Energy theft is not one thing. It is six things. And they all fire the same event.
The SERP for this keyword is monolithic: smart-meter ML against a single kWh stream. That framing is correct for a utility and useless for a property owner. At a multifamily building the losses arrive through at least six physically distinct vectors, half of them outside the electricity meter entirely. This guide decomposes the portfolio, shows the single event-class primitive that covers all six, and includes the exact payload Cyrano emits when each one fires on a real DVR.
See the same event fire on six different zonesThe SERP frames one commodity. Your P&L holds six.
Run the keyword in any search engine and the first page is homogeneous. Nature Scientific Reports, MDPI Energies, ScienceDirect, IET Smart Cities, Franklin Grid, CLOU Global. Every paper and every vendor post is structured the same way: ingest hourly kWh telemetry from smart meters, train a classifier (random forest, SVM, GCN, stacking ensemble), publish an accuracy number in the 80s. That is optimisation for a utility's question, which is whether a given retail account is under-reporting consumption.
If you operate the building, that is not your question. Your question is who is drawing load off your house panel at 02:47, whose cord is running from the exterior pedestal into the neighbour's yard for a grow tent, who walked out of your rooftop array with the inverter on a Tuesday morning. Most of what you pay for is not a flag on a kWh time-series. It is not even electricity. It is a portfolio of six physically distinct acts, and the utility's model never touches four of them.
The insight is that the six acts share a single structural feature: each one happens at a known physical point. Which means detection is not six classification problems. It is one primitive, applied six times, on the cameras the property already runs.
Six vectors. One hub.
The outer ring is the portfolio. The centre is the single edge unit tapping the DVR HDMI multiview. Every vector collapses onto the same event class.
The six vectors, in detail
Each one has a known physical point, a known dwell signature, and a known set of polygons to draw on the DVR multiview.
1. Panel tap
Unauthorised load pulled off the house panel or an unmetered service-panel-room bus. Usually an insider with access. Zone: service_panel_room (door from inside). Dwell 8 to 15 seconds, armed overnight and on weekends.
2. Submeter bypass
Jumper across a per-unit submeter so downstream load reads zero. Zone: submeter_closet_floor_N. Dwell 10 seconds, armed outside scheduled maintenance windows.
3. Gas meter tamper
Bypass, magnet, or bridge across residential gas meters or propane regulators. Zone: gas_meter_can_outside. Dwell 15 seconds, armed full 24/7 if no scheduled reader access.
4. Solar install copper strip
DC wiring, MPPTs, and inverters stripped from rooftop or ground-mount arrays. Zone: solar_inverter_rooftop_hatch and solar_array_perimeter. Dwell 20 seconds, armed overnight.
5. EV charger freeload
Unauthorised plug-in at reserved stalls, common-area Level 2, or amenity chargers. Zone: ev_charger_stall_N. Dwell 30 seconds, armed outside the assigned resident's plate window.
6. HVAC condenser coil cut
Outdoor AC condenser lines cut for the copper coils. Four- to five-figure replacement per unit. Zone: hvac_condenser_pad_unit_N. Dwell 15 seconds, armed overnight.
The anchor: same payload, different zone string
The claim of this page is that one event class covers every vector. Here is the evidence. Three of the six zones, firing across three physically unrelated vectors, anonymised from live deployments. Compare line by line. Every field except the zone string and the commodity correlation on the last line is identical.
The overlay_mask line records that the DVR clock digits, camera name strip, and channel bug were masked out of the image tile before inference. This is the same line across all six vectors. For any event that lands in a legal, utility, or insurance file, that mask string is what defeats the “your model just fired on its own watermark” objection. Because the payload schema is identical, one reviewer workflow, one audit rubric, and one delivery pipeline handle all six.
One inference engine, six commodity streams
The diagram below is the structural claim. On the left are the six vectors, each firing its own commodity signal into the property's existing meter or work-order system. In the middle is one edge unit. On the right is one event pipeline and one case-file format.
Six vectors collapse onto one event class
The portfolio numbers
What covering all six vectors actually costs and what it replaces. These are deployment-level numbers, not academic ML accuracies.
Utility smart-meter ML vs. one vector-agnostic zone primitive
| Feature | Smart-meter ML | Cyrano zone entry |
|---|---|---|
| Commodity coverage | One commodity per model (electricity, gas, water require separate stacks) | All six vectors, one event class |
| Training regime | Retrain per utility, per meter vendor, per tariff | No per-vector training; zone is a polygon and a dwell |
| Output granularity | Monthly or daily kWh anomaly flag on an account | Second-resolution event with tile thumbnail and overlay_mask |
| Identification | Account number only. No person, no time of act | Person-in-polygon, dwell, ISO timestamp, photograph |
| Solar theft | Not in scope. kWh goes up, not down | Same zone primitive on rooftop hatch or array perimeter |
| HVAC condenser theft | Not in scope. Not a kWh signal at all | Zone on condenser pad, same payload |
| EV charger freeloading | Not in scope unless the charger is smart-metered and the utility owns the data | Zone on the stall, armed outside the assigned plate window |
| Output format | Dashboard number | Structured event payload, drops into case file without reformat |
How a condenser coil cut becomes the same event as a submeter tap
“At one Class C multifamily property in Fort Worth, Cyrano caught 20 incidents including a break-in attempt in the first month. Customer renewed after 30 days.”
Fort Worth, TX property deployment
Covering all six vectors on a 120-unit property, in order
Below is a realistic install sequence. Eight to fourteen zones is typical. The whole sequence runs in an afternoon.
Map the six vectors on the property drawing
Walk the site with a floorplan. Mark service panel rooms, submeter closets, gas meter bank, exterior pedestals, solar hatches, EV charger stalls, HVAC condenser pads. Each is a zone candidate.
Confirm camera coverage on each physical point
For every marked point, verify a camera in the DVR has a usable angle. If one is missing, add a single PoE camera. Existing IR-capable cameras are sufficient for every indoor closet.
Plug the Cyrano unit into the DVR HDMI multiview
HDMI in from DVR, HDMI out to the existing guard monitor, network, power. Two minutes of physical install. The multiview layout is already the composite the guard already watches.
Draw the zone polygons and set dwell + armed window
In the admin, each zone is a polygon on a tile plus two numbers: dwell_seconds and armed_window. 10 to 20 seconds of dwell, overnight armed window is a sensible default for most zones.
Wire events to the ops WhatsApp thread and paired data
Zone entry events land on WhatsApp with the tile thumbnail. For each vector, define the paired commodity signal (submeter kWh, utility therms, solar export kWh, EV stall assignment, work-order).
Watch a full armed cycle, tune the dwell threshold
First night usually surfaces false positives from legitimate late maintenance or pool service. Raise the dwell on those zones or tighten the armed window. Second night is usually clean.
DVR and NVR brands the HDMI tap works on
Because the input is the HDMI multiview the guard monitor already receives, brand does not matter as long as the recorder has an HDMI output, which every current DVR does.
Per-vector deployment checklist
- Service panel room: camera from inside, 10s dwell, 24/7 armed outside maintenance windows
- Submeter closet: camera on the door, 10s dwell, armed outside reader schedule
- Gas meter can: exterior camera, 15s dwell, armed 24/7 unless utility reader is scheduled
- Solar rooftop hatch: exterior camera, 20s dwell, armed overnight
- EV charger stall: camera covering the stall, 30s dwell, armed outside assigned plate window
- HVAC condenser pad: exterior camera, 15s dwell, armed overnight
- Exterior pedestal (pool, RV, courtyard): camera on the outlet wall, 10 to 20s dwell, armed overnight
- Overlay mask verified for DVR clock, camera name strip, channel bug
- Each zone paired to its commodity source: submeter report, utility therms, work order, or charger log
The three objections this framing has to answer
“Smart-meter ML already catches electricity theft.”
For a utility, yes. For a building owner whose losses are upstream of the submeter, outside the kWh channel entirely (gas, solar, HVAC copper), or inside a legitimate billing envelope (EV charger freeload), the model's accuracy number tells you nothing about the money you are losing.
“A camera zone will false-fire on maintenance.”
It will on night one. The armed_window and dwell threshold exist specifically to filter scheduled activity. After one cycle of tuning, almost every remaining event is the behaviour you care about: after-hours access to a point with no legitimate reason for presence.
“Six vectors on one device is too much to manage.”
The reverse is the point. Six vectors on six different specialised systems is the hard version. Six vectors on one event schema, one inbox, one review workflow is easier than any single-vector product the owner currently runs.
Watch pre_action_zone_entry fire on a real DVR
Bring your DVR model and a photo of one vector point. We will draw the polygon on a live tile and show you the event payload land in under 60 seconds.
Book a 15-minute demo →Frequently asked questions
Why do the top SERP results for energy theft detection all look the same?
Because they all come from the same institutional stakeholder, which is the utility. Nature Scientific Reports, MDPI Energies, ScienceDirect, IET Smart Cities, Franklin Grid: every top-ranked 2026 result frames energy theft as a classification problem over smart-meter consumption telemetry. Stacking ensembles, graph convolutional networks, SVM at 86.67 percent accuracy against random forest at 83.33 percent. All of it is optimising a single number: can the distributor correctly flag a kWh account that under-reports. That is the utility's problem. If you own the building, not the grid, you are paying for a different class of losses that the kWh channel never sees at all, because most of them never touch a smart meter to begin with.
What are the six energy theft vectors at a multifamily or commercial property?
First, panel tap: someone pulls load off the house panel or an unmetered service-panel-room bus. Second, submeter bypass: a jumper across a unit submeter makes its downstream load read zero. Third, gas meter tamper: bypass, magnet, or bridge across the residential gas meter or propane regulator. Fourth, solar install copper strip: theft of DC copper wiring, MPPTs, and inverters from rooftop or ground-mount solar arrays. Fifth, EV charger freeload: an unauthorised resident or neighbour plugs into a reserved stall, common-area Level 2, or amenity charger. Sixth, HVAC condenser coil cut: a thief cuts the refrigerant lines on an outdoor AC condenser to strip the copper coils, a few hundred dollars of scrap and a four- to five-figure replacement for the owner. Each of these happens at a specific physical point. The owner's problem is not classification. The owner's problem is identification at that point.
How can a single Cyrano unit cover all six vectors?
Because Cyrano's detection primitive is not commodity-specific. It is person-in-polygon with a dwell threshold and an ISO timestamp. The event class is pre_action_zone_entry and it does not care whether the polygon is drawn around a gas meter can, a rooftop solar hatch, an EV charging stall, or an HVAC condenser pad. The only field that changes between vectors is the zone string. Everything else in the payload (timestamp, dwell_seconds, tile.label, thumb.url, overlay_mask, latency_ms, delivery) is identical. A utility has to train one ML model per commodity and typically per meter vendor. Cyrano draws six polygons on the existing DVR multiview feed and emits the same event for any of them.
What does the event payload actually look like when a zone fires?
event.class = pre_action_zone_entry, property identifier, tile.label (which camera tile), zone (one of submeter_closet_3rd_floor, gas_meter_can_outside, ev_charger_stall_14, solar_inverter_rooftop_hatch, hvac_condenser_pad_unit_212, exterior_pedestal_bay_17, or whatever polygons you draw), zone.armed_window (local time range), dwell_seconds (integer), timestamp (ISO 8601 with offset, to the second), a tile thumbnail URL at 480x270 centred on the event, overlay_mask (which DVR chrome was masked before inference so the detection is not firing on a clock digit or a channel bug), delivery channel (WhatsApp group or SMS fallback), and latency_ms from capture to delivery. The payload is the audit record. Drop it into a case file, an insurance claim, a utility investigator's packet, or an HOA violation notice without reformatting.
Does this replace my submetering vendor or my utility meter?
No. Think of the camera zone as the second source of truth that pairs with whatever meter signal you already have. The meter, the submeter, or the utility report tells you what was stolen and how much (kWh, therms, gallons, dollars). The zone event tells you who, when, and for how long, standing at which specific physical point. Neither one alone is a recovery document. Together they become one. If you do not have submetering for a given commodity, the zone event alone still gives you a prosecution record and a defendant. If you do have submetering, the zone event takes the monthly anomaly from unattributable to attributable.
Why is HVAC condenser copper theft counted as energy theft?
Because the outcome is an energy-denied-to-paying-residents loss at the owner's expense. A cut condenser does not just cost a scrap value in copper. It costs refrigerant, recertification, a full condenser unit replacement in the three to five thousand dollar range, and the revenue impact of a unit whose AC is down for however many days. The industry tends to put this under metal theft, but from the operator's P&L it is part of the same portfolio of losses as submeter bypass and gas tamper. Any serious energy-theft program for a multifamily operator has to include condenser pads. A zone on the pad with a 20-second dwell and a 22:00 to 06:00 armed window catches the approach before the refrigerant line gets cut.
How does this work on gas or propane, where there is no electrical consumption signal?
The commodity signal is irrelevant to the camera primitive. You draw the polygon around the gas meter can, the regulator, or the propane tank fill point. When someone enters the polygon outside the armed window and dwells longer than the threshold, the event fires. If your utility's gas theft team is investigating, they get a timestamped record of a person at that meter. If the theft is an insider using a magnet on a residential gas meter, you have a video-corroborated event placed on the timeline of when the meter telemetry went anomalous. If your property has propane tanks for pool heating or tenant stoves, the fill point is a well-known tap target and a zone on it is nearly free.
Do I need different cameras for different vectors, like a thermal camera for the HVAC pad?
No. Cyrano consumes whatever image your DVR or NVR is already recording. Standard IR-capable PoE or analog cameras cover all six vectors at night. For unlit interior spaces (submeter closets, service panel rooms), either the existing camera is already IR or you drop a small IR LED bar for about forty dollars. Rooftop solar hatches and ground-mount arrays typically already have a camera because insurance requires it. The detection is image-based and does not care whether the subject is illuminated by visible light, IR, or parking-lot floods, only whether a human is visible in the frame.
What is a realistic starting deployment for a property with all six vector types?
One Cyrano unit, 25 camera tiles, six to ten zones drawn. A typical 120-unit multifamily property has one service panel room, two or three submeter closets, a gas meter bank, two or three HVAC condenser pads, one solar rooftop hatch (if the property has solar), and two to six EV charger stalls. That is eight to fourteen zones, well under the 25-tile per-unit capacity. Install is HDMI in, HDMI out to the existing guard monitor, network, power, two minutes of physical connection. Zone drawing is 30 to 60 seconds per zone in the admin. Events start landing on the property's WhatsApp thread the same afternoon.
How does this compare to hiring a guard?
A guard cannot be at a submeter closet, a gas meter can, a rooftop solar array, an EV charger stall, a condenser pad, and an exterior power pedestal simultaneously. A 25-tile Cyrano unit is, functionally, a guard that is watching every one of those polygons every second. The guard costs three to five thousand dollars a month at market rates for a single shift. Cyrano is a one-time hardware cost plus a monthly service fee in the low hundreds. Unlike a guard, it produces a structured event payload that pairs with submeter or commodity data, which is the thing a court or a utility investigator actually wants.
Energy theft, one vector at a time
Related guides
Electricity theft detection for property owners
Why smart-meter ML misses the person at the panel, and how a zone event pairs with the kWh anomaly.
Power theft detection as a latency problem
The 60 to 180 second approach window that meter-side ML cannot fit into.
Cable theft detection before the cut
Real-time detection on the pre-cut approach, not the morning-after footage review.
Comments (••)
Leave a comment to see what others are saying.Public and anonymous. No signup.