/ use case 007 · security

Not just a person on camera.
A person doing something.

Traditional CCTV analytics tell you when a person crossed a line. They don't tell you whether the person should be there. We do — by reading the clip the same way a security guard would, and only escalating when something genuinely doesn't add up.

deployed in · warehouses · forecourts · workshops · car parks · industrial yards
/ the problem

Person detection is easy. Telling you whether to care is the hard part.

Most security analytics products will reliably tell you that a person was on camera at 02:14 in the yard. They cannot tell you whether that person is your night-shift manager picking up a tool he forgot, the cleaner on his usual route, or someone who has just climbed your fence. The result, on every site we've audited, is the same: alerts get muted. The system stops being useful long before something actually happens.

Traditional CV analytics

Detects a person. Detects an exclusion zone. Detects out-of-hours.

  • "Person in zone-A at 02:14"
  • No idea who, no idea why
  • Same alert for the manager and the burglar
  • Alarm fatigue within a week

Darkfield security

Detects the person, then reads the clip — body language, route, credentials, tools.

  • "Manager · badge in at side door · walked direct to office"
  • "Unknown · climbed perimeter fence · carrying bolt cutters"
  • The first one is logged. The second one rings the on-call.
  • One escalation a fortnight, not one an hour.
/ what we detect

Four layers, all checked on the same clip.

a / presence + zone + time

The baseline anyone can do.

A person enters a defined zone outside agreed hours. We still detect this — it's the trigger that wakes the rest of the pipeline up. On its own, it isn't an event yet.

b / behaviour

How are they moving?

Confident, direct, walking the route an employee would walk — or hesitant, looking around, trying handles. Lingering at a window. Approaching from the wrong direction. The model reads body language the way you would.

c / context

What did they bring with them?

Did they enter through the front door with a badge swipe, or climb the fence? Are they carrying a clipboard, or bolt cutters, or a crowbar? Are they in branded uniform, or covered up?

d / VLM clip review

Every escalation is audited.

Before any alert reaches your security team, the candidate clip is read end-to-end by a vision-language model. It writes a one-line verdict — employee return, cleaner, delivery, break-in — and only the events with concerning verdicts get escalated.

/ two examples · same site, same hour

One is logged. One rings the phone.

22:14 · Employee return

A person approaches the side door, badges in, walks directly to the office, gathers something from a desk, leaves the way they came. Total time on site: 4 minutes.

  • Badge event matched to person ID
  • Route consistent with prior visits
  • Body language: confident, direct
  • VLM verdict: employee, after-hours pickup
  • Logged. No alert.

22:38 · Break-in

A person approaches the perimeter, climbs the fence, walks slowly along the rear of the building checking handles, produces a tool, attempts entry at the loading bay door.

  • No badge event
  • Entry vector: fence, not gate
  • Body language: hesitant, scanning
  • VLM verdict: unknown, attempting forced entry
  • Voice call · on-call security · within 8 seconds
/ the data table

What you receive, row by row.

timewhere / whoVLM verdictaction
22:14:08side door · badge OP-0117employee, after-hours pickuplogged
22:38:51rear perimeter · unknownfence climb, attempting entryP1 · voice call
02:42:11yard · cleaner-routecleaner on usual routelogged
03:08:00loading bay · unknowndelivery early · matches schedulelogged
03:31:47workshop · unknownconcealed face, carrying toolsP2 · SMS
/ try it on your site

First detection on day one. No financial commitment for two weeks.

If we can't reach the accuracy you agreed within two weeks, you pay nothing — and we remove anything we installed.

other use cases
first detection
48 hours from camera connect
onboarding
4–6 weeks of weekly syncs after that
guarantee
two-week risk-free window
compliance
UK GDPR · anonymised in RAM