Wiegand was designed in the 1980s and it shows: card data travels in the clear, the reader cannot be supervised, and a pair of wires behind a reader is enough to replay a credential.
The cable is usually fine
Most Wiegand installs used multi-core cable with spare pairs. OSDP runs over two of them. In the majority of retrofits we survey, the existing cable supports the migration without a single new run.
Phase it by risk
Start with the doors where a replay attack actually matters — perimeter, server rooms, cash handling — and leave low-risk interior doors until the next refresh cycle. A controller that speaks both protocols lets the two states coexist for as long as needed.
Turn on Secure Channel
OSDP without Secure Channel is barely better than Wiegand. Insist on it being enabled and keys rotated, and verify it after commissioning rather than trusting the installation report.
