The three failure modes every plastic credential shares
A keycard says "let this person through." It can't tell whether the person tapping it is the one it was issued to. It can't refuse to work after that person leaves. It can't notice when two people walk through on one swipe. Every fix in modern access control is a workaround for one of those three gaps.
Cloning. The 125 kHz prox cards that run most office buildings clone in under 10 seconds with a $30 Flipper Zero or Proxmark device. An attacker holds the gear near a legitimate card in an elevator or a coffee shop and walks out with a working duplicate.
Stale credentials. Most mid-market organizations don't revoke a former employee's badge the day they leave. The HR system marks the person terminated, IT disables their email, and the access system sits with an active credential for weeks until a quarterly audit runs. PCI-DSS, HIPAA, and FTC Safeguards assessors flag this constantly.
Tailgating. The legitimate badge holder walks through; an unauthorized person follows. The door opens and closes once, no log entry. Without camera analytics counting people through the entry, the system never sees it.
Tailgating: the AI case that's actually real
Most "AI security" claims dissolve under inspection. Tailgating detection holds up. The camera at the entry counts people through; if two badged on one swipe, the system flags it.
It earns its cost at server rooms, pharmacies, finance offices, IT closets, and any zone where an unauthorized entry is expensive enough that a guard would be the alternative. A flagged tailgate at 2 AM at the server room door is a signal worth investigating. It doesn't earn its cost at a busy front lobby at 9 AM, where the model fires constantly, staff ignore the alerts, and the system devolves into noise. Use it for high-stakes zones, not every door.
Migration: hybrid, not forklift
Don't rip out everything that works. The smart play is hybrid: existing prox stays on internal doors where the threat model is low, mobile credentials with biometric step-up go on the front door and any regulated zone, and the cloud platform unifies the logs. That cloud side migrates first because it's a software change, not hardware.
Mobile readers are backwards-compatible with prox cards on every major platform, so the migration happens at the reader-replacement cycle (typically 7 to 10 years). New buildings and tenant fit-outs go straight to mobile. Existing buildings stay hybrid until the readers age out.