An unauthorized person entering a Manhattan office, residential property, hotel, retail location, or construction site does not automatically present a threat. But uncertainty can escalate quickly when the person bypasses access controls, refuses to identify their destination, enters a restricted area, or behaves aggressively.
The first five minutes should be guided by a clear principle: protect people first while gathering and communicating accurate information. Security personnel should follow the property’s post orders and emergency procedures, avoid unnecessary confrontation, and request police assistance when circumstances warrant it.
These time labels are a training outline, not waiting periods. Call 911 promptly whenever an emergency arises.
Before the Clock Starts: Define “Unauthorized”
A person may appear out of place without actually being unauthorized. They could be a new employee, delivery worker, contractor, visitor, resident’s guest, or someone who entered through the wrong door.
Security decisions should be based on observable access facts and behavior—not appearance, identity, disability, language, or assumptions. Relevant indicators can include:
- Entering through a restricted or staff-only door
- Following an authorized person through a controlled entrance without presenting credentials
- Using an expired, invalid, or mismatched credential
- Refusing to check in or identify a host when site policy requires it
- Attempting to access tenant floors, mechanical areas, loading docks, roofs, or other controlled spaces
- Remaining in the building after being advised that access cannot be verified
- Making threats, displaying a weapon, or acting in a way that creates an immediate safety concern
Properties should define these conditions in written post orders so guards, lobby staff, and managers respond consistently.
Minute 0–1: Observe and Maintain a Safe Distance
The first responder should pause long enough to assess what is happening before approaching. Rushing into close contact can reduce reaction time and make a manageable situation more dangerous.
Observe and remember:
- The person’s current location and direction of travel
- Clothing and other objective identifying details
- Whether the person is alone
- What door, turnstile, elevator, or stairwell they used
- Whether they appear to have a weapon
- Any statements, threats, or unusual actions
- Whether occupants are nearby or directly at risk
Maintain a safe distance and avoid blocking the person into a confined space. Do not attempt physical contact merely because access has not been confirmed. Physical intervention presents substantial safety and liability concerns and should be governed by training, site policy, and the immediate threat conditions.
If the person has a weapon, makes a credible threat, or is actively attacking someone, move away when possible, warn others, and call 911 as soon as it is safe to do so.
Minute 1–2: Notify the Security Desk
Before or during any safe verbal engagement, notify the security desk, supervisor, or designated building contact. Early notification allows another team member to monitor cameras, check credentials, control access points, and call for assistance.
A useful radio message is brief and factual:
“Possible unauthorized person in the east lobby near Elevator Bank B. Adult wearing a gray jacket and carrying a black backpack. Access has not been verified. No weapon observed. I am maintaining visual contact from a distance.”
Avoid vague or inflammatory labels such as “criminal,” “dangerous,” or “trespasser” unless the facts support that description. If your radio channel is not private, do not broadcast unnecessary personal information.
The security desk should acknowledge the message and begin a coordinated response. Depending on the property’s procedures, that may include:
- Reviewing live camera views
- Checking the visitor management or access-control system
- Contacting the claimed host, tenant, resident, or contractor supervisor
- Sending a second trained officer
- Alerting property management
- Positioning staff near occupied or sensitive areas without creating a confrontation
A well-staffed commercial office security program should establish these roles before an incident occurs.
Minute 2–3: Use Calm Verbal Engagement When Safe
If there is no immediate threat and the responder has been trained to engage, use a calm, professional greeting from a safe position.
Possible opening language includes:
“Good afternoon. I’m with building security. How may I help you?”
Follow with neutral questions appropriate to the property’s access procedure:
- “Who are you here to see?”
- “Which company or unit are you visiting?”
- “May I help you check in at the security desk?”
- “This area requires authorization. Please return with me to the lobby so we can verify your visit.”
Use simple directions and allow the person time to respond. Avoid insults, accusations, shouting, or statements designed to provoke compliance through fear. Do not make promises about consequences that security personnel cannot control.
If the person cooperates, escort or direct them to the designated check-in point according to site policy. If they refuse, maintain distance, update the desk, and avoid turning a refusal into a physical contest.
Minute 3–4: Protect Occupants and Control Exposure
While one responder maintains observation, other personnel should reduce occupants’ exposure to the situation. The right actions depend on the location, building design, and behavior involved.
Reasonable measures may include:
- Redirecting occupants to another entrance, elevator bank, or corridor
- Keeping people away from the immediate area
- Securing doors to sensitive rooms when this can be done safely
- Pausing visitor entry at the affected access point
- Advising reception, loading-dock, or tenant security personnel
- Moving a targeted individual to a secure location
- Using established shelter-in-place, evacuation, or lockdown procedures if the circumstances meet the property’s criteria
Do not initiate a broad evacuation or lockdown casually. These actions can create additional risks in a dense NYC building and should follow the property’s emergency plan and designated authority structure whenever circumstances permit.
When security staffing is limited, an incident can expose gaps at entrances and occupied posts. Property managers should plan in advance for relief personnel and emergency security coverage.
Throughout the Response: Escalate Emergencies Immediately
Call 911 for an emergency requiring immediate police, fire, or medical response. Examples include:
- A weapon is seen or credibly reported
- The person threatens or attacks someone
- Forced entry is occurring or has just occurred
- The person is attempting to reach occupants who may be in danger
- There is an immediate risk of serious property damage
- The person’s behavior creates an urgent safety or medical concern
When speaking with a 911 dispatcher, provide the building’s complete address, entrance or floor, a factual description, current location, direction of travel, known weapons, injuries, and the best point of contact. Follow the dispatcher’s instructions. Assign someone to meet responding officers when safe, while ensuring that critical entrances are not left unattended.
For a non-emergency refusal to leave or suspected unauthorized access, follow the property’s escalation procedures and management direction. Police involvement should reflect the facts, not frustration or assumptions. If conditions change, update responders promptly.
Security personnel should not pursue someone into a street, subway entrance, neighboring property, stairwell, or other uncontrolled area unless their training, post orders, and immediate safety conditions clearly support that action. Continue observing from a safe position and report the person’s direction of travel.
Immediately Afterward: Preserve Video and Access Records
Once people are safe and the situation is stable, preserve relevant evidence before routine system settings overwrite it.
The security desk or authorized system administrator should identify and retain:
- Video from entrances, elevators, stairwells, corridors, loading docks, and exterior cameras
- Access-control events, including denied entries and door alarms
- Visitor management records
- Intercom or security desk call records, when available and lawfully maintained
- Dispatch, radio, and supervisor logs
- Photographs of damaged doors, locks, or other physical evidence
Preserve footage from a reasonable period before, during, and after the incident. The earlier footage may show how the person entered, whether someone admitted them, and where they traveled before being noticed.
Use the system’s native export method when possible, retain the original file, and limit access to authorized personnel. Record who exported or received the material, when it was handled, and where it was stored. Do not circulate incident video through personal messaging accounts or post it publicly.
Write an Objective Incident Report
The report should allow a manager or investigator who was not present to understand what occurred. Complete it promptly while details are fresh, but do not guess when information is unknown.
Include:
- Date, time, and exact location
- How the incident was first observed or reported
- Objective identifying details
- The person’s actions and direction of travel
- Access point or credential involved
- Questions asked and instructions given
- Exact quotes for significant statements or threats
- Notifications made and their times
- Measures taken to protect occupants
- Police, fire, or EMS response details, if applicable
- Witness names and contact details when properly collected
- Camera numbers, video time ranges, and evidence preserved
- Property damage or reported injuries
- Final disposition, including whether access was verified or the person left
Separate direct observations from information provided by others. For example:
- Direct observation: “I saw the individual pull the east stairwell door three times.”
- Reported information: “A tenant employee told me the individual had entered behind another person.”
Avoid unsupported conclusions such as “the subject intended to steal” or “the person was intoxicated.” Describe the behavior instead: “The individual spoke slowly, lost balance twice, and leaned against the wall.”
If a detail is uncertain, say so. Accuracy is more valuable than false precision.
Build the Procedure Into Daily Operations
An effective response depends on preparation rather than improvisation. Property managers should review whether their security program includes:
- A written definition of unauthorized access for each post
- Current escalation and notification lists
- Radio protocols and plain-language location names
- Safe verbal-engagement training
- Procedures for protecting occupants without abandoning critical posts
- Clear criteria for emergency notifications
- Camera maps and video-export instructions
- Standard incident report forms
- Regular scenario drills and post-order reviews
Professional security guards should understand both the limits and responsibilities of their assigned role. The same response will not fit every Manhattan property, so procedures should reflect the building’s entrances, tenant population, operating hours, technology, and known risks.
Review Your Building’s First-Five-Minute Plan
Guardian ISI can help Manhattan property teams evaluate guard coverage, post orders, escalation procedures, and incident documentation. For scheduled or urgent security coverage, call or text (212) 602-1695 or request coverage online.
Related Guardian services
Review Security Guard Services and Commercial Office Security to connect these procedures with the appropriate staffing and site responsibilities.
Frequently asked questions
Should a security guard immediately approach an unauthorized person?
Not always. The guard should first assess the person’s behavior, maintain a safe distance, notify the security desk, and follow site procedures. If a weapon or immediate threat is present, the priority is protecting people and calling 911 when safe.
When should building security call 911?
Call 911 when immediate police, fire, or medical assistance is needed, such as when a weapon is present, threats or violence occur, forced entry is underway, someone is injured, or occupants face an urgent danger.
What should security say to a person whose access cannot be verified?
Use calm, neutral language, such as: “I’m with building security. How may I help you?” The guard can then ask who the person is visiting and direct them to the required check-in location.
How should an NYC building preserve surveillance video after an incident?
Authorized personnel should preserve relevant footage from before, during, and after the incident using the system’s native export process when possible. Retain the original file, document who handled it, and restrict access.
What makes a security incident report objective?
An objective report records times, locations, observable actions, significant exact quotes, notifications, evidence, and outcomes. It separates firsthand observations from witness statements and avoids speculation about intent or condition.
Should security follow an unauthorized person after they leave the building?
Security should generally avoid pursuing a person into uncontrolled areas when doing so could create additional danger. Staff can observe from a safe position, report the direction of travel, preserve video, and follow post orders and police instructions.