A mechanically certified lock does not necessarily protect against a cyber attack. The EN 15684 standard assesses the physical resistance of building locks, but it does not cover vulnerabilities related to Wi-Fi, Bluetooth, or embedded software. This distinction between mechanical security and cybersecurity is the starting point for evaluating the high-security locks available today.
Mechanical Certification and Cybersecurity of Locks: Two Distinct Assessments
Most lock comparisons focus on resistance to physical break-ins: number of locking points, quality of the cylinder, thickness of the steel. These criteria remain fundamental. A certified A2P multipoint lock offers documented resistance against picking, drilling, and forced entry.
However, as soon as a model incorporates a wireless connection, a second level of assessment becomes necessary. The EN 15684 standard does not cover the digital vulnerabilities of a connected lock. An impeccable mechanical cylinder can coexist with vulnerable firmware.
To compare these two dimensions, here are the criteria to distinguish when choosing a high-security lock:
| Criterion | High-Security Mechanical Lock | Connected Lock |
|---|---|---|
| Resistance to break-in | Certified A2P (1 to 3 stars) | Variable depending on the model, A2P certification possible |
| Digital protection | Not applicable | Depends on the protocol (Bluetooth, Wi-Fi, Zigbee) |
| Degraded mode in case of failure | Permanent operation (mechanical) | Physical key, local code, or emergency power depending on the model |
| Update obligation | None | Firmware updates recommended or mandatory |
| Upcoming regulatory framework | Stable existing standards | European regulation on cyber resilience being implemented |
When evaluating a connected lock, check if the manufacturer documents its management of digital incidents, not just the mechanical resistance of its product. This criterion allows for a quick filtering of Serrurerie Valbusa services offering truly comprehensive solutions.
European Regulation on Cyber Resilience: What Changes for Connected Locks
Connected locks are among the equipment targeted by the European regulation on cyber resilience. This text imposes concrete obligations on manufacturers of digital products regarding post-marketing monitoring.
A vulnerability that is actively exploited must be reported within 24 hours, followed by a complete notification within 72 hours to the relevant European authorities. This timeframe forces manufacturers to maintain active monitoring of their products long after the sale.
This obligation transforms the selection criterion for a connected lock. Until now, comparisons focused on features (smartphone opening, badge, fingerprint) and mechanical certification. From now on, the manufacturer’s ability to manage incidents after purchase becomes a standalone reliability indicator.
How to Evaluate a Manufacturer on This Criterion
- Check if the manufacturer publishes a history of firmware updates for its connected lock models, indicating active product monitoring
- Look for the existence of a vulnerability reporting channel (coordinated disclosure), which indicates a structured cybersecurity policy
- Prefer brands that specify the guaranteed duration of software support after purchase, as a connected lock without updates becomes a weakness
Degraded Mode and Autonomy: The Overlooked Criteria of Connected Locks
The loss of Internet connection does not necessarily cause a complete lockout. User feedback shows that in the event of a network failure, local opening via Bluetooth or physical key may still be functional. Remote control, however, becomes unavailable.
This distinction between local access and remote control deserves particular attention. A reliable degraded mode requires at least a mechanical key or a local code, independent of any connection. Models that rely exclusively on a cloud application present a risk of being locked out in the event of a server failure.
Energy autonomy is another blind spot. A battery-powered connected lock must clearly indicate the remaining battery level. Some models include emergency power via an external contact (9V battery or micro-USB port), allowing unlocking even when the internal battery is depleted.
Mechanical or Connected Multipoint Lock: Decide Based on Use
For a main entrance door in a residence occupied year-round, a certified A2P mechanical multipoint lock remains a robust protection, without technological dependence. Installing a high-security cylinder with protection against picking and bumping covers most common break-in attempts.
Conversely, a secondary residence or a vacation rental benefits concretely from a connected lock: management of temporary access, opening history, remote locking. The choice between mechanical and connected depends on the occupancy profile of the property, not on an intrinsically superior level of security of one over the other.
Enhancing the Overall Resistance of the Door: Beyond the Lock
A high-security lock loses some of its effectiveness if the rest of the opening does not follow suit. The door frame, hinges, and the panel itself contribute to the overall resistance against a break-in attempt.
- A reinforced metal frame prevents the separation of the door leaf, a technique used to bypass multipoint locks
- Anti-pick hinges block the lifting of the door at the hinge side, a frequent vulnerability on older doors
- A hardened steel cylinder guard reduces the risk of cylinder pulling or drilling, the primary attack point on European profile locks
- An anti-pinch angle, fixed on the edge of the door, completes the protection by preventing the insertion of a tool between the door and the frame
The lock protects the locking point, the reinforcement protects the entire access. A diagnosis of the existing door, performed by a locksmith, allows for the identification of weak links before investing in expensive equipment that would only address part of the problem.
