Visible theft detection powder is a starting gun. You have about 40 seconds.
Every vendor selling visible theft detection powder sells it as a passive identifier. Apply the dye, a thief touches the treated surface, the stain tells the story. What nobody in the top search results talks about is the countdown that starts the moment the thief glances at their hand. They bolt, they wipe, they drop the item, they try to wash. The stain is evidence only if you catch the hand before the person leaves the room. This guide is about the 40-second window that decides whether visible powder closes a case or just stains a pair of pants that walked out.
See the pre-action alert that fits inside the panic windowWhat the top results get wrong
Search the phrase and the first page is product pages. SmartWater visible stain. Redweb dye kits. ForensiKit visible marker powder. Shomer-Tec security dye. Banker dye packs repurposed for fixed surfaces. They all describe the same three-bullet loop: apply, transfer, identify. The word they never use is when.
Visible powder is not UV powder. UV powder is a covert mark. The suspect does not know they are stained, and the evidence is preserved for hours or days until someone sweeps a UV flashlight over their hands. Visible powder is the opposite. It announces itself. The moment the thief's eyes drift down to their hand, they know. From that second forward, they are optimizing for exit, not for the lift. They will drop the item, wipe on clothing, rinse at the first tap, or bolt. That behaviour collapses the evidentiary window from hours to under a minute.
The top search results do not mention this because they are trying to sell the powder as a stand-alone product. In practice, visible powder's utility is almost entirely a function of whether you receive a timely alert while the person is still on the treated surface with the stain still fresh on their fingers.
The thief's 40-second panic timeline
Composite timeline from deployment reviews where visible powder fired and camera footage was available. Your exact numbers will vary by powder formulation, lighting, and thief attentiveness, but the shape is consistent. The question this page answers is where a camera-side alert can usefully fit inside this sequence.
Second by second, contact to flight
t = 0s. Contact
Thief touches the treated shelf, drawer, or item. Powder transfers to palm and fingers in under 1 second. They are still committed to the lift. Nothing visible has registered yet.
t = 1 to 5s. Lift
Package leaves the shelf, cash leaves the tray, tool leaves the crib. The stain is on the hand but hidden behind the object. Dwell count in the zone is still climbing. This is the ideal frame for a tile thumbnail.
t = 5 to 15s. Alert reaches staff
Cyrano captures, runs inference, emits the zone entry event, and delivers to WhatsApp. A front-desk attendant, remote monitor, or on-call manager now knows someone is on the treated surface, with a thumbnail, right now.
t = 15 to 45s. Stain noticed
Thief glances at their hand, usually after a small maneuver (pocketing, repositioning, adjusting a bag). Expression changes. Response behaviour begins: rubbing on pants, looking for a sink, looking at the camera, looking at the exit.
t = 45 to 75s. Flight or wipe
One of three paths. Drop and walk out empty handed. Walk out fast carrying the item and the stain. Detour to a bathroom or sink. The item, the stain, and the person are about to stop being in the same room.
t > 75s. Evidence diffusion
Stain is transferring to clothing, to door handles, to steering wheels, to other surfaces. The physical mark is now distributed across a larger area that is mostly not on your property. Recovery becomes a forensic exercise.
The anchor numbers
Operating constants from the camera side of the pairing. These are the variables that decide whether the alert lands inside the panic window.
The actual event payload, anchored to this pairing
A single zone entry event emitted on a mailroom treated shelf, anonymised from a live deployment. The fields that matter for a visible powder pairing are highlighted in the notes below the block. This is the record a front-desk attendant acts on and the record a police report cites.
Notice the three fields that matter for visible powder. First, entry_edge tells staff the direction the person walked in from, which is also the likely exit vector. Second, dwell_seconds of 2 confirms the alert fired on zone crossing, not after a long timeout. Third, overlay_mask lists which DVR overlays were masked before inference, pre-empting any defense challenge that the model keyed off the DVR clock pixels. The latency_ms of 7.4 seconds is the whole ballgame: it is well inside the thief's own reaction window.
How the pairing physically works
Two halves. The powder is applied to the treated surface. The camera zone is drawn directly over that surface on the tile where it appears on the DVR multiview. Entry into the zone is the trigger. Everything else is delivery.
Inputs, inference, outputs
Visible powder alone vs. visible powder with Cyrano pre-action alert
Same dye, same camera, different outcome when the thief looks at their hand.
| Feature | Visible powder alone | Visible powder + Cyrano zone entry |
|---|---|---|
| Thief identification | Stain only | Stain + tile thumbnail with timestamp |
| Alert timing | Whenever footage is reviewed | Before thief notices stain (5 to 15s) |
| Response window usable | None (post-hoc) | Inside the 40s panic window |
| Approach direction known | Unknown without review | entry_edge field records it |
| Evidence of when contact happened | Inferred from shift logs | ISO 8601 timestamp to the second |
| Live intervention possible | Not possible | Staff dispatched during panic window |
| Holds up if suspect flees quickly | No, stain leaves with them | Yes, record is already emitted |
| Camera requirement | N/A | Any DVR with HDMI multiview |
| Chain of custody start | At stain discovery, manual | At zone entry, automated |
“The gap between the first frame of contact and the moment a thief realizes they have been stained is the only window where the hand, the item, and the person are all still in the room. Everything useful happens inside it.”
Cyrano deployment notes, 2026
Where this pairing earns its place
Visible powder plus pre-action alert is purpose-built for a specific shape of loss. A small set of treated surfaces. A short list of plausible actors. Losses that nobody has been closing because the footage was never actionable in time.
Mailroom shelves with after-hours package theft
Dye the inner shelf. Draw the zone around the shelf with an after-hours arming window. Residents walk past in 3 seconds and never enter the zone. A thief stops, reaches, and lifts, crossing the polygon. Pre-action alert fires at the reach, before the stain is noticed.
Tool crib and gang-box theft on jobsites
Visible dye on tool kits. Polygon around the crib. Armed outside shift hours. Alert lands while the hand is still in the crib.
Cash drawers and till skim
Classic dye-pack application, but for a fixed surface. Zone the drawer with shift-change armed windows. Catches substitution and skim during the handover.
Copper spool racks on laydown yards
Dye the spool ends. Polygon with a 30 to 60 second dwell. Visible stain on hands and cut tools narrows suspects to a short list.
HVAC condenser cages and transformer panels
Visible powder on cage latches. Alert fires when someone crosses into the polygon at the pad. Stain on hand, tools, and cage.
Fire alarm pulls and workstation keyboards
Small, specific surfaces with narrow legitimate use. Visible dye plus tight zone with low dwell catches malicious pulls and unauthorized access.
Storage unit doors and bike cages
Dye the hasp or latch. Zone the area in front of the door. After-hours armed window. Pre-action alert fires before the door is open.
The three things most deployments get wrong
Where visible powder pairings fail, they fail in three predictable ways. None of them are about the chemistry.
Mistake 1
Dye everything
Treating doorknobs, handles, and general touch surfaces generates noise faster than it generates leads. Dye only specific items with narrow legitimate contact. The polygon is drawn over the dye, not the room.
Mistake 2
Alert on exit, not entry
Any system that waits for a dwell timeout before alerting is outside the panic window on arrival. Cyrano emits pre_action_zone_entry on the first frame of polygon crossing. Entry, not exit.
Mistake 3
No staff on the other end
A pre-action alert landing in an unmonitored WhatsApp group is the same as no alert. The pairing only closes cases when someone is watching the thread during armed hours and can make contact or dispatch within the window.
The application checklist
If you are deploying this pairing for the first time, do each of these in order. Skipping any one of them puts the pairing outside the panic window the next time a thief arrives.
Configure once, verify weekly
- Identify the specific treated surface. Never a whole room.
- Apply visible dye to the surface and log the date, time, initials, batch.
- Draw the camera zone directly over the treated surface on the DVR tile.
- Set dwell threshold to 0 or 1 second so the alert fires on crossing.
- Set the armed time window to the hours the treated surface should be empty.
- Confirm the DVR layout overlays (clock, name strip, channel bug) are masked.
- Route delivery to a WhatsApp group actually monitored during armed hours.
- Test end-to-end latency. Target capture-to-WhatsApp under 15 seconds.
- Run a dry alert once a week. Measure the full sequence to staff response.
- After any triggered event, photograph the stain within 60 minutes if possible.
DVR and NVR brands this works on
Because the capture is the HDMI multiview signal, compatibility is at the recorder level. If your DVR has an HDMI port and you have a guard monitor connected, the inference path already exists.
Have visible powder. Want the alert that fits inside the 40-second window.
15-minute demo. We connect to a running DVR HDMI, draw a polygon over a test target, and show a pre_action_zone_entry event landing on WhatsApp with a thumbnail and an ISO timestamp, under 15 seconds from the test walk-through. That is the record that pairs with your visible dye.
Book a demo →Frequently asked questions
What is visible theft detection powder and how is it different from UV powder?
Visible theft detection powder is a brightly colored, slow-to-wash dye (typically fluorescent magenta, orange, or electric green) that transfers to hands and clothing on contact and stays visible in normal room light for hours to days. You do not need a UV flashlight to see it. Products in this category include SmartWater visible stains, Redweb/Redwebb dye-based stains, ForensiKit visible marker powder, banker dye packs, SpySite visible theft powder, and generic fluorescent security dye powders. The advantage over UV powder is immediate identification. The disadvantage, and the subject of this guide, is that the thief sees the stain too, which starts a countdown the moment they notice it.
What is the 40-second panic window?
In field reports from mailroom and tool-crib deployments, the typical interval between a thief first touching a brightly stained item and realizing they have transferred the color to their hand is roughly 15 to 45 seconds. Once noticed, the thief does not dwell. They bolt, they wipe frantically on their clothing, they drop the item back and try to leave unnoticed, or in a minority of cases they try to wash their hands on site. The useful upper bound for live intervention is around 40 seconds of dwell after contact. Past that, the stain is on the pants, the item is on the floor, and the evidence is already fragmenting. This is the window visible powder alone cannot help you with, because by the time someone reviews footage or checks the camera the next morning, the thief is three scenes downstream.
How does a pre-action zone entry event help?
Cyrano emits event.class = pre_action_zone_entry on the first frame a person's centroid crosses INTO the drawn polygon around the treated surface. Not on exit, not on dwell-timeout, on entry. That means the alert lands in WhatsApp with a tile thumbnail, zone name, and ISO timestamp before the thief has even touched the powder in most cases, and always before they have noticed the stain. Capture-to-WhatsApp latency is typically 5 to 15 seconds. Compare that to the 15 to 45 second stain-noticing window, and you have a usable intervention gap. During that gap, a front-desk attendant, a patrol officer, or a remote monitoring agent still has time to address, talk down, or dispatch while the stain, the hand, and the item are all in the same room.
Does visible powder not already solve the identification problem on its own?
It solves identification in a hypothetical future where the suspect is still in the building 15 minutes later. In practice, people who steal from mailrooms, tool cribs, and cash drawers leave quickly, and a visible stain accelerates the exit. You end up with powder on a pair of pants that is now three blocks away, unidentifiable on camera review because the person was in the room for 19 seconds and your recorder missed them. The powder is the ID tool. Getting your eyes on the tinted hand before the person leaves the building is a scheduling problem, and that scheduling problem is solved by a pre-action alert, not by more powder.
Can I use visible powder and UV powder together?
Yes, and this is increasingly common on multi-stage applications. Apply visible powder where the deterrence value is high and noticing-is-fine (mailroom inner shelf, obviously treated-looking copper racks). Apply UV-only powder where you want passive long-window evidence (keyed cash drawers, after-hours access to a treated panel). The zone entry event pairs with both. The visible powder flips the situation into a live intervention problem within the first minute. The UV powder remains as a forensic backstop for the cases that do get to the police report.
Do I have to replace my cameras or DVR?
No. Cyrano's capture point is the DVR or NVR's HDMI multiview output, the same signal that drives your existing guard monitor. That composite already has every camera on the recorder mosaiced into tiles. One HDMI tap gives inference access to every feed at once. Works on analog cameras, IP cameras, any DVR brand including Hikvision, Dahua, Lorex, Amcrest, Reolink, Uniview, Swann, Night Owl, Q-See, and their rebrands. Install on a running DVR is under 2 minutes: HDMI in, HDMI out to the monitor, network, power. Up to 25 tiles per unit. You do not touch camera firmware, you do not negotiate ONVIF, you do not coordinate credentials.
What does the actual event payload look like for a visible powder pairing?
Every zone entry event includes event.class (pre_action_zone_entry), property identifier, tile.label (camera name), zone name, entry_edge (which polygon edge was crossed, which tells you the approach direction), dwell_seconds so far at the moment of emission (often 1 or 2 when the alert is pre-contact), ISO 8601 timestamp with timezone offset to the second, a tile thumbnail URL (480x270 crop centered on the person), overlay_mask identifier (which DVR overlays were masked before inference, typically the clock, the camera name strip, and the channel bug), delivery channel (WhatsApp group), and latency_ms (capture-to-delivery). For a visible powder pairing, the entry_edge and the small dwell_seconds are the two fields that matter most, because together they prove the alert fired before the thief had any chance to react to the stain.
Where does this pairing earn its place versus cheaper alternatives?
Mailrooms and parcel lockers with recurring after-hours theft. Tool cribs and gang boxes on active jobsites. Cash drawers with shift-change skim problems. Transformer cages and HVAC condenser pads. Any setting where a small number of treated surfaces are touched by a small number of legitimate users inside defined hours, and where the current loss pattern is a recurring low-dollar theft nobody is closing. Visible powder alone gives you a stain to look at the next morning. Pairing it with a pre-action zone entry event turns the next-morning problem into a tonight problem, and a tonight problem is the only kind a patrol officer or front desk can actually resolve.
Is the pre-action alert accurate enough to act on without review?
The zone is drawn tightly around the treated surface. The dwell threshold for emission can be set to 0 seconds (fire on entry) or a short integer number of seconds for noisier scenes. The overlay_mask field records which DVR layout overlays were masked before inference so there is no ambiguity about the model triggering on a baked-in clock pixel. In practice, properties run an arming window (for example 19:00 to 06:00 on a mailroom shelf, or shift-change windows on a cash drawer) so the zone only emits during hours the treated surface should be empty. Combined, the precision is high enough that a WhatsApp alert is the right place to land, not a ticketing queue.
Worth saying plainly
Visible theft detection powder is a good product used for the wrong reason by most of the people who buy it. It is not a passive identifier. It is a starting gun. From the second the thief sees the stain, everything they do is optimized for exit, and the evidence you thought you had is about to walk out the door with them.
The fix is not more powder, stronger colors, or faster wash-resistance. The fix is being notified, reliably, inside the first 15 seconds of the thief's own panic timeline. That notification requires inference on every camera, a polygon drawn tightly over the treated surface, an emission rule that fires on crossing rather than on dwell timeout, and a delivery path that reaches staff before the stain reaches the pants. Cyrano is that path, on the DVR you already own.
Pair the powder with the clock. Visible dye tells a court what was touched. The pre-action zone entry event tells staff when to walk in, and tells a court when the touch happened. Neither closes cases alone. Paired, they close them during the minute where the outcome is still on the table.
Under 0s
Typical capture-to-WhatsApp latency for a pre_action_zone_entry event. Inside the window where the stain is still on the hand and the item is still in the room.
Comments (••)
Leave a comment to see what others are saying.Public and anonymous. No signup.