2.4 Detecting Physical Attacks

Preventing a break-in is great, but no security setup is perfect. That's where detection comes in. If an adversary does manage to slip into a restricted space, you need a way to know it happened, ideally while it's happening, so you can respond fast. Detection controls are the eyes and ears of physical security. They catch suspicious activity, create records you can review later, and often scare attackers off just by existing.

Security Controls That Detect Physical Attacks

Detection isn't one single tool. It's a mix of technology and people working together. Each control has strengths and weaknesses, and a smart security plan layers them so that if one fails, another picks up the slack.

more resources to help you study

practice questions

Cameras

Cameras capture a visual record of what's happening in a space. They're probably the most recognizable detection control out there, and they do two jobs at once: they let security watch live activity, and they save footage you can pull up later.

For cameras to actually be useful, the feed needs to be recorded and monitored. A camera that nobody is watching and that doesn't save footage is basically just a plastic decoration. Recorded footage matters a lot for after-incident investigations. If someone steals a laptop from a conference room, you can rewind, see who walked in, what they looked like, and what direction they went.

Security Guards

Security guards are humans who monitor an area and respond to suspicious activity. Unlike a camera, a guard can actually do something the moment they spot a problem. They can stop someone, ask questions, call for backup, or lock down a space.

Guards bring judgment that machines don't have. A camera can't tell the difference between a confused visitor and someone casing the building, but a guard usually can.

Motion Sensors

Motion sensors detect movement in an area and trigger an alert. They're especially useful in spaces where movement shouldn't be happening, like a server room at 2 a.m. on a Sunday. When the sensor goes off, security gets notified and can investigate.

Employees

This one gets overlooked, but employees are often the first line of detection. The people who work in a space every day know what "normal" looks like. They notice when a stranger is wandering near the server closet, when someone is wearing a badge that looks off, or when a door that's usually locked is propped open. Training employees to report suspicious activity turns every worker into a sensor.

Placing Detection Controls Effectively

Buying cameras and motion sensors isn't enough. Where you put them decides whether they actually catch attackers or just generate noise.

Camera Placement

When placing cameras, think about a few things:

• Visual coverage: Does the camera actually see the area you care about, or is half the view blocked by a pillar?
• Angle: Can you see faces, or just the tops of people's heads? A camera mounted too high might capture movement but not identity.
• Tamper resistance: Can an adversary reach the camera to cover it, unplug it, or spray paint the lens? Cameras in low spots are easy targets.
• Usefulness of the footage: What would a camera in this spot actually catch an adversary doing, and would that information help you respond?

Points of ingress and egress (entries and exits) are classic camera spots because everyone who enters or leaves a building has to pass through them. If something gets stolen, you want footage of every face that came and went.

Motion Sensor Placement

Motion sensors work best in areas where traffic is unexpected. Think:

• Server rooms
• Storage areas for sensitive documents
• Restricted labs
• After-hours office spaces

Putting motion sensors in high-traffic areas is a bad idea. If the sensor in the main lobby goes off 400 times a day, security will stop paying attention. Then when a real intruder triggers it, the alert gets ignored. This is called alarm fatigue, and it kills the usefulness of the whole system.

Lock Placement

Locks should be on every entry to an area with sensitive information or systems. For the really high-value spaces (data centers, executive offices, evidence rooms), an organization can use an access control vestibule. That's a small room with two doors where the first door must close and lock before the second one opens. It stops piggybacking and tailgating, which is when an unauthorized person sneaks in right behind someone with legitimate access.

Security Guard Placement

Guards come in two flavors, and where you put each type matters.

Stationary guards stay in one spot. They give constant protection to a specific area, entrance, or high-value item. They work best at places that funnel traffic:

• Entry gates
• Main lobbies
• Doors leading into more secure zones

Patrolling guards move around on routes. They're harder for an adversary to plan around because attackers can't predict exactly where the guard will be at any given moment. That unpredictability creates time pressure: an adversary knows a guard could show up at any second, so they have to work fast and risk mistakes. Patrolling guards are better suited for perimeters and exterior areas where you need broad coverage rather than constant watch over one spot.

Applying Detection Techniques

Knowing what the tools are is one thing. Using them together to actually catch attackers is the goal. Detection works best when controls back each other up.

Cameras Plus Facial Recognition

A camera on its own captures footage. A camera paired with facial recognition software can actively alert security the moment an unauthorized face enters a controlled area. Instead of waiting for someone to review the tape later, the system flags the problem in real time.

After a breach is detected, defenders use both live and recorded footage to track the adversary's path. Where did they enter? Which hallways did they walk down? Did they stop at any specific desks or rooms? This is how investigators figure out what was accessed or stolen.

Motion Detectors Plus Cameras

A motion detector tells you something moved. A camera tells you what moved. Pairing them is a huge upgrade because it solves the false alarm problem.

Here's how it works in practice. A motion sensor in the server room trips at 11 p.m. Security gets the alert. Instead of running down to the server room blind, they pull up the camera feed for that space. They can immediately see whether it's:

• A real intruder
• A custodian who got the wrong schedule
• A stray cat that got in through a vent

This verification step saves time and makes sure real threats get a real response.

Door Sensors and Entry Logs

When employees use an electronic badge to unlock a door, the system can record more than just who went through. A sensor can track how long the door was open.

Why does that matter? Because piggybacking and tailgating show up in the data. A door that normally opens for 3 seconds when one person walks through, but suddenly stays open for 12 seconds, is a red flag. Either someone held it for a buddy who didn't badge in, or someone slipped through behind them. By reviewing entry logs and looking for doors that stayed open longer than normal, security teams can spot breaches that would otherwise go unnoticed.

Putting It All Together

The pattern across all of these techniques is the same: detection controls are stronger together than alone. Cameras give you visibility, motion sensors give you alerts, badge logs give you data, guards give you judgment, and employees give you eyes everywhere. A good detection setup uses each one to cover the weak spots of the others, so an adversary who slips past one control gets caught by the next.