The fire door wouldn’t shut. Not properly, anyway.
A warehouse manager in the Midlands flagged it recently: a rear door whose hinge had dropped just far enough to leave a gap. The door itself wasn’t what bothered the security engineer sent to inspect it. What bothered them was that nobody had noticed for weeks. Staff had propped it open for ventilation more than once. And the alarm sensor covering that entry point? Untested since the system went in three years earlier. For anyone who takes business security seriously, that’s the uncomfortable bit.
Nothing happened, though. No break-in. No loss, no incident report. Still, it’s precisely the sort of gap that turns an opportunistic crime into an easy one — and it’s far more common than most owners assume.
Here’s the wider picture. Nearly a third of UK businesses will fall victim to some form of crime this year, according to the Home Office’s Commercial Victimisation Survey. That covers a broad mix of incidents (everything from customer theft to assaults on staff). Burglary and vandalism, though — the very things a decent security setup exists to stop — still make up a real chunk of it: 8% of businesses report a burglary or attempted burglary in a given year, and another 8% report vandalism.
Then there’s the ONS data. Figures for the year to March 2025 recorded 78,707 non-domestic burglaries — across England and Wales alone.
That’s a lot. And it isn’t spread evenly; some premises are simply softer targets than others. The difference rarely comes down to one glaring failure. Usually it’s a handful of small physical and procedural gaps that pile up quietly over time.
Specialists who carry out commercial site surveys, from single-unit shops to multi-building warehouse complexes, tend to see the same five business security warning signs again and again. None is dramatic by itself. Put them together, though, and they tell you exactly how exposed a site really is.
1. Blind Spots in CCTV Coverage
Most businesses have cameras. Far fewer have cameras pointed at the places someone would actually try to get in.
The pattern’s familiar. A commercial CCTV system goes in years ago, then gets added to bit by bit as the building changes — new extensions, storage areas and car park sections that never quite get brought into scope. Installers routinely find old analogue kit with resolution too poor to pick out a face or number plate at any useful distance. Recorders that hold footage for only a few days before overwriting it. Cameras trained on the car park entrance while a side loading bay goes completely unwatched.
The answer isn’t always “more cameras.” Sometimes it’s moving two existing units to kill a blind spot; sometimes it’s swapping an ageing DVR for an IP-based NVR system with proper retention, remote access and motion-triggered alerts. (Both are recorders: a DVR handles older analogue cameras, an NVR works over the network with IP ones.) What really counts is whether the coverage lines up with the building’s genuine weak points — not wherever someone happened to mount a camera a decade back.
2. Poor or Patchy External Lighting
Simple to fix. Easy to overlook.
Overgrown shrubs blocking a dusk-to-dawn sensor. A motion-activated floodlight that’s been broken for months, never reported because nobody’s on site after dark to notice. Lighting fitted when the building went up and never reviewed again, even as the planting grew and extensions appeared.
Bad lighting doesn’t just make a site harder to watch. It actively weakens CCTV, because even a good camera struggles in low light without enough illumination or infrared support matched to the distance involved. Want to know where you stand? Walk the perimeter after dark. Five minutes tells engineers more than most people would guess: which areas are genuinely lit, which are lit at the wrong angle, and which have quietly gone dark without anyone clocking it.
3. Alarms That Haven’t Been Tested or Serviced
An intruder alarm with no service visit in over a year? It’s such a routine finding that experienced installers barely remark on it anymore. Systems get installed, commissioned… and then mostly forgotten until a false alarm forces the issue.
Why does that matter? Two reasons.
First, sensors degrade. PIR detectors — passive infrared, the motion sensors tucked into ceiling corners — can drift out of calibration. Backup batteries age past their useful life. And dual-technology detectors, which combine microwave and infrared sensing, need periodic recalibration to keep working as intended.
Second (and often the bigger deal) is compliance. Systems maintained to BS EN 50131 and monitored through an NSI or SSAIB-approved alarm receiving centre qualify for a police response under current national policy. Let the maintenance slide, rack up a few false alarms, and that police response priority can be withdrawn entirely. The business is then left relying purely on a keyholder or a third-party response. Not ideal.
Regular servicing isn’t box-ticking. It’s what keeps the system doing the job it was installed to do — one of the least glamorous but most useful parts of business security.
4. Uncontrolled or Outdated Access
This one catches owners off guard more than any other, because it doesn’t look like a security problem until somebody maps it out. Master keys never replaced despite several rounds of staff turnover. Alarm codes shared around a team years ago and never changed. Access fobs issued to former employees that were never deactivated.
Security consultants often walk into premises where the site manager genuinely can’t say how many people still hold a working key or code. That’s no dig at the manager. It’s simply what happens over years of staff changes when there’s no proper access control system logging who came and went, and when.
A modern access control system — card, fob or biometric — does two things a set of shared keys never will. It restricts entry by time and area. It also leaves an audit trail, and when something does go wrong, that record is often the difference between knowing exactly what happened and guessing.
5. No Link Between Detection and Response
Picture it: the middle of the night, an alarm going off at a unit on an empty industrial estate. It rings. And rings. Nobody comes.
An alarm nobody responds to is, in practical terms, no better than having no alarm at all. Yet sites still turn up with intruder alarms running as standalone units — no connection to a monitoring station, relying entirely on the racket itself to scare off an intruder or alert a passer-by.
Monitored systems close that gap. Connected to an alarm receiving centre (ARC) and backed by a properly maintained keyholder list, they turn noise into a response: the ARC can verify the alert, contact keyholders in the right order and, where the system qualifies, request police attendance. Without that link? Response time comes down to pure chance — whether someone happens to hear it, whether they know who to call, and whether that person actually picks up.
Keyholder lists deserve their own review, too. Engineers regularly find numbers that no longer work, staff who’ve left the business, or a contact order that no longer reflects who’s actually available at short notice.
Bringing It Together
Taken one at a time, none of these five issues is catastrophic. A slightly dim floodlight or an unreviewed keyholder list won’t sink a business on its own.
The catch? They cluster. A site with poor lighting often has an ageing CCTV system that was never upgraded to compensate. A business that’s lax about deactivating old access fobs is usually just as lax about alarm servicing. The problems compound.
That’s where a proper site review earns its keep. It isn’t about hunting for one dramatic flaw — it’s about spotting the pattern across all five areas and understanding how they interact. A warehouse with excellent CCTV but no monitored alarm connection still has a critical gap. A retail unit with a well-maintained alarm but blind spots in its camera coverage is still exposed to opportunistic theft the alarm alone won’t catch. Good business security has to join up, or it isn’t really working.
Recognise one or two of these on your own premises? The sensible next step is straightforward: get someone qualified to walk the site properly, rather than waiting for an incident to force the question. That Midlands warehouse manager got lucky — the gap was found before anyone exploited it. Not every business gets that outcome by chance. And with commercial burglary rates where they currently are, chance is a pretty poor strategy.
