Access Control, Video and Alerts in One Platform: What "Unified" Actually Means

A unified security platform runs access control, video and alerting on one database, with one event timeline and one set of user permissions. An integrated platform runs three separate systems that pass messages to each other. The difference shows up the first time someone asks who opened a door at 2:14 a.m. and what the camera saw: a unified system answers in one click, an integrated one answers in three logins and a timestamp comparison.

That distinction decides most of what follows: how fast an incident gets resolved, how many alerts a team can actually act on, and what the system costs to run after year one.

What makes a platform unified rather than integrated

Vendors use both words loosely. Four tests separate them.

One event record, not three. In a unified system, a badge read, the video clip around it and the alert it generated are the same event object. In an integrated system they are three records joined by a timestamp, and timestamps drift. A camera clock two seconds off a controller clock is enough to pull the wrong clip.

One permission model. A property manager who can see Building C should see Building C's doors, cameras and alerts, set once. If the video system has its own user list, every staffing change is a change in two places, and the second one gets forgotten.

One alert pipeline. A door held open, a camera detecting a person in a restricted area and a sensor going offline should all land in the same queue, with the same escalation rules. Separate pipelines mean separate apps, and separate apps mean someone is not watching one of them.

One failure domain you can actually test. When access control and video are separate products joined by an integration, the integration is the part that breaks, and neither vendor owns it. Ask who answers the phone when the link drops.

The three layers where integration has to happen

Credential layer

The reader-to-controller link is where most legacy systems are stuck. Wiegand, the default for three decades, sends credential data unencrypted and unsupervised: a device spliced onto the wire can read badge numbers or inject them, and the panel cannot tell a cut line from a quiet one.

OSDP, the Security Industry Association's replacement, is the standard to require. Its Secure Channel mode supports AES-128 encryption, it supervises the connection so a cut wire raises an alarm, and it was approved as an international standard, IEC 60839-11-5:2020, by the International Electrotechnical Commission in May 2020. SIA released version 2.2.2 in October 2024.

Put OSDP v2.2.x with Secure Channel enabled in the RFP as a requirement, not a preference. A reader that only speaks Wiegand is a reader you will replace.

Video layer

The question to ask is what happens to the cameras already on site. A platform that only works with its own cameras is a hardware refresh disguised as a software purchase. ONVIF profile support, specifically Profile S for streaming and Profile T for advanced streaming and metadata, is what lets a new platform read existing cameras.

For federal and federally-aligned deployments, NIST Special Publication 800-116 Revision 1 sets out how physical access control systems should use PIV credentials, including the authentication mechanisms appropriate to each security area. It is a useful structure even outside government, because it forces a decision about which doors need one factor and which need more.

Event and alert layer

This is the layer most buyers skip in evaluation and complain about in year two. The questions that matter:

• Can a rule combine inputs from two subsystems, for example a door forced open and motion on the adjacent camera?
• Does an alert carry the clip with it, or a link that requires a second login?
• Can alerts be routed by time of day and by role, so overnight events reach the on-call person and not the whole staff list?
• Is there a record of who acknowledged what, and when?

An alert that nobody can act on from their phone at 11 p.m. is not a security feature.

Why separate systems get expensive

The licence cost is the visible part. The rest shows up in operations.

• Incident investigation. Separate systems: pull the door log, match the timestamp, find the camera, export the clip, commonly 15 to 40 minutes. Unified platform: click the event and the clip is attached, commonly under 2 minutes.
• Staff onboarding. Separate systems: accounts in two or three systems and two or three training sessions. Unified platform: one account, one interface.
• Integration maintenance. Separate systems: breaks on either vendor's update, and neither owns the fix. Unified platform: a single vendor and a single support path.
• Audit response. Separate systems: manual correlation across exports. Unified platform: one filtered export.
• Adding a building. Separate systems: new controllers, a new NVR and new integration work. Unified platform: new devices on the existing tenant.

The investigation line is the one to quantify for your own site. Multiply your average incident count per month by the time your team currently spends correlating logs and footage, then by a loaded hourly rate. For most multi-site operators that single number is larger than the software difference.

What to ask a vendor

1. Is access control, video and alerting one database or several? Ask to see the schema or the API, not the marketing diagram.
2. Does the reader link run OSDP with Secure Channel, and at what version?
3. Which ONVIF profiles are supported, and can you show it reading a camera we already own?
4. Can one alert rule take inputs from a door and a camera at the same time?
5. When an alert fires at 2 a.m., what exactly arrives on the phone?
6. Who owns the integration when it breaks?
7. What happens to door control if the internet connection drops?

Question 7 catches more cloud platforms than the others. Local controllers should hold credentials and keep doors working through an outage, syncing when the link returns. Ask how long the offline cache lasts and how many credentials it holds.

Where the market sits

Platforms tend to fall into three approaches, and each fits a different kind of site.

• Access-first, video added. Door hardware and credentials are the core, with video integrated later. This fits sites where door control is the main job and cameras are secondary.
• Video-first, access added. Camera and analytics are the core, with access control added to the console. This fits sites with heavy camera estates and existing VMS investment.
• Platform-first. Access, video and alerting are built on one event model from the start. This fits multi-site operators who investigate incidents regularly.

Frequently asked questions

What is a unified security platform?

A single system that manages access control, video and alerting on one database, with one event timeline, one permission model and one alert pipeline. It differs from an integrated system, where separate products exchange messages across an interface.

Is a unified platform the same as a converged system?

Converged usually means physical and IT security managed under one organisation or policy. Unified refers to the technical architecture. A unified platform supports convergence but the terms are not interchangeable.

Can a unified platform use cameras we already own?

It depends on ONVIF support. A platform supporting ONVIF Profile S and Profile T can generally read standards-compliant third-party cameras. Ask for a demonstration against your specific camera models rather than accepting a compatibility list.

Does unifying mean replacing all the door hardware?

Not necessarily. Controllers that support open hardware, such as Mercury boards, can often be retained while the software layer changes. Readers running Wiegand should be upgraded to OSDP, which is usually a reader swap rather than a rewire.

What happens if the internet goes down?

In a well-designed system, local controllers hold a credential cache and continue making access decisions offline, then sync events when connectivity returns. Confirm the cache size and duration during evaluation.

How long does a unified platform deployment take?

For a single site retaining existing controllers and cameras, typically two to four weeks. A full hardware replacement across multiple sites runs to months. The variable is hardware, not software.

See Aimee in action

Alocity OS brings cloud access control, AI video and alerting onto one event record, so an investigation starts from a single event instead of three exports. Aimee, its conversational AI operator, lets a manager ask in plain English who opened a door and what the camera saw. Book a live Aimee demo to walk through your own doors and cameras.

Sources

• Security Industry Association, Open Supervised Device Protocol
• NIST SP 800-116 Rev. 1
• ONVIF Profile S and Profile T