Operational AI / Security investigations
How AI can help investigate unauthorised access
An investigation is not a search for a convincing narrative. It is a process of establishing what happened, using evidence from systems that rarely tell the whole story on their own.
A sighting in an executive boardroom
An individual who should not have been in an executive boardroom has reportedly been seen there. Senior management wants to know who entered, how they gained access, where they went and whether there is an ongoing risk.
The questions are straightforward. The evidence is not. Security may have a witness report, access-control events, visitor records, CCTV footage and relevant procedures. Each records a different part of the story, and none should be treated as conclusive on its own.
The investigation starts with a reported sighting, not a proven identity or an established route.
What each system can tell us
The investigator needs a coherent account of the incident. The information available is distributed across different operational records.
| Source | What it records | What still needs establishing |
|---|---|---|
| Incident report | A sighting, time, place and witness account | Accuracy of the account and the precise event window |
| Access control | Credential activity at controlled doors | Whether the named holder was the person passing through |
| CCTV | Footage at covered locations and times | What the footage actually shows, confirmed by human review |
| Visitor records | Expected visitors, hosts, arrival and departure records | Whether entries correspond to the observed movements |
| Procedures | Approved rules for access, escorting and incident response | Whether the events complied with the rules in force |
| Footfall or occupancy | Counts or movement indicators where available | Whether an anomaly merits further investigation, not an identity |
From scattered events to a defensible timeline
AI can help identify relevant records, reconcile timestamps, compare accounts and surface contradictions. It can also narrow the time windows for a human investigator to examine in CCTV.
The system should keep each finding connected to its source and distinguish recorded events, plausible interpretations and verified conclusions. The human investigator retains responsibility for confirming footage, assessing credibility and deciding on escalation.
Illustrative investigation sequence
Where AI helps, and where it must stop
Much of the time in an investigation can be consumed by locating records, comparing timestamps and assembling a chronology. These are useful places for a controlled AI workflow to help.
But an apparent match is not a finding. Clock drift, incomplete coverage, shared or temporary cards, tailgating and inconsistent record keeping can all make an initial hypothesis misleading.
AI-supported work: retrieve relevant events, identify inconsistencies, propose a sequence, locate supporting procedures and prepare reviewable evidence.
Human responsibilities: inspect CCTV, challenge assumptions, verify identities where appropriate, judge significance, approve conclusions and decide any consequential response.
Evidence from a separate unauthorised-access sprint
In a separate SIRV sprint involving access-control event reconciliation and human CCTV verification, the evaluation produced encouraging results. This was not the fictional boardroom investigation described above.
Sprint findings from a bounded evaluation. Timing figures are estimates based on an average case, including human CCTV review and final verification. They should not be generalised to every access investigation or treated as independently validated production benchmarks. The percentage relates to valid cases found in the evaluated sample, not a universal detection rate.
Privacy and governance are part of the investigation
Access-control records, visitor details and identifiable CCTV can contain personal data. Investigations need an appropriate lawful basis, purpose limitation, proportionate access, suitable retention and controls over disclosure. They also need clear rules for when a person, rather than the system, reviews identifiable footage.
A controlled workflow should minimise unnecessary personal data, protect source material, record who accessed it and preserve the evidence underlying findings. Whether a DPIA is required should be assessed for the proposed processing and its risks, rather than assumed from the existence of CCTV alone.
Relevant external guidance includes the NPSA CCTV guidance, NPSA access-control guidance and the ICO's video surveillance guidance.
Unauthorised-access investigation checklist
The practical test is whether another authorised reviewer could reconstruct the investigation from the retained record.
What was reported, by whom, when, and with what uncertainty?
Which sites, doors, cameras and time periods are relevant?
Are exports, clock assumptions and original references retained?
Are unusual swipes, temporary cards and shared credentials considered?
Have relevant clips been checked by an authorised investigator?
Could an escort, visitor or timing mismatch explain the sequence?
Which access and escalation rules were in force?
Can reviewers distinguish facts, inferences, gaps and final judgements?
What a useful investigation output looks like
The goal is not a longer report. It is a defensible account: a timeline with source references, what is verified, what is disputed or unknown, who reviewed the evidence and which follow-up decisions remain open.
AI can accelerate the assembly of evidence. Accountability remains with the people who verify it and act on it.
Sources and further guidance
Could an investigation workflow be better controlled?
SIRV AI helps safety, security and resilience teams connect approved operational information, support investigation workflows and retain a clear record of evidence, review and decisions.
Discuss a workflow
