A small office is empty for around two-thirds of its life, and that is when almost everything bad happens to it: the break-in, the burst pipe, the freezer that failed on Friday, the heating that ran all weekend. Most organisations respond to this by buying cameras, which is understandable and only solves part of the problem. Cameras tell you what happened. What you actually want is to be told while it is still happening.
This is about building a system that notices, escalates to a real person, and does not cry wolf so often that everybody mutes it.
Decide what you are protecting against
“Security” bundles together several quite different risks, and the sensible response differs for each.
Opportunist entry — someone trying a door or a ground-floor window. Deterrence and fast detection work well here, because the intruder is not committed.
Targeted theft of specific valuable equipment. Detection matters more than deterrence, and so does knowing exactly which room was entered.
Internal loss, which nobody enjoys planning for. Access logs and per-room detection help; cameras in staff areas usually create more problems than they solve.
Non-criminal disasters — water, fire, heating faults, freezer failures. Statistically these cause more damage to more small offices than burglary, and they are much cheaper to detect. If your budget is limited, this is where the first hundred euros should go.
Start with the things that are not crimes
A connected smoke alarm that reaches your phone at two in the morning is worth more than any camera. A water leak sensor under the kitchen sink, behind the dishwasher and in the plant room costs very little and guards against the most common expensive incident in commercial premises.
Add a temperature sensor anywhere a failure would matter: a server cupboard, a fridge holding anything perishable, a room with pipes that could freeze. And put a whole-building energy meter in, because an unexpected overnight load frequently means something has been left running that should not be.
None of this is glamorous. All of it pays for itself the first time it fires.
Detection that does not annoy everyone into ignoring it
The failure mode of every alerting system is the same: too many notifications, so people stop reading them, so the real one gets missed. Avoiding that is mostly a matter of requiring corroboration and being careful about what deserves to interrupt a human.
Two sensors, not one
A single motion sensor in an empty office will trigger on sunlight moving across a wall, warm air from a vent, a spider on the lens and a delivery van's headlights through a window. Requiring a second signal within a short window — a door contact, or a second sensor in an adjoining space — removes almost all of that without meaningfully reducing genuine detection.
Contacts before cameras
Door and window contacts are the most reliable sensors you can fit. They report a fact rather than an inference: this door opened. Fit them on every external door, every accessible window and the doors of any room worth protecting separately. They are cheap enough that there is no reason to be selective.
Glass-break and vibration
A contact tells you a window opened; it says nothing about a window broken but left closed, which is a common entry method. Acoustic glass-break sensors cover a whole room. Vibration sensors on the frame catch forcing. Both need sensitivity tuning, particularly on a busy road.
Cameras where they add something
Cameras answer “what is happening?” once something else has told you that something is. Put them at entrances and in circulation areas, aimed so a face is captured at a sensible height and distance. Prefer on-device detection so a person, a vehicle and a cat are distinguished before you are notified, and prefer local recording for reasons we cover in the camera guide.
Escalation: who is actually told, and how
An alert with no defined recipient is a log entry. Write the escalation path down before you configure anything.
- Tier one, informational: a door opened out of hours, or an unusual overnight load. Goes to a group chat or an email digest. Nobody is woken.
- Tier two, needs a human tonight: corroborated motion in a secure area, a water leak, a temperature excursion in the server room. Push notification to two named people, not one, because one person is asleep or abroad.
- Tier three, emergency: fire or smoke. This should be a monitored alarm with a professional response, not a phone notification. A notification-based system is not an appropriate response to a fire in a commercial building.
Two people minimum on every tier that matters. The single most common failure in small-office security is a well-configured system that notifies one person who has their phone on silent.
Deterrence, used honestly
Deterrence works on opportunists, which is most of what a small office faces. The measures that genuinely help are unexciting: good lighting at entrances, triggered rather than permanently on so the change is noticeable; visible cameras at the door; a building that plainly looks occupied.
Randomised evening lighting is more effective than a fixed timer, because a light that comes on at exactly 18:30 every night reads as automated from the street. Vary the rooms and the timing, follow actual sunset rather than a clock, and include an upstairs or rear light late in the evening.
What we would not rely on is a dummy camera. Anyone with the confidence to try a commercial door can usually tell, and it provides no evidence if you are wrong.
Arming: the part that decides whether any of this gets used
An alarm nobody arms is decoration, and the most common reason for not arming is that it is inconvenient or people are unsure whether someone is still inside.
Automatic arming solves this, provided it is careful. Arm on a confirmed empty building: all credentials checked out, no presence detected for a set period, external doors closed. Always give an audible warning countdown, and always allow a simple cancel — a returning employee should be able to stop the process from inside without calling anyone.
Disarm on a valid credential at the door, and log who did it. That single link between the person and the disarm event is what makes an access log useful after an incident.
Cameras and the law
In the EU and UK, operating cameras at a workplace brings obligations. In outline: inform staff and visitors clearly with signage; aim cameras at your own premises and use privacy masking for anything beyond your boundary; do not record audio of public space, which is treated more strictly than video; do not put cameras in break rooms, toilets or changing areas; set a retention period and hold to it; and restrict who can view footage.
Monitoring employees specifically, as opposed to protecting premises, is a separate and much more demanding legal question. If that is the intention, take proper advice rather than reading an article. We are not lawyers, and this is a genuinely regulated area.
A build order that stays sensible
- Non-crime risks first: smoke alarms, water sensors in the three or four places water appears, a temperature sensor in the server cupboard, and a building energy meter.
- Contacts on every external door and accessible window. Cheap, reliable, and the foundation everything else builds on.
- Two presence sensors in the main areas, configured to require corroboration before anything escalates.
- Two cameras — the main entrance and the main circulation space — with local recording and on-device detection.
- Write the escalation path down, with two named people per tier, and test it by triggering each tier deliberately.
- Then automatic arming, once you trust the occupancy detection enough not to arm the building around somebody.
Test it quarterly by setting off each tier on purpose. An untested alerting system is an assumption, and the first genuine incident is a poor moment to discover that a notification has been going to a former employee's phone since April.