Every security budget now faces the same question, usually asked by someone in finance: if the cameras have AI, and the system sends alerts, and a monitoring center watches the feeds — how many officers do we actually need on site?
It is a fair question, and it deserves a better answer than reflexive defense of the status quo. The honest answer is that the technology has become genuinely good, that it has changed what officers spend their time doing, and that it has not replaced them — for a reason that has nothing to do with tradition and everything to do with what these systems are actually built to do.
Detection systems detect. They do not decide, and they do not act.
Start with what the technology does well
Any serious argument here has to begin by conceding how much has changed, because a great deal has.
Modern video analytics reliably flag loitering, perimeter breaches, crowd density, objects left behind, and vehicles where they shouldn’t be. Access control platforms produce a clean audit trail of every credential presented at every door. Remote monitoring lets a single operator maintain awareness across dozens of sites at hours when staffing every one of them would be indefensible. Mobile reporting puts time-stamped, photo-supported documentation in a client’s inbox before the shift ends.
These are real capabilities, and organizations that skip them are leaving protection on the table. Integrated security technology has made coverage broader, documentation better, and response faster than it was a decade ago.
What none of it does is close the loop.
The gap between detection and decision
An alert is a statement that something unusual occurred. It is not an assessment of what the thing means, and it is not a response.
Consider a genuinely ordinary scenario. At 6:40 p.m., a camera flags two people entering a controlled door on one badge presentation. The system has done its job perfectly. Now something has to happen — and what should happen depends entirely on facts the system does not have.
If it’s a contractor whose credential was deactivated that morning by an HR process nobody told security about, the correct response is to verify and reissue. If it’s an employee from a floor they don’t normally work on, the correct response is a friendly check and a note in the log. If it’s a terminated employee returning to collect something they believe is theirs, the correct response is very different and time-sensitive. If it’s someone conducting a walkthrough for a later theft, the correct response is different again.
Four situations, one alert, four appropriate outcomes — and the cost of choosing wrong runs in both directions. Treat a legitimate visitor as a threat and you have an incident with a client’s guest. Treat a threat as a legitimate visitor and you have an incident of a much more serious kind.
That judgment is the job. It requires reading a person’s demeanor, knowing the building’s normal rhythms, recognizing who works there, and calibrating a response in the seconds available. It is also the same instinct that defeats social engineering — the confident stranger in a high-visibility vest gets past a camera every time, and gets stopped by someone who has learned to ask one more question.
The standards already settled this
This is not merely a vendor’s opinion. It is written into the control catalog that underpins most enterprise and federal security programs.
NIST Special Publication 800-53, Revision 5, includes PE-3(8), Access Control Vestibules — the control that addresses unauthorized entry through a controlled door. Its guidance describes how the control may be satisfied: interlocking door controllers “can be fully automated (i.e., controlling the opening and closing of the doors) or partially automated (i.e., using security guards to control the number of individuals entering the containment area).”
The standard treats trained personnel as a valid implementation of the control — one of two recognized ways to satisfy it, not a concession or a fallback.
The same control family goes further. PE-3(3) addresses continuous guard coverage as its own named control. PE-6 covers monitoring physical access. PE-8 covers visitor access records. NIST SP 800-116 Rev. 1 applies a risk-based approach to credential authentication in facility access, recognizing that different entry points warrant different levels of assurance.
Taken together, the framework describes a layered model in which technology and personnel each cover what the other cannot. It does not describe a transition from one to the other.
The situations that only resolve in person
A meaningful share of what officers handle has no technological analogue at all, because the required output is a human being doing something.
Someone collapses in a lobby. A camera records it. An officer trained in first aid and AED use starts care and directs paramedics to the right entrance.
A domestic situation follows an employee to work. Analytics may flag an unfamiliar person at the perimeter. De-escalating it — calmly, without triggering the confrontation everyone is trying to avoid — is a trained human skill with no substitute.
A fire alarm sounds on a floor with visitors who don’t know the building. Someone has to move people toward the correct exit, check the areas people forget, and account for who came out.
A distressed patient in a healthcare setting needs to be managed in a way that protects staff without escalating a medical crisis into a security one. That is a judgment call informed by training, and getting it wrong has consequences in both directions.
These are not edge cases. Across specialized environments — healthcare, retail, industrial, commercial, residential — they are a routine part of the work, and they are the part clients remember.
The presence effect, and why remote coverage isn’t the same
Deterrence is the oldest argument for an officer, and it remains the least replicated by technology.
A camera deters someone who both notices it and believes it will lead to consequences. A person standing in a lobby who has already made eye contact deters at a different level, because the consequence is immediate and visible. Opportunistic crime — the majority of what most commercial properties actually face — is largely a calculation about friction and attention. A visible officer changes both variables in a way a housing on the ceiling does not.
There is a second effect that rarely appears in the budget conversation. For most visitors, the officer is the first employee of your organization they interact with. They give directions, sign for deliveries, help someone who is lost, and set the tone for the building. That is real value the line item doesn’t capture, and it disappears entirely when coverage moves off-site.
The model that actually works
The organizations that get the most from both are the ones that stop framing this as a choice.
Technology should be doing what humans do badly: watching a perimeter at 3 a.m. without lapse, maintaining a complete and tamper-evident audit trail, covering geography that would be uneconomical to staff, and surfacing anomalies out of data volumes no person could review.
Officers should be doing what systems cannot: interpreting ambiguous situations, intervening proportionately, responding physically, and exercising the discretion that keeps a minor issue from becoming a major one.
In practice this means fewer officers standing in low-value positions and more officers positioned where a decision might be needed, supported by systems that tell them where to look. That is a better program than either component alone, and it is usually a more efficient one — which is the honest answer to the question finance is asking.
The question to ask instead
“How many officers can technology let us cut?” is the wrong question, because it optimizes for the wrong variable.
The better one: when your system generates an alert at 2 a.m., what happens next, and how long does it take? If the answer involves someone off-site deciding whether to call someone else, you have detection without response — and you will discover the difference during the incident that matters, not before it.
St. Moritz Security Services has protected commercial, healthcare, residential, retail, and industrial environments since 1982, combining professionally trained security officers with integrated security technology. To discuss the right balance for your facility, request a consultation.
Frequently Asked Questions
Can AI and security cameras replace security guards?
No. Video analytics and access control systems are detection tools — they identify that something occurred and generate an alert. They do not assess intent, exercise discretion, or respond physically. NIST SP 800-53 continues to recognize trained security personnel as a valid implementation of physical access controls, alongside automated systems.
What is the difference between remote monitoring and on-site security officers?
Remote monitoring provides observation and documentation across multiple sites cost-effectively. On-site officers provide immediate physical response, de-escalation, medical assistance, and visible deterrence. Most effective programs use both, with technology extending coverage and officers positioned where a decision may be required.
What do professional security officers do beyond deterrence?
Access control and visitor verification, emergency response including first aid and evacuation, de-escalation of volatile situations, incident documentation, coordination with law enforcement and EMS, and serving as the first point of contact for visitors and staff.
How do security officers support cybersecurity?
Physical access is a precondition for many data breaches. Officers verifying unfamiliar people, enforcing visitor escort procedures, and preventing unauthorized entry are controlling an attack path that network security cannot reach — an intruder already inside the building bypasses most perimeter defenses.
Does adding security technology reduce the number of officers needed?
Sometimes it changes where officers are positioned rather than how many are required. Technology can eliminate low-value static posts and redirect coverage to points where judgment and response are needed. The right number depends on the facility’s risk profile, layout, and hours of operation.