Mercury Security, a company owned by HID, has unveiled its new S4 family of input/output modules for physical access control systems. The platform increases the number of doors that can be managed from the same footprint and adds secure boot, hardware-based key protection, and support for post-quantum cryptography, aiming to modernize existing installations without forcing a full infrastructure replacement.
Mercury S4 key facts in 30 seconds
- Mercury S4 modernizes access control systems while maintaining compatibility with existing installations.
- The MR54-S4 module can manage four doors in the space previously occupied by a two-door interface.
- The platform includes secure boot and a Common Criteria EAL6+ certified secure module.
- Mercury adds support for post-quantum cryptography with long-lived installations in mind.
- The new units multiply memory sixfold and storage eightfold compared with earlier generations.
Card-based, mobile-credential, or biometric-reader access systems typically remain installed for many years. That lifespan creates a particular problem: hardware deployed today will have to coexist with threats and security requirements that will likely change several times before it’s replaced.
Mercury is trying to address that scenario with a modular architecture that allows installations to be upgraded progressively. The company notes that its controllers are present in more than eight million installations worldwide, so maintaining compatibility with earlier generations can be especially relevant for integrators and organizations with large deployments.
The S4 family has been available since September through Mercury’s OEM partner network.
More Doors in the Same Space, Without Replacing Every Panel
One of the most visible improvements comes in the Mercury MR54-S4 Reader Interface Module.
The device can control four doors while occupying the same physical space previously needed for a two-door interface module. That doubles density without necessarily requiring larger cabinets for housing the systems.
Each module can manage up to 12 inputs and eight readers.
Space might seem like a secondary concern, but access controllers are typically installed in technical cabinets and comms rooms shared with other systems.
Increasing the number of doors supported per module reduces the number of panels needed, simplifies some of the wiring, and lets an installation expand without consuming as much additional space.
Mercury has also designed S4 with forward and backward compatibility.
The goal is for an organization to be able to modernize parts of its infrastructure progressively rather than carrying out a full replacement.
This approach can be especially relevant in corporate buildings, hospitals, universities, government facilities, industrial sites, or complexes with hundreds or thousands of access points.
In these environments, replacing a system doesn’t just mean buying new controllers. It also requires technician visits, wiring, testing, downtime, and integration with existing software.
Mercury argues that reducing those interventions can lower costs over the infrastructure’s lifespan. The actual savings, however, will depend on the size and characteristics of each installation.
The new modules also boost internal resources.
According to the manufacturer, S4 has six times more memory and eight times more storage than previous generations. That extra headroom leaves room to add new features via software and meet future requirements without immediately changing the hardware.
Physical Access Control Also Has a Cybersecurity Problem
S4’s most interesting evolution is probably found in its security architecture.
A door controller might look like a fundamentally physical device, but modern systems are connected to IP networks, management servers, cloud services, and enterprise platforms.
A vulnerability therefore stops being purely an IT problem, a shift that has become clearer as attacks against network hardware exposed to the internet keep making headlines.
If an attacker manages to alter the firmware or compromise the keys used by the system, the incident can end up affecting mechanisms designed specifically to control who can enter certain areas.
Mercury has added secure boot.
This technology establishes a hardware-based root of trust and verifies that the software running at startup is authorized. Its purpose is to prevent modified or unauthorized firmware from loading normally on the device.
The new platform also includes a Secure Access Module (SAM) with Common Criteria EAL6+ certification to protect operations involving cryptographic keys.
EAL stands for Evaluation Assurance Level, a scale used within the international Common Criteria standard to assess the level of assurance applied during a product’s security evaluation.
The component’s EAL6+ certification shouldn’t be read as an equivalent certification for the entire access-control infrastructure. It refers specifically to the secure module used within the architecture.
Mercury also notes that S4 was designed with frameworks from the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS) in mind, along with requirements tied to the evolving European Cyber Resilience Act (CRA).
Post-Quantum Cryptography Reaches the Doors Too
Another element that’s unusual for this kind of device is support for post-quantum cryptography, a shift already under way in other parts of the security industry, from hardware security modules like Thales’s Luna 8 to network equipment.
Today’s quantum computers aren’t capable of breaking, at practical scale, the main cryptographic systems that currently protect enterprise communications.
The problem lies in the future.
A sufficiently powerful, fault-tolerant quantum computer could compromise public-key algorithms currently in use. That’s why organizations like NIST have spent years developing and standardizing algorithms resistant to quantum attacks.
The European Commission has also set out a coordinated roadmap for moving toward post-quantum cryptography, paying particular attention to critical infrastructure and high-risk systems.
Access control has an additional quirk: the hardware can stay installed for a decade or more.
A controller installed in 2026 could still be running when cryptographic requirements look considerably different.
Mercury isn’t claiming that S4 systems are already using post-quantum cryptography for all their operations. What the platform adds is support for this shift and a way to ease future implementations.
The distinction matters, because being ready for a technology isn’t the same as having it deployed and active across every configuration.
The approach tries to avoid a future cryptographic migration forcing the retirement of thousands of controllers simply because their hardware can’t support the new mechanisms.
Physical Security Keeps Getting Closer to IT
The S4 family reflects a broader shift in physical security systems.
Cameras, readers, door controllers, sensors, and alarm systems have gradually moved from operating as relatively isolated installations to becoming part of enterprise networks.
That opens up new management possibilities, but it also expands the surface security teams need to monitor.
A physical security manager now needs to think about issues that, years ago, were associated almost exclusively with the IT department: signed firmware, key management, vulnerabilities, updates, encrypted communications, and support lifecycles.
At the same time, cybersecurity teams have to include physical devices in their inventories and policies.
Mercury’s bet is to prepare the controller for that convergence without giving up a feature that’s especially important in this market: interoperability.
The company maintains an open architecture that lets manufacturers and partners integrate their controllers with different software platforms.
S4 tries to preserve that model while adding new security and performance capabilities.
Being able to keep existing components can matter as much as the new specs. In large installations, a full refresh can involve hundreds or thousands of doors.
Upgrading controllers gradually lets organizations spread out investment and reduce the physical work required.
The arrival of post-quantum cryptography in a product as seemingly everyday as a door controller also shows how far preparation for a possible cryptographic transition has come.
The quantum computer capable of endangering today’s cryptography doesn’t exist yet. The devices that could still be installed by the time it arrives, however, are already being built.
Frequently Asked Questions
What are the Mercury S4 modules?
They’re a new generation of input/output modules for professional physical access control systems. They’re designed to expand existing installations and add greater security and processing capabilities.
How many doors can the Mercury MR54-S4 control?
The MR54-S4 provides capacity for four doors in the space previously used by a two-door interface. It can support up to 12 inputs and eight readers.
Does Mercury S4 use post-quantum cryptography?
Mercury states that the architecture supports post-quantum cryptography. That doesn’t mean every installation automatically uses post-quantum algorithms from day one.
Why does a door control system need cybersecurity?
Today’s systems are connected to networks, servers, and management platforms. Protecting firmware, communications, and keys is necessary to prevent a cyberattack from also compromising physical security functions.
via: newsroom.hidglobal