How System Integrators Can Build Recurring Revenue with Identity-Based Access
The PACS system integrator business model has a structural weakness: it’s project-based. You sell a system, install it, configure it, and move to the next project. Revenue comes in lumps tied to construction schedules, renovations, and security upgrades. Between projects, the revenue stops.
Annual maintenance contracts add some recurring revenue — but maintenance margins are thin, and customers shop maintenance aggressively.
Identity-based access creates a different revenue structure: per-station recurring subscriptions on the same Mercury infrastructure you already deploy.
The current SI economics
A typical PACS project for a 200-door commercial building:
| Component | Revenue | Margin | Recurring? |
|---|---|---|---|
| Panels (Mercury LP/MP) | $40K–$80K | 20–30% | No |
| Readers | $20K–$40K | 20–30% | No |
| Software (LenelS2/Genetec/etc.) | $15K–$30K | 10–20% | Annual maintenance |
| Installation labor | $30K–$60K | 40–50% | No |
| Credentials (badges) | $2K–$5K | 30–40% | Replacement cycle |
| Annual maintenance | $8K–$15K | 15–25% | Yes (thin) |
The project generates $115K–$215K in revenue, mostly in the first 90 days. After that, the SI earns $8K–$15K per year in maintenance. The customer is served. The relationship continues — but the revenue doesn’t grow.
What identity-based access adds
KeyShare’s physical access solution deploys as software on the Mercury controllers the SI already installs. The Panel Application runs on existing panels. The Add-On appears inside the existing PACS console. The SI’s hardware deployment is unchanged.
What changes is the revenue model: per-station recurring subscriptions for the identity-based access capability. The subscription is per-station (not per-user), which means the revenue is predictable and grows with site expansion — not with employee headcount fluctuations.
For the same 200-door building:
| Component | Revenue | Margin | Recurring? |
|---|---|---|---|
| All existing PACS revenue | Same as above | Same | Same |
| Identity-based access subscriptions | Recurring | Higher than maintenance | Yes — monthly/annual |
| Visitor management (if deployed) | Recurring per-site | Higher than maintenance | Yes — monthly/annual |
The SI’s project revenue stays the same. The recurring revenue layer is additive. Over a 5-year access control lifecycle, the cumulative subscription revenue can approach — or exceed — the original project revenue.
Why SIs are the right channel
Identity-based access deploys on Mercury panels. SIs know Mercury panels. The deployment is software — the SI loads the Panel Application, configures the Add-On, sets up Connect. This is configuration work, not a new skill set. The SI’s existing Mercury expertise is the deployment qualification.
The support model reinforces the SI relationship: the SI provides Tier 1 support (deployment, configuration, reader issues), and KeyShare provides Tier 2/3 (Panel Application, Connect platform, identity verification). The customer’s primary support relationship stays with their SI.
For SIs evaluating the opportunity: the Channel Partner Program includes certification training, demo environments, deal registration, and co-marketing support. Certified SIs get pipeline protection and priority pricing.
The demo advantage
Most PACS products require installing hardware in a customer’s building to demonstrate. Identity-based access can be demonstrated in any conference room with a Puck, a phone with a digital ID, and a laptop running the admin console in demo mode. Pre-loaded test data shows enrollment, credential provisioning, and access events.
The demo takes 15 minutes. The customer sees a live tap, a live enrollment, and a live access event — without touching their production infrastructure. That’s a different sales conversation than “trust us, we’ll install it and show you in 8 weeks.”
For your customers, the economic case is straightforward — identity-based access eliminates the per-user credential fee that stalls their mobile credential deployments.
