A physical security breach can happen quickly. An unauthorized person enters a restricted area, a gate is forced open, an alarm activates after hours, a vehicle enters without authorization, or someone attempts to bypass an access-control system.
When situations like these occur, security guards responding to security breaches need clear procedures. Their priority is not to create a confrontation. It is to assess what is happening, protect people, communicate the situation, follow site-specific instructions, document important information, and coordinate with supervisors or emergency responders when necessary.
This guide focuses specifically on physical security breaches. Cyberattacks, network intrusions, and data breaches require separate cybersecurity and information-technology response procedures.
What Is a Physical Security Breach?
A physical security breach occurs when someone gains unauthorized access to a property, restricted area, building, room, equipment area, or other protected space, or when a physical security control fails in a way that exposes the property to unauthorized access.
Examples can include:
- Unauthorized entry through a gate or door
- Trespassing
- Forced entry
- Tailgating through a controlled entrance
- A lost or stolen access card
- A damaged lock, fence, gate, or door
- Unauthorized vehicles entering the property
- Attempts to access restricted areas
- Suspicious activity near entrances or loading areas
- An alarm indicating possible intrusion
CISA recommends controlling who enters a workplace, verifying the purpose of visits, monitoring entry and exit areas, and promptly reporting damaged doors, windows, locks, and suspicious activity. You can review additional guidance through CISA’s physical security resources.
Step 1: Assess the Situation
The first responsibility is to understand what is happening without unnecessarily increasing the risk.
The officer should quickly consider questions such as:
- What type of breach appears to have occurred?
- Is anyone in immediate danger?
- Is the individual still on the property?
- Are weapons or other immediate hazards visible?
- Which area of the property is affected?
- Has an entrance, gate, fence, or access system been compromised?
- Does the situation require police, fire, or medical assistance?
Officers should follow site-specific post orders, employer procedures, and their training rather than improvising a response outside their assigned responsibilities.
Step 2: Prioritize Life Safety
Protecting people comes before protecting property.
If the incident presents an immediate threat to employees, visitors, residents, customers, contractors, or officers, security personnel should follow the property’s emergency procedures and contact the appropriate emergency services.
Depending on the situation, this may involve:
- Moving people away from the affected area
- Restricting access to a dangerous location
- Directing people toward established safe areas
- Contacting 911 when immediate police, fire, or medical response is necessary
- Providing responding personnel with accurate location information
A professional response should focus on reducing exposure to danger, not unnecessarily escalating the incident.
Step 3: Notify Dispatch, Supervisors, and the Client
Security officers should not operate as isolated individuals during a serious incident.
After identifying a potential breach, the officer should follow the site’s communication and escalation procedures.
This may include notifying:
- Security dispatch
- Field supervisors
- Property management
- Facility leadership
- Designated emergency contacts
- Law enforcement
- Fire or emergency medical services
The initial communication should be concise and factual. Useful information may include the location, type of incident, number of people involved, descriptions, vehicles, direction of travel, known hazards, and whether emergency services have already been contacted.
Step 4: Control Access to the Affected Area When Safe
If conditions allow, security personnel may help prevent additional people from entering an affected area.
Depending on the property and post orders, this could involve:
- Closing or monitoring designated doors
- Controlling vehicle entrances
- Redirecting visitors
- Restricting access to damaged areas
- Establishing a safe perimeter
- Keeping uninvolved personnel away from the scene
Access control should always be performed within the officer’s training and site procedures. Officers should not take unnecessary risks simply to protect property.
Step 5: Observe and Communicate Important Details
Accurate observations can be extremely valuable during and after an incident.
Security officers should pay attention to details such as:
- Number of individuals involved
- Physical descriptions
- Clothing
- Direction of movement
- Vehicle description
- License plate when safely observable
- Location of entry or exit
- Tools or objects being carried
- Damage to doors, gates, fences, or locks
- Time of significant events
The officer should report what was actually observed rather than assuming motive or intent.
Step 6: Avoid Unnecessary Confrontation
Professional security response is not about chasing every person who runs from a property or turning every incident into a physical confrontation.
An officer’s actions should be governed by training, post orders, applicable law, employer policies, and the conditions of the incident.
When there is no immediate threat to life, observation, communication, access control, documentation, and coordination with responding authorities may be more appropriate than direct confrontation.
This is particularly important when the number of individuals, presence of weapons, or other risks are unknown.
Step 7: Help Protect the Incident Scene
After the immediate threat has ended, the affected area may contain information that is important to law enforcement, the client, an insurance investigation, or an internal security review.
Security personnel may be asked to help keep unauthorized people away from the area until management or responding authorities determine that normal access can resume.
Officers should avoid unnecessarily moving objects, handling property, or disturbing the area unless doing so is necessary to address an immediate safety hazard or they are instructed to do so by authorized personnel.
Step 8: Cooperate With Responding Authorities
When law enforcement, firefighters, emergency medical personnel, or other responders arrive, security officers can provide useful information about the property and incident.
This may include:
- What the officer observed
- When the incident began
- Where the individual was last seen
- Descriptions of people or vehicles
- Which entrances were affected
- Known hazards
- Available surveillance coverage
- Contact information for property management
Security personnel may also help direct emergency responders to the correct entrance or location when appropriate.
Step 9: Document the Security Breach
Once the immediate situation is under control, accurate documentation becomes essential.
An incident report should clearly explain:
- Date and time
- Exact location
- How the incident was discovered
- What the officer personally observed
- Description of people or vehicles involved
- Actions taken by the officer
- People who were notified
- Emergency services that responded
- Property damage observed
- Photos or supporting documentation when appropriate
- Any known follow-up requirements
The report should separate confirmed facts from assumptions and use clear, professional language.
For more information, read our guide on security guard reporting and communication.
Step 10: Review What Allowed the Breach to Occur
The response should not end when the incident is over.
Management should review how the breach occurred and determine whether a vulnerability needs to be corrected.
Questions may include:
- Was a door or gate left unsecured?
- Did someone bypass an access-control procedure?
- Was a badge or key used improperly?
- Was the area covered by surveillance?
- Did lighting make the area difficult to observe?
- Was the patrol frequency appropriate?
- Did officers have clear post orders?
- Were notifications made quickly enough?
- Did employees understand security procedures?
The answers can help determine whether patrol routes, access procedures, staffing, cameras, lighting, locks, fencing, training, or post orders should be adjusted.
Access Control Is One of the Best Ways to Reduce Security Breaches
Many physical security incidents begin with a failure to control access.
Depending on the property, access control may involve:
- Employee badges
- Visitor identification
- Guest sign-in procedures
- Vehicle access lists
- Key or access-card management
- Guarded entrances
- Controlled gates
- Restricted-area credentials
- Delivery procedures
CISA’s physical-security guidance recommends monitoring and controlling workplace entry and identifying the purpose of visitors before authorizing access. :chatgpt-content-reference{index=”2″}
Patrols Can Identify Vulnerabilities Before a Breach Occurs
Security patrols are not only intended to catch someone already committing an offense.
Patrol officers can identify conditions that may make a future breach easier, including:
- Broken locks
- Open gates
- Damaged fencing
- Poor exterior lighting
- Propped-open doors
- Unauthorized vehicles
- Suspicious activity near loading areas
- Alarm problems
- Obstructions around cameras
Properties that do not require a permanent standing officer may use mobile patrol security for scheduled or randomized inspections of entrances, gates, parking areas, perimeters, and other priority locations.
Video Monitoring Can Help Detect Unauthorized Activity
Cameras can extend visibility across areas that an officer cannot observe continuously.
Depending on the property, video surveillance may cover:
- Building entrances
- Parking areas
- Loading docks
- Perimeters
- Gates
- Restricted areas
When video monitoring is connected to a defined response process, suspicious activity can be communicated to on-site personnel, supervisors, or other authorized responders.
Learn more about Secure Guard’s video monitoring services.
SecureTrack Supports Security Incident Response
A security breach can involve several different people: the officer who discovers it, dispatch, supervisors, operations personnel, client contacts, and possibly emergency responders.
Secure Guard uses SecureTrack to help organize field activity and reporting.
Depending on the assignment, SecureTrack can support:
- Digital incident reports
- Daily activity reports
- Photos and supporting documentation
- GPS-supported patrol records
- Checkpoint activity
- Real-time alerts
- Officer attendance records
- Post-order access
- Supervisor visibility
This helps turn an individual security event into documented information that can be reviewed and followed up on by the operations team.
Post Orders Should Explain How Officers Respond
Security officers should not be forced to invent procedures while an incident is unfolding.
Site-specific post orders can establish:
- Emergency contacts
- Client notification procedures
- Police and emergency escalation procedures
- Access-control responsibilities
- Restricted areas
- Alarm procedures
- Patrol requirements
- Incident-reporting requirements
- Supervisor notification procedures
These instructions should reflect the property’s actual layout, operating environment, risks, and management expectations.
Security Guards and Cybersecurity Breaches Are Different
Physical security and cybersecurity can overlap, but they require different response teams.
For example, a security officer may discover an unauthorized person attempting to enter a server room. The officer’s responsibility may involve physical access control, observation, notification, and documentation.
If the incident involves malware, compromised accounts, stolen data, phishing, ransomware, or network activity, the organization’s cybersecurity or IT incident-response team should handle the technical investigation.
Clear procedures should explain how physical security personnel notify the appropriate technical teams when an incident crosses from the physical environment into information security.
California Security Guards Must Follow Licensing and Training Requirements
Security guards working in California are regulated by the Bureau of Security and Investigative Services.
BSIS requires security guards to meet registration, background-check, and training requirements. Security companies should also provide site-specific procedures that explain an officer’s responsibilities at each assignment.
Current requirements can be reviewed through the BSIS Security Guard Registration Fact Sheet.
How Secure Guard Prepares for Security Incidents
Secure Guard Security Services combines professional officers with site-specific post orders, patrol procedures, 24/7 dispatch support, field supervision, and connected reporting technology.
Depending on the property, a security program may include:
- Armed or unarmed security officers
- Access-control officers
- Mobile patrol
- Video monitoring
- Incident reporting
- SecureTrack patrol verification
- 24/7 dispatch
- Field supervision
- Client escalation procedures
The goal is not simply to respond after something goes wrong. A well-managed security program should also identify vulnerabilities and reduce the likelihood of future incidents.
Review Your Security Plan Before a Breach Happens
The best time to determine how officers should respond to unauthorized access is before an actual incident occurs.
Property managers and facility leaders should review entrances, gates, parking areas, restricted spaces, alarm procedures, emergency contacts, camera coverage, post orders, and escalation procedures as part of their overall security planning.
CISA provides tools and resources to help organizations evaluate physical-security risks and strengthen resilience. :chatgpt-content-reference{index=”3″}
Request a security assessment to discuss your property’s access points, vulnerabilities, patrol requirements, incident procedures, and security coverage.
Frequently Asked Questions About Security Breach Response
What should a security guard do first during a security breach?
The officer should assess the situation, determine whether anyone faces immediate danger, follow site-specific emergency procedures, and communicate the incident to the appropriate supervisors, dispatch personnel, or emergency services.
Should a security guard confront an intruder?
Response depends on the circumstances, applicable law, training, employer policy, and site-specific post orders. Officers should avoid unnecessary confrontation and prioritize life safety, observation, communication, and appropriate escalation.
What information should a security guard report after a breach?
The report should document when and where the incident occurred, what the officer observed, descriptions of people or vehicles involved, actions taken, notifications made, responding agencies, property damage, and relevant follow-up information.
Can security guards preserve an incident scene?
Security personnel may help restrict unauthorized access to an affected area and prevent unnecessary disturbance of the scene while waiting for management or responding authorities, when doing so is safe and consistent with their procedures.
Can security guards respond to cybersecurity breaches?
Security guards primarily handle physical security responsibilities. They may report physical activity associated with a cyber incident, such as unauthorized access to a server room, but cybersecurity teams should handle technical network, account, malware, and data investigations.
How can businesses reduce physical security breaches?
Businesses can use layered measures such as access control, trained officers, documented patrols, cameras, lighting, alarms, restricted areas, visitor procedures, clear post orders, and regular security assessments.
