Why is Security Still Treating Every Sensor Alarm as Absolute Truth? Bayesian Logic Could Change That

Walk into almost any modern Security Operations Center (SOC) and you'll find sophisticated Physical Access Control Systems (PACS), Video Management Systems (VMS), intrusion detection systems, and increasingly, AI-enabled video analytics.  These systems generate enormous amounts of information. Door forced open alarms, motion detection, access denied events, video analytics, perimeter intrusion detection, and dozens of other alarm conditions.

Yet despite millions of dollars invested in security technology, most systems still operate using surprisingly primitive alarm processing logic:

Sensor alerts → An alarm is generated → A console operator must determine whether it matters.

The problem isn't necessarily the sensors. It's how we're interpreting the information they provide. A recent How-To Geek article about Home Assistant presence detection discussed an interesting solution to unreliable sensors: Bayesian probability. While the article focused on determining whether someone is home, the underlying concept has much broader implications for commercial and industrial physical security systems. In fact, Bayesian sensor logic could fundamentally improve how PACS and VMS platforms process, correlate, and prioritize security alarms.

1. The Problem: Security Systems Have Plenty of Sensors but Very Little Intelligence

Consider a typical commercial facility with 150 access-controlled doors and 300 surveillance cameras.

The access control system monitors:

• Door position switches
• Request-to-exit (REX) devices
• Credential transactions
• Electric lock status
• Door-held-open and door-forced-open conditions
• Intrusion alarm inputs

Meanwhile, the VMS monitors:

• Video motion detection
• AI object classifications
• People and vehicle detection
• Line-crossing events
• Loitering
• Camera tampering
• Video loss

Each system independently processes its own alarms. A door position switch reports an unauthorized opening, and the access control system generates an alarm. A camera detects motion near the same door, and the VMS generates another alarm. An AI video analytic detects a person in the doorway and generates yet another alarm. The operator might receive three separate events describing what is actually one incident. More importantly, the systems often fail to recognize that these three observations are related.

We've spent decades integrating cameras with access-controlled doors so operators can retrieve associated video. But displaying video when a door alarm occurs isn't the same thing as intelligently analyzing the combined sensor information. We need to move beyond alarm integration and toward evidence-based alarm adjudication.

2. Understanding Bayesian Sensor Logic

Bayesian inference is a mathematical method for updating the probability of an event as additional evidence becomes available. Rather than treating a sensor as either TRUE or FALSE, Bayesian logic evaluates how much each observation changes the probability of a particular condition.

For example, suppose we want to determine whether an unauthorized person has entered a secured electrical substation. Several sources of information might be available:

A conventional alarm system might generate three or four independent alarms. A Bayesian alarm processor would instead evaluate all of these observations to estimate the probability that an unauthorized entry has occurred.

The underlying concept is Bayes' theorem:

P(H|E) = [P(E|H) × P(H)] / P(E)

Where:

• H = Hypothesis, such as an unauthorized intrusion
• E = Observed evidence from sensors
• P(H) = Prior probability of the hypothesis
• P(E|H) = Likelihood of observing the evidence if the hypothesis is true
• P(H|E) = Updated probability after evaluating the evidence

As additional observations arrive, the system can update its assessment. The result is potentially much more useful than an individual alarm from a door contact or motion sensor. An important distinction: a sensor's reported 95% confidence that an object is a person does not automatically mean there's a 95% probability of an intrusion. Those are two different probabilities.

A properly designed Bayesian processor must account for sensor accuracy, site conditions, event frequency, and the relationship between different observations.

3. A Practical Example: Door Forced Open at an Electrical Substation

Let's consider a remote electrical substation that generates frequent nuisance alarms. High winds occasionally cause an improperly adjusted door contact to change state. Wildlife triggers exterior motion detection. Technicians sometimes access the building during unusual hours. Currently, every event might require evaluation by a security operator.

Now consider two different scenarios.

Scenario A: Probable Nuisance Alarm

At 2:15 AM:

1. The exterior door contact briefly changes state.
2. The access control system reports a door-forced-open alarm.
3. No person is detected by the adjacent camera.
4. No interior motion detector activates.
5. The door contact returns to its normal state after one second.

A conventional PACS immediately generates a door-forced-open alarm. A Bayesian processor examines the combined evidence and may determine that unauthorized entry is unlikely. The event remains recorded, but depending on the facility's security requirements, it could be classified as a lower-priority alarm requiring routine review.

Scenario B: Probable Unauthorized Entry

At 2:15 AM:

1. The door contact changes state.
2. No authorized credential transaction exists.
3. The camera detects a person approaching the door.
4. Video analytics observe the individual entering.
5. An interior motion detector activates.
6. No maintenance personnel are scheduled to be on site.

Now the system has several mutually reinforcing observations. The probability of unauthorized entry should increase substantially, assuming the underlying sensor models are properly calibrated.  Instead of generating multiple unrelated alarms, the security system could present one consolidated incident:

Probable Unauthorized Entry — Park Place Substation Door 1425 — High Priority

The operator receives the supporting sensor data, relevant video clips, and a recommended response procedure.

That's a far more useful security alarm than simply reporting that Door 1425 is open.

4. Bayesian Logic Is Not the Same as Conventional Alarm Correlation

Some manufacturers already offer alarm correlation, conditional logic, and event filtering.

For example:

IF door forced open AND motion detected within 10 seconds, THEN generate a high-priority alarm.

That is useful, but it's still deterministic rule processing. Bayesian logic goes further by allowing different observations to contribute different amounts of evidence.  A video analytic identifying a person might increase the likelihood of intrusion, while a valid access grant within the appropriate time window might substantially decrease it.  Evidence doesn't necessarily have to occur simultaneously. Event sequences, timing, sensor reliability, and historical operating conditions can influence the assessment.

There is also an important statistical limitation.  If two cameras observe the same person, those observations aren't necessarily independent. Likewise, two alarms derived from the same video analytic shouldn't be treated as independent confirmation.  A poorly designed Bayesian system could become dangerously overconfident by counting essentially the same evidence multiple times. Manufacturers need probabilistic models that account for these dependencies, rather than simply multiplying confidence scores together.

5. Where PACS and VMS Manufacturers Should Be Going

I believe the next generation of enterprise physical security platforms should incorporate a probabilistic alarm assessment engine. This functionality could reside within the PACS, VMS, a Physical Security Information Management (PSIM) system, or an independent software service. Ideally, it should be available through standardized APIs and event interfaces rather than requiring every subsystem to come from the same manufacturer.

The architecture would look something like this:

Sensor Inputs → Event Normalization → Bayesian Evidence Evaluation → Risk-Based Prioritization → Operator Response

The platform would collect observations from access control, video analytics, intrusion detection, and other security devices. It would then normalize those observations around common attributes, such as location, timestamp, associated device, and event type. A probabilistic evaluation engine would calculate the likelihood of specific conditions, such as unauthorized entry, tailgating, perimeter intrusion, or suspicious occupancy.

The resulting assessment could be used to prioritize alarms and determine the appropriate operator workflow.

Some examples include:

Tailgating Detection: A single valid credential transaction, two independently verified persons entering through the doorway, and a door cycle could support a probable tailgating event.

Perimeter Intrusion: Fence vibration, thermal camera detection, and a person crossing a restricted boundary provide stronger evidence together than any individual sensor.

After-Hours Occupancy: Interior motion detection, a door opening, and video-confirmed human presence can be evaluated against access records and operating schedules.

Camera Tampering: Video obstruction, camera movement, unusual scene changes, and a nearby intrusion detection event may indicate deliberate interference rather than equipment malfunction.

Security Device Failures: Repeated door alarms combined with unstable communications and no supporting physical activity could indicate an equipment problem instead of an actual intrusion.

In each case, the objective is not simply detecting more events.

It's determining which events actually deserve a security operator's attention.

6. AI and Bayesian Logic Should Complement Each Other

Artificial intelligence is already being deployed throughout video surveillance systems.  Modern video analytics can identify people, vehicles, weapons, and other objects with varying degrees of accuracy.  Large Vision Language Models (VLMs) can examine video frames and provide contextual descriptions of observed activity.

However, AI-generated confidence scores are not inherently calibrated probabilities of a security incident. A camera may identify a person with 98% confidence, but that doesn't establish that the person represents a threat. This is where Bayesian reasoning becomes particularly valuable. The AI provides observations about what is happening in the scene. The Bayesian processor evaluates those observations against additional evidence and determines how strongly they support a specific security hypothesis.

For example:

• AI reports a person entering a restricted area.
• PACS reports no authorized access grant.
• The facility schedule indicates the area should be unoccupied.
• A second sensor confirms movement beyond the entry point.

The system can evaluate all four pieces of evidence before recommending an escalation. This approach combines the perception capabilities of AI with structured probabilistic reasoning.  It also creates an opportunity for feedback-based improvement.  Security operators could classify reviewed incidents as confirmed, benign, equipment-related, or inconclusive. Those outcomes could improve the calibration of the alarm processing engine over time.

Importantly, adjusting the Bayesian alarm model does not necessarily require retraining the underlying video AI models.

7. The Critical Limitation: Probabilities Must Not Override Mandatory Security Functions

There is an important distinction between using probabilities to prioritize alarms and using them to control security functions. We would not recommend allowing a Bayesian processor to independently suppress mandatory security alarms (Duress, Smoke Detector, etc), unlock secured doors, disable intrusion detection, or alter fire and life-safety functions.

Likewise, a high-consequence alarm at a nuclear facility, electrical generating station, or critical data center may require immediate notification regardless of the calculated probability.  A Bayesian system should supplement—not replace—deterministic access-control rules, life-safety requirements, regulatory obligations, and established response procedures.

Missing, degraded, or tampered sensors should also never be interpreted as evidence that an area is secure.  A camera that has lost communications cannot confirm the absence of an intruder.  In many cases, missing information should increase uncertainty and trigger a separate equipment or security-integrity alarm.  But again, here Bayesian logic system could be used to automatically generate a trouble ticket for unscheduled maintenance via an API in a platform like ServiceNow.

Manufacturers must also address model validation, false-negative performance, cybersecurity, audit logging, and the ability to explain why an alarm received a particular classification. The purpose is to improve human decision-making, not create an unaccountable black box that quietly decides which security incidents can be ignored.

8. What Should Security Consultants Be Asking Manufacturers?

As part of a security system evaluation or competitive procurement, consultants should begin asking manufacturers more sophisticated questions about alarm processing capabilities.

For example:

1. Can your system combine PACS, VMS, and intrusion detection observations into a single incident assessment?
2. Does it support probabilistic event evaluation, or only conventional Boolean alarm rules?
3. Can individual sensor reliability and detection accuracy be incorporated into the assessment?
4. Does the system account for correlated sensor observations and prevent duplicate evidence from artificially increasing confidence?
5. Can alarm classifications be refined using verified operator dispositions?
6. Does it provide an auditable explanation of how an event was classified?
7. What happens when sensors become unavailable, communications fail, or event data arrives late?
8. Can the system prioritize alarms without compromising mandatory alarm notification or life-safety functions?

We should also insist on measurable performance.

Manufacturers should be able to demonstrate actual false-alarm reduction, incident detection rates, alarm latency, and performance under sensor-failure conditions.  A vendor claiming that its system is 99% accurate means very little without explaining what that number measures.  An algorithm that correctly dismisses thousands of benign events but misses a rare, serious intrusion might demonstrate impressive overall accuracy while still being unacceptable for physical security applications.

9. The Real Opportunity: Better Security Operations, Not Just More Technology

Security systems have become extremely good at collecting information. Unfortunately, we've done a considerably poorer job of turning that information into actionable intelligence. Many SOCs already struggle with the volume of alarms generated by existing systems. As AI video analytics become more prevalent, that problem may actually get worse. Adding hundreds of intelligent cameras doesn't necessarily make an organization more secure if the resulting alarm volume overwhelms the operators responsible for evaluating the information. Bayesian evidence evaluation offers a logical path toward a more intelligent alarm-processing architecture. Instead of asking whether an individual sensor has triggered, the system begins asking a much more useful question:

Given everything we currently know, how likely is it that a specific security incident is actually occurring?

That's a fundamental change in how we approach physical security monitoring. And frankly, it's a capability that sophisticated enterprise PACS and VMS platforms should have begun developing years ago.

Conclusion: It's Time to Move Beyond Binary Alarm Processing

The physical security industry has invested heavily in higher-resolution cameras, intelligent video analytics, mobile credentials, cloud platforms, and increasingly powerful AI models. Yet the basic alarm-handling architecture of many commercial security systems remains remarkably similar to what we used decades ago.

A contact opens. A relay changes state. An alarm appears on a screen.

Bayesian sensor logic provides an opportunity to move beyond that model by combining multiple observations, recognizing uncertainty, and producing better-informed incident assessments. It won't eliminate false alarms, and it certainly won't eliminate the need for trained security operators. But properly implemented, it could reduce nuisance alarm traffic, improve operator situational awareness, and make better use of the substantial investments organizations have already made in electronic security technology.

The next major improvement in physical security may not come from installing another sensor. It may come from finally teaching our systems how to intelligently interpret the sensors we already have.