A theft detection lock for buildings is three signals, one polygon, one schedule.

The phrase was popularised by Android's Theft Detection Lock, a phone-side feature that uses the accelerometer, Wi-Fi, and Bluetooth to detect a snatch motion followed by fast movement away, and then auto-locks the screen to protect data. That is a specific product for a specific asset class: a pocket-sized device that is picked up and run with. If you searched the phrase because you are protecting a phone, that is where you want to end up. If you searched it because you are protecting a mailroom, a transformer pad, an HVAC cage, a loading dock, or a parking lot, the mechanism is structurally similar (three-signal fusion, then a lock) but the signals and the capture point are different. This guide is about that second version.

On a phone, the lock is the screen lock. On a property, the lock is a polygon armed on a schedule. The moment a person enters that polygon during the armed window and dwells past the threshold, the detection pipeline locks onto that subject for that event: tile captured, thumbnail cropped, zone label attached, dwell counter frozen, message shipped. The event is 'locked' in the same sense that a radar operator says target lock: a specific subject, a specific zone, a specific time, with the chain of evidence packaged so dispatch can act inside the pre-action window rather than after the fact.

Zone, dwell, and time. Zone is a drawn polygon on a specific camera tile: the package shelves in the mailroom, the condenser pad, the dock apron, the trailer king-pin area, the transformer cage. Dwell is how long a person stays inside that polygon before the event fires, usually 10 to 20 seconds, chosen to filter residents walking through from actors setting up. Time is the schedule the zone is armed on: some zones are armed 24/7 (transformer cage), some only after business hours (mailroom after 7 p.m.), some only during specific shifts (dock gate). Any single signal fires dozens of times a day. All three signals together fire a handful of times a day, and those are events worth reading.

Because the HDMI multiview is the signal that already shows every camera at once, downstream of whatever the camera vendor is. The recorder has already done the hard work: it has pulled the streams, muxed them into a mosaic, and driven them to the monitor port the guard watches. Cyrano taps that port. One HDMI in from the DVR, one HDMI out to the monitor, a network cable, power. The physical install on a running DVR is under 2 minutes. No ONVIF negotiation, no per-camera credentials, no camera firmware assumption. The capture point is the recorder, so analog and IP cameras behave identically and the brand of the camera does not matter.

Up to 25 tiles per unit off a single DVR multiview. If the DVR is set to a 4x4 grid the unit runs inference across 16 tiles in parallel. If it is a 5x5 it runs across 25. If the operator switches the DVR to fullscreen on a specific camera during an incident, the unit re-scopes to that single camera at full resolution, so per-tile accuracy goes up, not down. Properties with more than 25 cameras typically run one unit per DVR.

End-to-end, tile capture to WhatsApp delivery, under 60 seconds in measured deployments. The alert carries a tile thumbnail, the zone label, dwell seconds, timestamp, camera name, and a latency number on the payload. A sample real-deployment event record shows a latency of about 5,120 ms from capture to delivery. That number matters because the pre-action window, from zone entry to the actual act, is usually 30 to 180 seconds. A detection that lands at second 45 is intervention. A detection that lands at minute 4 is documentation.

Those are the part of 'AI on existing cameras' that most vendors skip, and the part that kills false-positive budgets. A DVR composite is not a clean video feed: every tile has a fixed-position clock, a per-tile camera name strip, and a channel bug watermark. To a detection model those glyphs are visual noise that can fire bounding boxes on a colon in the clock or on tall letterforms in a camera label. Cyrano masks the three overlays per DVR layout once at install time, not once per frame. Layout id 4x4-std, 5x5-std, and so on, are preconfigured.

A smart lock is an access control device on a single opening. If someone defeats it, you know it was defeated. A theft detection lock in this guide is a detection device that covers open outdoor areas and shared indoor zones that have no door at all: transformer pads, parking lots, package alcoves, dock aprons, HVAC cages, trailer yards. Those places cannot be locked with a bolt because they are either outdoors, shared, or part of a traffic path. The only 'lock' that maps to them is a zone armed on a schedule, with a camera providing the evidence chain. Use both if you have both. They cover different failure modes.

Motion alarms run on one signal: pixel delta. They fire on raccoons, trash bags, shadows at sunset, delivery drivers turning around, and headlights sweeping a wall. A zone + dwell + time pipeline runs on three filter layers, all of which have to agree. A typical 16-camera apartment property generates more than 200 raw person detections per day from residents, contractors, deliveries, and staff. The same property generates 3 to 8 delivered alerts per day after the three filters run. That ratio, roughly 50 to 1, is what separates an alert channel that stays in service from one that gets muted inside a week.

One WhatsApp thread per property, with the tile thumbnail attached. WhatsApp is chosen because it is already open on the staff's phones, it is the same thread they use for maintenance, move-outs, and vendor coordination, and adding an alert stream to it is a free change. The alternative, a dedicated monitoring portal, starts around $250 per camera per month and assumes a human watching a feed. SMS fallback and a webhook into a PMS or access-control platform are both available if a property wants them, but the default is WhatsApp because the default is: the channel that gets read.