Rushing towards an intruder can turn an access breach into an immediate danger. Guards should protect people, maintain a safe distance, alert the control room and contact police when appropriate.
An effective intruder response depends on clear decisions, not the speed of a confrontation. Follow training, site post orders and applicable law, without pursuing or physically engaging someone unless necessary to protect a person from an imminent threat and permitted by law and training.
Start by separating what is known, what remains uncertain and who may be exposed.
Key takeaways for guards and supervisors
- Put people before property, moving staff and visitors away from the affected area without directing them towards another hazard.
- Maintain a safe position and assess available information, without approaching an intruder merely to obtain a clearer view.
- Notify the control room promptly, giving the exact location, observed behaviour, people at risk and assistance required.
- Call 999 for an immediate threat to life, violence or a serious crime in progress; emergency action should not await management approval.
- Preserve observations, recordings and access records, without disturbing the scene or circulating footage through personal accounts.
- Complete a factual incident report, hand over outstanding risks and assign responsibility for repairs, welfare support and procedural changes.
The supervisor should make these expectations practical before the shift starts. Officers need working communications, current contact details, clear withdrawal instructions and a response plan that reflects staffing levels.
A written procedure is only useful when the people on duty can carry it out.
Make the first minute about safety
The first actions should reduce exposure while establishing enough information to direct help. They should not depend on identifying the intruder or proving a criminal offence.
Move to a safer position
Stop any approach that would bring the officer into an uncertain confrontation. Maintain distance, retain a clear withdrawal route and use existing secure separation where available.
Look for people who may be closer to the intruder, including cleaners, contractors, delivery drivers and staff working away from occupied areas. Direct them away where this can be done safely.
Avoid blocking the person’s route, entering a confined space or following them around a blind corner. A better view does not justify losing a safe position.
If violence, a weapon or an immediate threat is apparent, withdraw and initiate the emergency response. Do not delay while trying to establish the person’s intentions.
Apply the site instructions without delaying help
Post orders should identify reporting channels, safe positions, emergency contacts and actions that a lone officer must not attempt. Follow those instructions within the limits of training and applicable law.
The SIA licence-linked training specifications provide a training framework. They do not replace induction into the actual building, its occupants or its emergency arrangements.
Report a material gap immediately, such as a failed radio, unavailable control room or inaccessible emergency gate. Use the approved fallback rather than continuing as though the planned support exists.
Where instructions are unclear during an immediate danger, prioritise withdrawal, warning people at risk and summoning emergency assistance. Administrative uncertainty should not hold up a life-safety call.
Establish the facts without unsafe investigation
An access alarm establishes that a system has detected a condition. It does not, by itself, establish who caused it or what they intend.
The control-room operator should assess the alert source, relevant cameras, access-control events and current building activity. The officer should report direct observations separately from information supplied by others.
Distinguish unauthorised access from an unresolved identity
A person without a visible pass may be an authorised worker, an unexpected visitor or an intruder. Clothing, appearance and unfamiliarity are not reliable grounds for deciding which.
Use approved records and trusted site contacts to establish whether access was expected. Review contractor bookings, delivery arrangements and visitor records without leaving people exposed while an administrative explanation is sought.
A valid access-card event does not establish that its holder used the card. Equally, missing access data may reflect a system fault rather than forced entry.
Record the uncertainty. If identity cannot be established safely, maintain the restriction and escalate through the agreed procedure.
Report behaviour rather than assumed intent
Describe the activity that can be observed: entering through a damaged door, trying handles, moving through a restricted area or carrying property. Avoid presenting an interpretation as an established fact.
State whether the information comes from a live camera, recorded footage, a witness or direct sight. Each source has limits that matter to the response.
If the person disappears from view, report the last confirmed location and direction of travel. Do not describe an unobserved route as though it has been followed.
Further verification should stop when it would create additional danger. An immediate threat requires action before every detail is available.
Notify the control room and assign the response
The control room needs a usable report, not a general statement that something looks wrong. Give the building, exact area, observed activity, people at risk and assistance required.
Send a short, structured first message
Identify the officer and current position, then describe the event in plain language. Include the number of people observed and any immediate hazard.
State what has already been done, such as moving staff away or withdrawing behind a secure door. Finish with the action needed and the means of contacting the officer.
The operator should repeat back the location and urgent instructions. A misunderstood entrance or floor can send assistance into the wrong area.
Keep subsequent updates focused on changes. Report movement, loss of visual contact, additional people, injuries or a failed protective measure without repeating the full account each time.
Give each task a named owner
The incident lead should assign emergency calls, camera monitoring, occupant warnings, access control and the incident log. Confirm that each instruction has been received.
Avoid sending every available guard towards the reported location. Reception, emergency access and other occupied areas may still require protection.
Where there is no dedicated control room, post orders should identify the duty supervisor or monitoring contact who coordinates support. The reporting arrangement must still work outside normal office hours.
A mobile officer’s attendance is additional support, not permission for the on-site guard to advance. Keep the response within the agreed staffing and safety limits.
Record who is leading the incident and when responsibility changes. Separate instructions from different managers can otherwise leave officers acting on conflicting information.
Call police according to the danger and circumstances
Police contact should reflect the threat, whether the incident is continuing and whether anyone requires immediate protection. Do not wait for a complete description before reporting an emergency.
Calling a supervisor does not replace calling police when emergency assistance is needed.
Use 999 for an immediate emergency
Call 999 where there is an immediate threat to life, violence or a serious crime in progress. Report any suspected weapon without approaching to identify it more closely.
Give the full site address, exact location, safest known access point and callback number. Explain what is happening, how many people are involved and whether anyone is injured or unable to leave.
Separate confirmed facts from uncertainty. State that a weapon is suspected if its identity is unclear, rather than presenting it as confirmed.
Police Scotland’s break-in guidance advises moving to safety and calling 999 if an intruder may still be present. Remain available for further questions and follow the call handler’s instructions.
Use non-emergency reporting when immediate danger has passed
Where an incident has ended and there is no immediate danger, use the appropriate non-emergency reporting route. Police.uk’s contact guidance identifies 101 for non-emergency enquiries.
Do not assume that departure resolves every risk. An injured person, suspected accomplice or unresolved threat may still require emergency action.
Record when police were contacted, the information supplied, instructions received and any reference number. Update police if circumstances materially change.
Police attendance is outside the guard’s control. Continue the safe site response rather than leaving staff, access arrangements or evidence unmanaged while waiting.
Protect staff and visitors without creating another hazard
Moving everyone towards the usual exit may expose them to the intruder. Protective movement should follow the emergency plan and the current location of the threat.
The incident lead should decide whether occupants need to leave, remain in a safer area or avoid particular routes.
Direct people along routes that remain safe
Give short instructions that identify the action and route. Tell occupants which corridor, entrance or area to avoid without broadcasting an unconfirmed account of the incident.
Do not send staff through the affected area to collect bags, close windows or look for colleagues. Report unresolved locations to the incident lead and emergency services.
A normal assembly point may be unsuitable if it is close to the intruder’s last known position. Use the alternative arrangements established in the emergency plan.
The principles in security guard evacuation duties remain relevant, including clear directions, accountability and preventing unsafe re-entry. The route must reflect the actual hazard.
Include people who need assistance
Consider visitors unfamiliar with the building and occupants with mobility, hearing, visual or communication needs. Give practical assistance within the agreed plan and available training.
Ask what support the person needs rather than assuming they can use the same route as everyone else. Keep an accessible method of communication available.
Reception and contractor records can support accountability, but presence on a register does not establish a person’s current location. Pass unresolved names and likely locations to the incident lead.
Do not improvise a physical rescue beyond training and equipment. Report the location, known need and safest available access for trained responders.
Keep groups away from entrances needed by emergency services. People waiting for information should not obstruct the response or remain within view of the threat.
Secure access without trapping people
Access control should separate people from danger while preserving safe escape. Closing every door or barrier without considering occupancy can obstruct evacuation or emergency attendance.
Use authorised controls to restrict entry into the affected area where this can be done safely. Do not approach a door occupied by the intruder merely to secure it.
Keep emergency exits usable. Do not lock people into rooms, disable escape arrangements or alter fire-door operation as an improvised security measure.
The control-room operator should understand how remote door commands affect the building. Record which doors were controlled, who authorised the action and whether anyone remained in the restricted area.
Protect reception, key storage, access-control workstations and other points that could enable further movement. Unauthorised access to a control position can create a wider incident.
If a pass or key is believed compromised, notify the authorised manager and apply the approved restriction. Record the affected credential and time without circulating codes over open radio channels.
Keep a safe route available for emergency vehicles and responders. Gate access, barriers and internal directions need an assigned owner.
Restrict unnecessary arrivals while the incident remains active. A delivery driver or arriving contractor should not enter simply because their visit was booked.
Report controls that cannot be applied, including a failed lock or barrier. Temporary protection must reflect the fault, rather than relying on a door that only appears secure.
Keep unavoidable contact calm and brief
Guards should not approach an intruder to force an explanation. If contact occurs, the immediate purpose is to reduce danger and create space for withdrawal.
A conversation should not become an improvised interview or an attempt to recover property.
Use plain language from a safe position
Speak clearly and keep instructions short. Avoid insults, threats, arguments about authority or statements that cannot be carried out safely.
Where appropriate, identify the area as restricted and direct the person towards an available safe exit. Do not place the officer between the person and that route.
Keep the exchange focused on immediate actions. Questions about identity or purpose should not prolong contact where the person is becoming agitated.
Allow space for a response without moving closer. A person may be confused, distressed, unable to hear clearly or unfamiliar with English.
Behaviour and changing risk should guide the decision to withdraw. Apparent cooperation does not remove the need for distance and an escape route.
End contact when the situation becomes unsafe
Withdraw if the person threatens anyone, advances aggressively, produces a suspected weapon or attempts to draw the officer into an isolated area. Alert others and request emergency assistance.
Do not continue talking merely to demonstrate control. Repeated challenges can prolong exposure without improving safety.
If the person leaves, report their direction and any safely observed description. Do not follow to preserve the conversation or obtain identifying information.
Tell the control room when direct contact ends and whether the person’s location remains known. Silence after a confrontation should not leave colleagues guessing about the officer’s welfare.
Apply additional limits to lone working
A lone officer cannot simultaneously monitor an intruder, protect reception, guide occupants and manage emergency access. The response plan must account for that limitation before an incident occurs.
Keep welfare information current
The control room should know the officer’s location, assigned task, communication method and expected contact arrangements. Update those details when the officer withdraws or changes position.
HSE’s lone-working guidance requires employers to include lone workers in the general risk assessment. The assessment should translate into practical limits and support arrangements.
A working radio is not enough if nobody is assigned to receive calls. The plan needs a monitored contact and a defined response to missed communication.
If contact is lost, follow the agreed welfare escalation. Do not send an unprepared colleague into the same uncertain area to find out what happened.
Do not send a lone officer to search
A request for better information should not become an instruction to enter a dark warehouse, isolated stairwell or enclosed service area. Use cameras and other safe sources first.
The guard should report areas that remain unobserved rather than describing the site as clear. An incomplete picture is an operational limitation that the incident lead needs to understand.
The limits described in construction site guard duties include the risks of asking a lone guard to confront a group. The same judgement applies across other large or difficult sites.
Arrange support according to the incident plan. Additional attendance should have a defined task, safe meeting point and current briefing, rather than becoming an uncoordinated search.
Keep force and pursuit outside the routine response
An SIA licence does not grant police powers. The NPSA summary of SIA licences distinguishes licensed activities and training; neither provides unlimited authority over people on site.
Guards should avoid confrontation, pursuit and physical engagement unless necessary to protect someone from an imminent threat and permitted by applicable law and training.
A person leaving with property does not justify turning an observation role into an unsafe pursuit.
Do not chase an intruder through the site, onto a road or into a vehicle route. Pursuit can expose the officer, occupants and bystanders to further danger.
Do not try to block a moving vehicle, seize carried property or close distance to obtain a registration number. Record only what can be observed safely.
Physical intervention can cause injury and requires a lawful basis. General guarding experience, a manager’s instruction or possession of equipment does not establish that basis.
Legal rules concerning force, detention and searches differ across jurisdictions. Site instructions must reflect applicable law and the officer’s actual training.
Where intervention occurs to protect someone from imminent harm, summon police and medical assistance as needed. Record the threat, decisions, actions and any injury accurately.
Supervisors should preserve the officer’s own account without replacing it with softer wording. A report must describe what happened, including actions taken by security staff.
Adapt the response to the site and other hazards
The same report of unauthorised entry can create different risks in an occupied office, a warehouse, a retail unit or a construction site. Site knowledge should shape protective action.
Consider the hazards around the intruder
In warehouses and logistics yards, moving vehicles, loading bays and machinery may endanger people who divert around the affected area. Tell the authorised operational lead when movement needs to stop.
On construction sites, unfinished edges, excavations and changing access routes can make an apparently open escape route unsafe. Use the current layout, not an outdated plan.
Clear construction site alarm response procedures should connect monitoring, gate access, key control and escalation. A responder still needs to reach the correct location safely.
In shared buildings, notify the designated management contact so neighbouring occupiers receive consistent restrictions. A breach should not leave each tenant issuing conflicting instructions.
Recognise when another emergency changes priorities
Fire, smoke, injury or a suspected dangerous item requires the relevant emergency procedure. Do not treat every incident as an access-control problem.
Where a fire alarm activates, follow the building’s fire emergency plan. Security measures must not obstruct escape or prevent firefighters reaching the building.
If someone needs medical help, request assistance and provide first aid only within training and when the scene is safe. An injury does not make an unsafe area safe to enter.
Report suspected dangerous items without touching or moving them. Prevent others approaching where this can be done safely, and follow emergency-service instructions.
The incident lead should record how conflicting hazards were managed, including routes closed and changes to normal operations.
Preserve the scene, footage and access records
Evidence preservation begins while the response is active. Damaged doors may be repaired, footage may overwrite and witnesses may leave unless responsibility is assigned.
Leave physical material undisturbed where safe
Restrict unnecessary access to damaged entrances, discarded objects and areas where the intruder was observed. Do not handle items merely to identify them or improve a photograph.
Life safety takes priority over an undisturbed scene. If something must be moved to prevent injury or enable emergency access, record what changed, why and by whom.
Do not test the damaged lock, reopen drawers or walk through the entry route to reconstruct events. Those actions can alter material that investigators may need.
Identify witnesses and ask them to preserve their own recollections promptly. Keep accounts separate rather than encouraging a group discussion about what probably happened.
Record observations made before the area was protected. Scene control cannot establish that nobody touched an object earlier.
Retain original recordings and a clear evidence log
Authorised staff should preserve relevant CCTV, body-worn video, alarm events, access logs and radio recordings before routine deletion or overwrite. Include relevant periods before and after the observed entry.
Record camera references, footage times, export details and storage locations. Note clock differences between systems rather than silently adjusting the timeline.
Keep original files intact. Do not annotate original footage, trim away context or send clips through personal messaging accounts.
An evidence log should identify the material, its source, who obtained it, where it is stored and each transfer of control. This establishes how it was handled.
Limit access to people with an operational or investigative need. A staff update should describe the protective action without circulating identifiable footage or speculative allegations.
Write an incident report that supports decisions
A report should allow someone who was not present to understand the event, response and unresolved risks. A brief entry stating that police attended does not provide that account.
Build a chronological record
Start with how the incident came to attention, including the time, source and exact location. Continue through observations, protective actions, calls, instructions and changes in the situation.
Identify which details were directly observed and which came from another person or system. Use clear attribution so a witness account is not mistaken for the officer’s own observation.
Record the times of police contact, assistance requested, arrival where known and transfer of responsibility. Include reference numbers and evidence locations without copying confidential access details into unnecessary records.
The structure in security guard incident reporting guidance supports this distinction between discovery, action and outcome.
If a time is approximate, identify it as approximate. Do not fill gaps with invented precision or alter an earlier entry without a visible correction process.
Explain decisions and outstanding work
Record why an area was closed, why the officer withdrew and what information supported the decision. State who authorised changes to access or normal operations.
Include injuries, damage, missing property reported by an authorised person and any equipment failure that affected the response. Distinguish confirmed loss from an initial concern.
List unresolved actions in the report or linked task record, with named owners. These may include preserving footage, repairing a door, supporting a witness or changing access permissions.
A supervisor should review serious reports promptly, ideally before shift end where practicable. The review should address missing facts and follow-up, not rewrite an officer’s recollection into a preferred account.
Keep the incident record consistent with handover notes. Different versions of the current position can cause a second operational failure.
Hand over clearly and control the return to normal
The arrival of police changes responsibilities, but does not remove the need for site coordination. Guards should provide concise information and remain available for instructions.
Brief responders and the incoming shift
Tell responders the last confirmed location, observed behaviour, known hazards, people at risk and actions already taken. Identify safe access, restricted areas and relevant witnesses.
Provide access to plans, keys and recordings through the authorised process. Do not present assumptions about the person’s route as confirmed movement.
A shift handover should also cover temporary controls, faults, pending calls and evidence awaiting collection. The incoming officer needs the current position, not merely a copy of the first report.
The outgoing and incoming officers should resolve questions before responsibility passes. Record who accepted the handover and any matters still awaiting a decision.
Reopen through the authorised decision-maker
A quiet building or the intruder’s departure does not establish that normal operations can resume. There may be damaged locks, missing credentials, unsafe areas or police restrictions.
Follow responder directions and the site’s authorised recovery process. Record who approved reopening, which areas were released and what temporary controls remain.
Facilities staff should assess damaged infrastructure before it is relied upon again. A door pushed back into position may still fail to secure the area.
Provide factual updates to staff and occupiers. Explain current restrictions and next steps without naming suspects unnecessarily or promising that the incident cannot recur.
Include welfare support for officers, staff and witnesses directly affected by threats or violence.
Use the review to correct identifiable failures
The supervisor’s review should examine decisions, information and controls. Asking whether the guard responded quickly provides only a small part of that assessment.
Assign actions to the gaps that mattered
Establish whether the alert reached the right person, communications worked, safe routes remained available and emergency access was usable. Identify where information arrived late or was misunderstood.
Review how the intruder entered and whether existing faults or temporary works contributed. Separate a failed control from a procedure that was never assigned to anyone.
Give each corrective action an owner, deadline and completion check. Repairing a lock, changing a visitor process and improving radio coverage require different responsible roles.
Measures in security reporting and escalation standards can help make follow-up accountable. A fast first call does not compensate for missing evidence or an unresolved access defect.
The review should retain decisions that worked as well as failures. Useful practice needs to be carried into revised instructions and training.
Exercise the decisions officers actually face
Use tabletop exercises to test unclear alarms, unavailable contacts, camera loss, lone-worker communication failure and competing emergency instructions. Include reception, facilities and relevant building management.
Ask who makes each decision, what information they receive and how an absent decision-maker is replaced. Record answers that depend on an assumption rather than an agreed arrangement.
Training should match assigned duties. The SIA’s door-supervisor training requirements include role-specific content; employers should not assume every guarding qualification provides identical preparation.
Rebrief officers when layouts, tenants, occupancy or access arrangements change. Instructions suitable for an empty building may be inadequate once staff and visitors are present.
Close the review only when actions have been completed or remaining risks have been formally assigned. Filing the incident report does not repair the weakness.
Frequently asked questions
What should a guard do first after seeing an intruder?
Protect people and take a safe position, then notify the control room with the exact location and observed activity. Call 999 without delay where there is an immediate threat to life, violence or a serious crime in progress.
Do not approach merely to establish identity or obtain a clearer description. Further assessment should use safe observations and available systems.
Should guards wait for CCTV confirmation before calling police?
An immediate emergency should not wait for camera confirmation. Report what is known, explain any uncertainty and update the call handler when reliable information becomes available.
For an uncertain alert without signs of immediate danger, the operator can assess cameras, access events and building activity through the approved procedure. Verification must not expose an officer to additional risk.
Should a guard follow an intruder who leaves?
Guards should not pursue a departing intruder. Report the last confirmed location, direction of travel and any description obtained safely.
Do not move closer to obtain photographs, a vehicle registration or further identifying details. Preserve available footage and tell police whether the person’s location is still known.
The guard’s remaining responsibilities include protecting occupants, controlling access and maintaining the incident record.
Does a false alarm still need recording?
Record the activation, checks made, explanation established and any action taken under the site’s reporting procedure. A routine resolved alert may belong in the daily log, while a fault, significant disruption or escalated response may require a formal report.
Repeated false alarms need an assigned follow-up. Labelling each activation harmless without addressing its cause can reduce confidence in the system and obscure later events.
A safe response leaves a clear record
A guard’s response should protect people, summon appropriate help and keep actions within training, post orders and applicable law. Confrontation should not become the default because an officer is already on site.
Clear responsibility matters throughout the incident: who called, who protected access, who retained evidence and who authorised reopening.
The response remains incomplete until the next shift understands the outstanding risks and each necessary repair or procedural change has an owner.
0 Comments