Leading Indicators for Property Security Delivery

1. Leading vs lagging, quickly

A lagging indicator measures what already happened. Monthly incident count. Number of police reports. Insurance claim value. These numbers are real and useful at the board level, but they do not tell you how to act today. If last month had six incidents, you already know the outcome. You cannot change it.

A leading indicator measures the process that produces the outcome. How long it took to acknowledge an alert. How many patrols were completed on schedule. How many cameras were offline this week. These numbers tell you, before next month's incident count is tallied, whether the program is drifting.

The same shift happens in every operations discipline. Manufacturing learned it decades ago with cycle time and defect rate per station. Software learned it with deployment frequency and time to recovery. Security is the last operations function in most real estate portfolios to move in this direction, mostly because the telemetry required did not exist cheaply until recently.

2. The five to seven indicators that matter

Not every leading indicator is worth tracking. The ones that actually predict outcomes at a property security program, in rough order of impact:

• Alert to acknowledgement time. From the moment an alert fires to the moment a human confirms it. Measured in seconds. This is the single strongest predictor of whether the program responds or just records.
• Alert to physical response time. From alert fire to someone physically arriving at the location. Much more variable, but captures the part of the program that actually interrupts an incident.
• Camera uptime. Percentage of cameras fully online and recording over the measurement window. A camera that has been offline for two weeks is a leading indicator of future blind spots.
• Patrol completion rate. Percentage of scheduled patrols completed, ideally measured with a tour verification system (GPS tags, beacons, patrol app). A drop here predicts an incident in the gap.
• Incident escalation rate. Percentage of incidents that required escalation (from alert to call to dispatch). Rising rate indicates either a changing threat environment or a degrading first line response.
• Resident reported incidents per 1000 units per month. A counterintuitive metric: higher usually means the reporting channel is working, not that the property is less safe. A sudden drop is a warning sign that residents have lost confidence in the program.
• Mean time to footage retrieval. How long it takes to produce a clip from a specific camera at a specific time, upon request. Predicts whether the program can actually support an investigation when one is needed.

Five of those seven, tracked weekly, are enough. Add the other two when the basics are stable.

3. Response time, measured honestly

Response time is the most often quoted and most often fudged metric in security. Vendors report average response time, but averages hide the tail. One incident with a two hour response pulls the mean up, and then twenty quick acknowledgements pull it back down, and the number on the dashboard looks fine.

Track the P95 instead, or at least alongside the mean. The P95 is the response time that 95 percent of incidents were faster than. If the P95 is 12 minutes and the mean is 3 minutes, you have a long tail of slow responses hiding in the distribution. That tail is where the real exposure is.

Also split response time by hour of day and day of week. Most programs are fine during business hours and fall apart overnight and on weekends. The staffing model that works at 2 pm on a Tuesday is not the same model that works at 2 am on a Saturday. The number that matters is the 2 am number, because that is when most incidents happen.

4. Escalation rates and what they tell you

Escalation rate is the percentage of alerts that required an escalation beyond the first line response (from a staff member to a property manager, from a property manager to police, from a contracted guard to the client). It is one of the most honest numbers a program can track, because it is hard to manipulate.

A stable escalation rate over a rolling 90 day window is a healthy sign. A rising escalation rate is an early warning. The cause could be anything: changing threats in the neighborhood, a new property manager still calibrating thresholds, a thinning front line response that pushes more to the next tier. The point is that the number rises before the lagging incident count does, which gives leadership time to act.

A falling escalation rate deserves attention too. Either the program genuinely improved, or the front line quietly stopped reporting things that should have been escalated. The distinction matters, and the only way to know is to audit a sample of alerts against the log.

5. The telemetry you need to track these

You cannot track what you do not measure. The telemetry layer for a leading indicator program has four components:

• Alert source with timestamps. Every alert needs a source, a camera or sensor, and a timestamp accurate to the second. A monitoring tool that produces email digests with no per event granularity is useless for this.
• Acknowledgement tracking. Someone has to click acknowledge, and that click has to be recorded. Messaging based workflows (WhatsApp, SMS, Slack) can capture this naturally if the thread is monitored.
• Patrol tour verification. GPS tagged patrol apps, Bluetooth beacons, or pipe tags plus time clocks. The exact tool matters less than the output being machine readable.
• Camera health telemetry. Either the DVR's own monitoring, or an overlay that detects stream loss and alerts when a camera goes dark. The weekly uptime percentage depends on this being reliable.

Most existing camera stacks have at least partial telemetry. The work is usually wiring it together into one shared view, not replacing every piece. An edge AI overlay that reads the DVR's HDMI output, like Cyrano, can provide timestamped alerts on top of the existing cameras without touching the recorder, which means the telemetry bootstrap happens without a capital project.

6. Running a quarterly program review

Leading indicators are only useful if they feed a review loop. Once a quarter, the security program needs an hour with leadership, the five or seven numbers, and a discussion about what they show.

A clean quarterly review has three sections. First, the numbers: where each indicator is relative to baseline, relative to target, and relative to last quarter. Second, the narrative: what specific changes explain the movement. Third, the actions: what two or three operational changes will be made this quarter to move specific indicators, and who owns each.

The review is boring when it works. Numbers drift inside a narrow band. Actions are small adjustments. Boring is the goal. The review becomes interesting only when something has shifted, and by that point you have 90 days of lead time rather than finding out through an insurance claim.

7. FAQ