily routine, and every temporary pass is a credential with weaker controls around it.
Reader and door hardware sized for peak, not average
A building at 56% average utilization can still be at 90% on a Wednesday morning. Entry infrastructure specified against average occupancy creates queues on exactly the days the organization is trying to make attractive.
Integration is the requirement, not the feature
Access control that cannot talk to visitor management, fire detection, desk booking and building management is a closed system generating data nobody can act on.
The uncomfortable summary
Most organizations are running workplace analytics on infrastructure that was procured as a door-opening system, reporting occupancy figures with an unquantified error margin, evacuating buildings against a headcount they cannot verify, and processing employee data for purposes they have not documented.
None of that is a crisis. All of it is fixable, and most of it is fixable without replacing the estate.
But it does mean the access control conversation is no longer a security conversation. It is a real estate conversation, an HR conversation and a data governance conversation, and the people in those functions are usually not in the room when the system gets specified.
They should be.
Evolution works with organizations across the UK, Ireland, mainland Europe and the United States to design, integrate and maintain access control and physical security systems. If your access control data is now informing decisions it was never specified to inform, we can help you establish what it can and cannot reliably tell you.