Layer 1
Site and approach
Detects activity around gates, driveways, gardens, yards, detached stores and external approaches. It may buy time, but the outside environment creates many nuisance triggers.
Physical security chapter
Alarms and Detection Systems
An alarm is not a barrier. It does not stop a door being forced, prevent a display case being smashed or make a valuable object impossible to remove. Its purpose is to recognise an abnormal event, communicate it reliably and trigger a useful response before the loss becomes irreversible.
That distinction is especially important for collectors. Valuable objects may be small enough to remove in seconds, individually recognisable, difficult to replace and concentrated in rooms or buildings that are rarely occupied. Detection must therefore be designed around the collection, the likely route to it and the time available to respond—not around the number of devices in a brochure.
The four questions every system must answer
- 1.What has happened?
- 2.Where has it happened?
- 3.Is the signal credible?
- 4.Who will act, and how quickly?
Collector scenario
The alarm sounded, but the collection was already gone
A collector stores several highly portable pieces in a glazed cabinet at the rear of a detached garage. A motion detector covers the middle of the room and sends an app alert to one telephone. The garage door is forced, the offender remains close to the wall, smashes the cabinet and removes the most valuable objects before crossing the detector's strongest field.
The equipment did not necessarily fail. The design failed to detect the attack early, the cabinet offered almost no delay, the alert depended on one unavailable person and no responder could arrive within the removal time. The system recorded an event; it did not create a credible intervention.
What happened
Detection began too late in the attack sequence.
Why it mattered
Removal time was shorter than notification and attendance time.
What changes
Add shell detection, delay, resilient signalling and a real response plan.
Foundations
An alarm system is a chain, not a siren
A complete system combines detection devices, a control panel, warning and communication equipment, event logging, power resilience and an agreed response. The panel must distinguish intrusion from entry activity, tamper, detector faults, low batteries, power failure, communications failure and deliberately omitted zones. The response arrangement must then translate that information into safe action.
The quality of the chain is usually more important than the loudness of the sounder. A highly sensitive detector linked to an unreliable internet connection, one sleeping phone and no safe attendance plan is not robust protection.
01
Event
An abnormal condition begins: approach, forced entry, smoke, water, interference or system tamper.
02
Detection
The appropriate device identifies the change early enough to matter and the panel assigns it to the correct zone and alarm type.
03
Transmission
The signal reaches the intended recipient despite plausible power, broadband, mobile or equipment failure.
04
Verification
Detector sequence, audio, video or human confirmation helps distinguish a credible incident from nuisance activity.
05
Response
A safe, documented action follows: emergency services, professional response, keyholder attendance, water isolation or salvage measures.
06
Evidence and review
Logs, footage and collection records are preserved, the incident is reconstructed and weaknesses are corrected.
Coverage
Design from the outside in—and from the object out
Detection becomes more precise as it moves closer to the collectible, but precision also increases complexity. Object-level sensors may identify exactly what moved, while shell detection may provide earlier warning. A good design uses the right combination rather than treating one layer as universally superior.
Layer 2
Building shell
Protects doors, windows, roof openings, garage doors, cellar access and other vulnerable parts of the building envelope. Shell detection is often the first reliable indication that an entry route is being attacked.
Layer 3
Room and route
Detects movement through rooms, corridors and storage areas. It is useful, but can signal only after entry has already occurred unless paired with stronger outer layers.
Layer 4
Container
Protects display cases, cabinets, safes, drawers, storage cages and inner enclosures. This layer matters where the wider room is legitimately occupied or where a particular container concentrates value.
Layer 5
Object
Detects movement, displacement or interference with a particular collectible. It offers precision, but can be costly, awkward during legitimate handling and physically unsuitable for fragile material.
Diagnostic test
Trace one credible attack route
Imagine an offender approaching the property, defeating the weakest entry point, reaching the most portable valuable object and leaving. Mark the exact point at which the first signal occurs. Then compare attack time, communication time and attendance time.
Where the first meaningful signal occurs only after the collection has been reached, the system may still be useful for evidence, but it is not buying much protective time.
System choice
Audible, self-monitored and professionally monitored systems
These categories describe who receives the alarm and what happens next. They are not simple rankings. A well-designed self-monitored system with several reliable recipients may outperform a badly specified monitored system, but high-risk collections generally require a response chain that does not depend on the collector being awake, connected and available.
Audible-only
A local siren may deter an opportunist or alert nearby people, but it does not guarantee that anyone will report the incident or attend. Its value depends almost entirely on who can hear it and what they will do.
- Low recurring cost
- Visible and audible deterrence
- Weak where neighbours are absent, indifferent or unable to act
Self-monitored
The system sends alerts to the collector or trusted contacts through an app, text or automated call. This can be effective for modest risk, but the collector becomes the monitoring centre and every phone, account, network and human delay becomes part of the response chain.
- Useful remote status and fault information
- Alerts should reach more than one trusted recipient
- Never attend a possible intrusion merely because an app has notified you
Professionally monitored
Signals are sent to an Alarm Receiving Centre, where operators follow an agreed process and may contact keyholders, security personnel or emergency services. This is often the benchmark for concentrated, portable or insurer-sensitive collections.
- Operates when the collector is unavailable
- Can monitor communication and system faults
- Requires contracts, maintenance and disciplined use
| Output | Recipient | Best contribution | Main weakness |
|---|---|---|---|
| Local sounder | People nearby | Deterrence or local attention | No assured attendance |
| App alert | Collector or trusted contacts | Fast information at modest cost | Phone, account and human availability |
| ARC monitoring | Professional operators | Managed escalation and fault handling | Contract, compliance and keyholder dependency |
| Video verification | Owner or operator | Adds context to an alarm | Image quality, privacy and network dependency |
Detection technologies
Choose sensors for the attack and the environment
Detector selection should follow the surface, room, likely attack and normal daily activity. No sensor should be treated as universally reliable. Curtains, heating, pets, traffic vibration, storage changes, metal cabinets and external weather can all alter performance after installation.
Shell
Door and window contacts
Simple and generally reliable. They identify opening, but may not signal until a door, frame or window has already been substantially attacked.
Pre-entry
Shock and vibration sensors
Can detect forcing, drilling, cutting or impact before entry is complete. They must be tuned to the surface and environment or normal building movement will create unwanted alarms.
Glazing
Glass-break detection
Acoustic or glass-mounted devices can identify glazing attack. Their effectiveness depends on glass type, detector location, room acoustics, furnishings and the type of transparent barrier used.
Interior
Passive infrared movement
PIR detectors respond to changes in infrared energy. They are affordable and common, but placement, heating, sunlight, pets, storage and blocked fields of view all affect performance.
Interior
Microwave and dual technology
Microwave detection can be sensitive beyond the intended room. Dual-technology devices may reduce unwanted alarms, but requiring two conditions can also miss or delay marginal events if badly positioned.
Boundary
Curtain and narrow-beam detection
Creates a narrow protected band across a doorway, window bank, corridor or wall of cases. Useful where movement elsewhere in the room must remain possible.
Inner zones
Collection rooms, cases and individual objects
A dedicated collection room should usually be treated as an inner security zone rather than as an ordinary household room. Separate zoning can allow the collection area to remain armed while the rest of the home is occupied, identify the affected area more precisely and limit access by visitors, cleaners or contractors.
The operational design matters as much as the hardware. If family members repeatedly trigger the inner zone, it will eventually be bypassed or ignored. The system must fit realistic behaviour rather than demand perfect discipline.
Cases and cabinets
Contacts, vibration sensors, glass-break devices, tilt switches, fibre-optic loops and internal motion detection can reveal unauthorised opening or attack while the wider room is occupied.
They do not make weak glazing or flimsy construction secure. Compare defeat time with alarm transmission and response time.
Object-level detection
Pressure-sensitive plinths, accelerometers, tilt sensors, tags, tethers and trackers may be justified where one object dominates value or can be removed without forcing a room or case.
Adhesives, batteries, radio blockage, repeated handling and physical contact can create conservation risks. No device should be attached to an important object without material-specific judgement.
More than theft
Fire, water and environmental detection
Collections are threatened by hazards that do not arrive as an intruder. Fire, water and environmental failure may be more probable than targeted theft and may spread through many objects at once. These systems should share a response philosophy with intrusion detection: early warning, reliable communication and a practical intervention.
Fire
Life safety comes first. Collection protection must never weaken escape or fire-safety arrangements. Smoke, heat, multi-sensor or specialist aspirating systems should be selected for the room, fuel load and likely nuisance conditions.
- Consider paper, textiles, plastics, batteries, foams and old electrical equipment
- Interlinked alarms improve warning across larger or multi-storey properties
- Seek qualified advice for unusual materials, dense storage or business use
Water
Leaks can cause extensive loss without dramatic warning. Point sensors, conductive ropes, flow monitors and smart shut-off systems are useful only when the alert leads to rapid isolation, attendance or salvage.
- Place sensors below pipes, tanks, boilers, radiators and low basement points
- Do not store valuable objects directly on the floor
- A sensor is not a substitute for sound maintenance and elevation
Environmental failure
Temperature and relative-humidity alarms can reveal heating failure, rapid damp increase, open windows, water ingress, power loss or sensor failure. Thresholds must distinguish a harmless fluctuation from a sustained or fast-moving risk.
- Define acceptable range, duration and rate of change
- Decide who receives the alert
- Write down what practical response is possible at any hour
Verification and resilience
A signal must survive failure and remain believable
Verification may be sequential, audio, video or human. A door contact followed by room movement provides a different level of confidence from one isolated signal. Verification reduces unnecessary escalation, but it must not be so strict that a rapid theft creates only one qualifying event and is dismissed.
Communication resilience is equally important. A secondary path should be genuinely independent. Two services that depend on the same router, cable entry or power supply may fail together. The system should report communication loss, prolonged polling failure, mains failure, battery condition and tamper—not merely wait for an intrusion alarm.
Signal timing
Before entry or after entry?
A detector at the collection-room door is not equivalent to one at the external entry point. The first may record arrival at the target; the second may buy time before the target is reached.
Attack time
How quickly can the object be removed?
A case alarm has limited value if weak glazing can be defeated and the object removed in seconds. Physical delay must be long enough for communication and response to matter.
Response time
Who can act, and how soon?
The loudness of the siren is less important than the reliability of the response chain. A distant owner, unavailable neighbour or unreachable keyholder may make a technically sound alarm operationally weak.
Evidence
What will remain after the event?
Event logs, detector sequence, communication status and video may explain what happened. Inventory records, photographs, serial numbers and valuations establish what was lost.
Infrastructure
Wired, wireless and hybrid systems
Wired
Stable and suitable for larger installations, but disruptive to install and vulnerable if cables are badly routed. Rearrangement can be difficult in finished or historic buildings.
Wireless
Easier to add and less disruptive, but batteries, radio range, metal storage, interference, jamming and dependence on proprietary cloud services require active management.
Hybrid
Often practical in established homes: wired panel and primary zones with wireless cabinets, outbuildings or later additions. Judge the complete system, not the marketing label.
System survival
Power, tamper and cybersecurity
A control-panel battery does not keep the router, mobile communicator, cameras, network switches and electronic locks operating. Power resilience must be assessed across the whole chain, including detached buildings and long outages. Backup batteries deteriorate and require testing and replacement.
A serious system should also identify attempts to open panels, remove detectors, cut cables, mask lenses, disable routers, jam radio devices, interrupt power or steal the recorder. Critical equipment should not sit beside the entry door, inside the collection room or in a location exposed by property photographs.
Modern alarms and cameras are networked computers. Use unique passwords, multi-factor authentication where available, supported firmware, restricted user accounts, secure recovery email and controlled installer access. Remove former users and document what happens if a cloud service is withdrawn.
The camera system should not become a remote catalogue for an attacker
Indoor footage can reveal collection contents, room layout, routines, alarm controls and blind areas. Security accounts, retention periods, remote access and shared credentials should be treated as part of physical security, not as ordinary smart-home convenience.
Human reliability
Keyholders and response planning
A keyholder is not merely someone with a spare key. They must be contactable, close enough to act, able to enter, familiar with the system and clear about when not to enter. They should never be expected to confront an intruder.
The written response plan should distinguish confirmed intrusion, unconfirmed intrusion, fire, water, power failure, environmental excursion, communication fault and tamper. It should identify safe contacts, shut-off points, collection salvage priorities and where restricted documentation is held.
Response hierarchy
1
Protect people
Do not enter a property where intrusion, fire, smoke, structural failure or electrical danger may be present.
2
Escalate correctly
Follow the monitoring or emergency-service process appropriate to the signal type.
3
Limit continuing damage
Where safe and authorised, isolate water, electricity or environmental failure.
4
Preserve evidence
Avoid overwriting logs or recordings and document copies made.
5
Begin salvage
Use pre-agreed priorities and material-appropriate emergency guidance.
Operational quality
False alarms are a security failure, not an inconvenience
Repeated unwanted activations cause users to stop setting the system, neighbours to ignore it, keyholders to withdraw and monitoring or police-response status to be affected. Every activation should be classified as genuine incident, user error, equipment fault, environmental cause, design problem or unexplained event.
“Unexplained” should not be reset and forgotten. Repeated activity in one zone may indicate intermittent wiring, failing equipment, pests, water, building movement, attempted interference or an incorrect zone description.
Common failure patterns
Where collector systems go wrong
An expensive collection with a consumer package
The system may be adequate for routine household risk while remaining wholly disproportionate to a concentrated, portable or publicly known collection.
Cameras without prompt detection
Excellent footage may be produced while nobody is alerted quickly enough to intervene. Evidence after loss is not the same as active protection.
Room detection without shell protection
The first alarm occurs only after the intruder has entered the building and may already be beside the collection.
App alerts sent to one phone
One battery, account, network connection and person becomes the entire monitoring and response system.
Environmental alerts without intervention
A system repeatedly reports high humidity or a leak, but nobody knows how to isolate water, restore heating or move vulnerable objects.
A system that is rarely armed
Poorly designed routines, false alarms and awkward zoning cause users to omit the collection area or abandon the system altogether.
Myth
A monitored alarm automatically brings the police.
Reality
Monitoring means a signal reaches a monitoring centre. Police response depends on the system, verification, current policy, local arrangements and the incident itself.
Myth
More detectors always mean better protection.
Reality
Coverage, placement, reliability and response matter more than device count. Poorly selected sensors create gaps, nuisance alarms and eventual non-use.
Myth
CCTV proves the alarm is working.
Reality
A camera may deter, detect, verify or record evidence, but those are different functions. A wide view of a room may not identify a face or trigger any response.
Myth
Wireless means weak and wired means secure.
Reality
Either can be appropriate. The meaningful questions are supervision, tamper detection, radio conditions, cable routing, power resilience, support life and maintenance.
Proportionate design
Match protection to the collection, not value alone
Monetary value is only one axis. Portability, notoriety, occupancy, replacement difficulty, attacker knowledge, location, concentration of value and realistic response time can move a collection into a higher risk category even when the headline valuation is lower.
Basic risk
Modest, low-visibility collection
Good doors and locks, interlinked fire detection, shell contacts, interior movement detection, alerts to more than one person, obvious water detection and regular testing may be proportionate.
Elevated risk
Substantial, portable or frequently unattended collection
Consider professional design, shell and room detection, a separately armed collection zone, resilient signalling, monitored response, camera verification, collection-room fire detection and integrated water protection.
High or targeted risk
Exceptional value, known location or insurer conditions
A specialist survey may justify higher-grade detection, layered shell-room-case-object protection, monitored CCTV, resilient communications, professional keyholding, formal testing and close insurer involvement.
Specialist threshold
When professional design becomes necessary
Seek a specialist security survey before purchase or installation where the collection is exceptionally valuable, highly portable, publicly associated with the address, stored in a detached or unusual building, subject to insurer warranties, exposed to repeated visitors or affected by previous threats or attempted theft.
The installer should provide a documented risk assessment, system design, detector and zone schedule, explanation of coverage, signalling details, maintenance arrangements, training and certification. Be cautious where the same package is recommended to every property or where the discussion is limited to cameras and an app.
Before commissioning
Questions to ask the installer and monitoring provider
- What exact events is the proposed system designed to detect?
- Which plausible routes to the collection remain undetected?
- At what point in a realistic attack will the first signal occur?
- What happens if broadband, mobile service or mains power fails?
- Are signalling paths genuinely independent or do they share one router, cable or power supply?
- What counts as a verified or confirmed alarm?
- Who receives intrusion, fire, water, tamper and communication-failure signals?
- What system grade and standards are proposed, and why are they appropriate?
- Will the insurer accept the design and installer before work begins?
- Who owns the equipment, and what continues to work if a subscription or cloud service ends?
- Who retains remote administrator access, and how is it removed later?
- What testing, maintenance and battery replacement are required?
Documentation
Keep the security record strong enough to survive an incident
Exact detector positions, codes and detailed security plans should be held in a restricted file rather than ordinary collection documentation. However, enough structured information must survive to prove what was installed, how it was maintained, whether insurer conditions were met and what happened during an incident.
- Risk assessment and design proposal
- Zone and detector schedule
- Installation and commissioning certificate
- Applicable standards and system grade
- Monitoring and signalling arrangements
- Keyholder and response instructions
- Maintenance and testing reports
- Alarm activation and fault reports
- Battery replacement dates
- User and administrator access review
- Insurer correspondence and security warranties
- Record of later alterations to rooms, shelving, doors, networks or equipment
After an incident
Preserve the original record
Event logs may establish the first activation, detector sequence, alarm-setting state, omitted zones, communication status, power failure, tamper and keyholder contact. Video may show activity before and after the alarm.
Avoid repeatedly editing, exporting or overwriting original records. Preserve source files where possible, document copies and pair alarm evidence with inventory, photographs, serial numbers, distinguishing marks, valuations and provenance. Detection proves that something happened; collection documentation proves what was affected.
Lifecycle
Changes that should trigger a security review
- A major acquisition or new valuation materially increases concentration of value
- The collection moves or expands into a loft, garage, basement or outbuilding
- New shelving, metal cabinets or display cases change detector coverage or radio performance
- Doors, windows, walls or room layouts change
- Broadband, routers, monitoring providers or cloud accounts change
- Household members, cleaners, carers, contractors or regular visitors change
- The collection becomes more visible through selling, publication, social media or public display
- An attempted burglary, unexplained activation or repeated nuisance alarm occurs
Central judgement
The best alarm is the system that closes the whole loop
- ✓The right events are detected early enough to matter.
- ✓The affected location and type of incident are identifiable.
- ✓Signals survive likely power, network and equipment failures.
- ✓Genuine events can be distinguished from nuisance activity.
- ✓Physical barriers delay access or removal long enough for response to matter.
- ✓Responders know what to do and what not to do.
- ✓The system is actually armed, tested and maintained.
- ✓Useful evidence and collection documentation survive the incident.
Final principle
Detection should buy time, information and a credible response.
Physical security should make that time useful. Neither works properly in isolation. Where the answers about first detection, transmission, verification, attendance and evidence remain vague, the installation is not yet a security plan—it is only a collection of devices.
Continue learning
Locks, Keys and Access Control
Understand how keys, locks and authorised access determine who can reach the collection before detection is needed.
Back to Physical Security
Return to the full physical-security chapter and its sequence of protective measures.
Cameras and Visual Monitoring
Continue into camera placement, live monitoring, verification, privacy and evidential use.
Related topics
Layered Physical Security
Combine delay, detection, communication and response so that no single failure exposes the collection.
Secure Rooms and Storage Areas
Plan inner zones, room boundaries and dedicated storage spaces around the collection itself.
Collection Risk Assessment
Assess value concentration, portability, visibility, occupancy, access and likely attacker knowledge before selecting equipment.
Routine Security Checks
Turn testing, user checks, fault review and response readiness into a repeatable collecting routine.