- › Planned attacks on a site, from theft to targeted violence, usually include a period of watching it first, and that phase happens in public where it can be seen.
- › The useful signals are repetition and interest in your security features, never a single person with a camera.
- › Most sites already have the observations, but they are spread across shifts, contractors, and front desk staff, and nobody puts them together.
- › A simple observation log, reviewed weekly by one person, turns scattered sightings into a pattern somebody can act on.
- › Know where a watcher would stand, brief the people who work outside, and vary the routines that surveillance is trying to learn.
The receptionist noticed the car first. It was parked across the street from the loading dock on a Tuesday morning, engine off, one person inside, and it was still there when she came back from lunch. The following week a dock worker saw what he thought was the same car at shift change, and a few days after that a contractor mentioned to the facilities manager that somebody had been taking pictures of the side entrance from the bus stop.
Three people saw something, each saw it once, and each decided on their own that it probably meant nothing. Any one of them was probably right about their single sighting. Together, they had watched somebody learn when the dock was busiest, when the doors were propped, and which entrance had no camera, and nobody in the building knew it.
Attacks Are Planned Where You Can See Them
People who study targeted attacks, whether workplace violence, organized theft, or an intrusion by someone with a grievance, describe a fairly consistent sequence. The attacker selects a target, gathers information about it, sometimes rehearses or tests, and then acts. The information gathering is the part that matters here, because for a physical site much of it has to happen in person.
Someone planning to get into your building needs to know when it is quiet, where people come and go, how the doors work, where the cameras point, and what happens when something unusual occurs. Some of that can be found online. The rest requires standing somewhere and watching, often more than once, and usually from public space where there is no law against being.
That is the phase where the attacker is most exposed and you have the most time. By the moment of the attack itself, the indicators we described in decoding pre-attack indicators play out in seconds. The surveillance phase plays out over days or weeks, and it leaves traces with ordinary people who work at your site.
What Watching Looks Like
The honest answer is that it mostly looks normal, which is why the individual sightings get dismissed. What separates hostile surveillance from ordinary life is pattern and focus, and the specific behaviors worth noticing fall into a few groups.
The first is repeated presence without an obvious purpose. The same person or vehicle appears at different times or on different days, in places with a view of your entrances, and does not seem to be waiting for anyone or going anywhere.
The second is attention to security features instead of the building itself. Photographs of doors, badge readers, cameras, gates, and the loading dock are different from photographs of the architecture. So is someone who watches the guard more than the street, or who times the gap between a door opening and closing.
The third is testing. A person tries a door that should be locked, follows an employee in to see whether anyone objects, makes a delivery to the wrong entrance to see how it is handled, or asks casual questions about shift times and when the building empties out. Some of this reaches your staff away from the site, over coffee or in a parking garage, and some of it happens online, where family members’ public posts, the household surface in our executive threat model, give away routines without anybody being asked.
None of these on its own means anything. People photograph buildings, sit in cars, and ask questions for entirely innocent reasons every day, and treating each one as a threat would exhaust your staff and alienate your neighbors. We made the case for proportion in when the indicator was nothing, and it applies fully here. The thing worth acting on is repetition combined with interest in how the site is protected.
Why Nobody Connects the Sightings
In most sites I assess, the observations that would reveal surveillance already exist. They are spread across a dozen people who each hold one piece: the front desk, the dock, the parking attendant, the cleaning crew who arrive at dawn, the contract guard who rotates between sites, and the employee who smokes by the side door.
Nobody has a place to put what they saw. There is no form, and the options people see are calling the police, which feels like an overreaction, or saying nothing, which feels safe. Contract staff in particular often assume that reporting something is somebody else’s job and that raising a false alarm could cost them the account.
The result is that each person sees a fragment, evaluates it alone, and dismisses it, which is exactly the right call for any single fragment and exactly the wrong outcome for the site. Surveillance detection is mostly the work of getting those fragments into one place.
Building Surveillance Detection Into the Site You Have
None of this needs a dedicated team. It needs a few decisions and some habits among the people who are already outside.
Find where you would watch from
Walk the outside of your property and ask where you would stand or park if you wanted to learn the building’s routines without being noticed. The answers are usually a handful of places: a parking lot with a view of the main entrance, a bus shelter, a coffee shop window, an adjacent business, a spot along the fence line. Those are the places your people should glance at, and the places your exterior cameras should cover if they can.
Give every observation one place to go
Set up a simple log for anything that seemed out of place: date, time, location, a description of the person or vehicle, and what they were doing. Make the bar for writing something down deliberately low, and make it clear that nobody gets questioned for a report that proves to be nothing. Then have one person review the log every week, looking specifically for repeats.
That weekly review is where the value is. A single entry about a parked car is noise, and three entries about the same car at shift change over two weeks is information that deserves a closer look at your exterior camera footage for those times.
Brief the people who work outside
The front desk, dock staff, facilities, parking, cleaning crews, and guards see more of the outside world than anybody else in the building. A thirty minute briefing on what matters, meaning repetition and attention to security features, and on where observations go, is enough to change what they notice. Our guidance on situational awareness training covers the broader skill, and this is the site-specific version of it.
Include contract staff in that briefing, and tell their supervisors you want the reports. The contractor who mentioned the bus stop in my opening example was the one who saw the most important piece.
Vary what can be learned
Surveillance is trying to learn your routines, so predictable routines are what it collects. Guard patrols at the same minute every hour, deliveries accepted the same way every day, and a side door that is always propped at shift change are all things a watcher can plan around. Changing patrol times and tightening the few routines that create openings takes away most of what a watcher came to learn.
Decide in advance what people should do
Staff should not confront or follow anyone, and they should not leave the property to investigate. A friendly “can I help you?” to someone on your property is entirely appropriate, and simply being noticed is often enough to end surveillance, since the person doing it depends on not being seen.
For anything beyond that, the instruction is to note the details, report through the log, and escalate to whoever owns security at the site. When the weekly review shows a real pattern, that person decides whether it goes to local law enforcement, and should know ahead of time who to call there. If there is a known grievance involved, such as a recent termination or a protective order, that context changes the threshold, and our guidance on preventing workplace violence applies.
The Watcher Has to Show Up
Someone who wants to hurt your people or take what is in your building usually has to come and look first. That is a real disadvantage for them, and most sites give it away by letting what their own staff saw evaporate one sighting at a time.
The receptionist, the dock worker, and the contractor in that opening example did everything we could reasonably ask of them except write it down somewhere that someone else would read. Fixing that costs almost nothing, and it is the difference between three people who each half-remember a parked car and a site that knows it is being watched.
Dusten Trounce is Director of Physical Security at Grab The Axe.
A leader defined by a 'bias for action,' Dusten specializes in physical security assessments that impact profitability. He leverages high-logic strategies to pinpoint high-ROI vulnerabilities, ensuring defense measures actually scale with the business.
View Author Page →
