IntelliSee AI perimeter detection overlay on data center exterior camera showing rooftop access approach
File #011 — Data Centers
Data Centers — Rooftop Intrusion

Badge Access Secures Doors.
AI Secures Everything Else.

A Tier III colocation data center in the Southeast addressed the physical access vectors that a professional penetration test had identified — rooftop intrusion and perimeter boundary breaches that bypassed the badge system entirely — using 34 existing exterior cameras and zero new hardware.

Tier IIIFacility Certification
3Pen-Test Vectors Closed
34Cameras Repurposed
$0New Hardware
3Physical Intrusion Vectors — All Closed
A professional physical penetration test had identified three rooftop and perimeter access vectors that bypassed the badge system entirely. All three were brought under automated real-time detection coverage without new cameras, new infrastructure, or access control modification.
Data Center / Colocation
Rooftop Intrusion Detection
Perimeter Control
Southeast, USA
2025
The Threat Landscape

The Penetration Test Found What Badge Access Couldn't See.

Data centers invest heavily in logical access security — multi-factor authentication, biometric verification, mantrap vestibules. These controls govern every door. They govern nothing above the roofline. A professional physical penetration test commissioned by the facility's security team identified three access vectors that bypassed the badge system entirely: a rooftop access ladder reachable from an adjacent HVAC service platform, a perimeter fence section with an unmonitored climb approach, and a maintenance hatch accessible with basic tools that was technically locked but physically vulnerable.

The concern was specific and documented: copper theft, cooling system interference, and in a colocation environment, the potential for physical media extraction from customer equipment bays. A rooftop intrusion that went undetected for 20 minutes in a Tier III facility could represent both physical infrastructure damage and a customer data exposure event with contractual and regulatory implications that extended far beyond the cost of the intrusion itself.

Before Deployment
3 rooftop access vectors identified by physical pen test — all unmonitored
Badge system governed doors only — no perimeter or rooftop coverage
Exterior cameras recorded rooftop zones — zero detection or alert capability
A 20-minute undetected rooftop intrusion could result in infrastructure damage or media extraction
No SOC alert pathway from any physical envelope camera
The Paradigm Shift

Reactive Surveillance vs. Proactive Safety

Before IntelliSee
Rooftop intrusion discovered when visible to interior staff or by chance
Perimeter breach detected during guard patrol — or at next check
No alert to SOC from exterior camera network
Incident investigated after access had already occurred
Customer notification triggered by discovered breach — not prevented breach
With IntelliSee
Every rooftop zone monitored continuously — any person detected triggers SOC alert
Perimeter approach flagged before breach completes
SOC receives alert with camera location and detection image in real time
Detection-to-response window opens before intruder reaches high-value areas
Zero breach escalation in monitored period
Deployment Record

Physical Envelope Coverage on Existing Exterior Infrastructure

IntelliSee was connected to all 34 exterior cameras — covering every rooftop access ladder, HVAC equipment platform, perimeter fence approach, and vehicle access checkpoint — without new hardware or network modification. Rooftop intrusion detection was configured as the primary alert class on all cameras with rooftop view; perimeter control on fence-line cameras; vehicle detection on after-hours loading dock approaches.

Alert routing integrated directly with the facility's existing SOC monitoring terminal and the on-duty physical security manager's device. Alert classification included camera location, zone designation, and detection image — giving SOC operators the context to initiate the appropriate response protocol without leaving the monitoring station for a visual confirmation.

Camera Zones Covered
Rooftop — North Surface
Rooftop — South Surface
HVAC Equipment Platform
Access Ladder Approaches (×3)
Perimeter Fence — East Boundary
Perimeter Fence — West Boundary
Loading Dock Approach (After-Hours)
Vehicle Entry Checkpoint
Active Detection Types
Rooftop Intrusion
Any person detected on or approaching rooftop surfaces, equipment platforms, or access ladders triggers immediate SOC alert
Perimeter Control
Individuals breaching or approaching the facility's perimeter boundary fence flagged in real time
Vehicle Detection
After-hours vehicle access to loading dock zone and service vehicle approach areas monitored autonomously
Detection Log — Verified Event Record
First Recorded Detection

North Rooftop Access Ladder. 1:22 AM. Saturday.

Timestamp
1:22:08 AM
Camera
CAM-31 — North Rooftop Ladder
Classification
ROOFTOP INTRUSION
Alert Sent
1:22:13 AM
Apprehension
On-Site — 1:38 AM

At 1:22 AM on a Saturday, Camera 31 detected a person ascending the north rooftop access ladder — one of the three vectors identified in the penetration test. The detection model classified the rooftop zone event and routed an alert to the SOC terminal in five seconds. The on-duty SOC manager confirmed the detection and contacted the physical security response team immediately.

The security team reached the rooftop access point at 1:38 AM — 16 minutes after the detection alert. The individual was a competitive intelligence operative hired to demonstrate rooftop access feasibility. They had reached the parapet but had not yet accessed the HVAC service platform that leads to the equipment bay roof. No infrastructure was accessed. No equipment was damaged. The subsequent security report cited the detection as validating both the pen test finding and the effectiveness of the AI monitoring deployment.

Event Metrics
5 secIntrusion to Alert
16 minAlert to Security Response
0Infrastructure Accessed
Documented Results

The Physical Gaps Badge Access Left Behind — Closed.

FirstRooftop Detection Capability in Facility History

The facility had never had automated rooftop monitoring capability. IntelliSee provided the first real-time alert system covering all identified rooftop access vectors, using cameras already installed for other purposes.

34Existing Cameras Repurposed

Every exterior camera was transformed from passive recording infrastructure into active detection. No new hardware. No installation window. No tenant notification required.

3 of 3Pen-Test Vectors Now Monitored

All three access vectors identified in the physical penetration test were brought under continuous automated detection coverage in a single deployment phase.

Intelligence Brief

Rooftop Intrusion Detection: How the Model Knows the Difference Between a Person and HVAC Movement

Rooftop environments are visually complex: HVAC units vibrate, fans rotate, birds land, and lighting conditions change dramatically across a 24-hour cycle. Standard motion detection in these environments produces a false positive rate that makes it operationally useless. IntelliSee's rooftop intrusion model does not detect motion — it detects the object class 'person' within defined spatial zones that correspond to rooftop surfaces, equipment platforms, and access ladder approaches.

This distinction is the operational difference between a system that generates 40 alerts per night and one that generates zero alerts on quiet nights and one alert when a person actually appears. The model is trained to distinguish a person from the visual background of a rooftop environment specifically — not generic outdoor motion detection repurposed for a roof application. For data center physical security, that precision is the threshold requirement for SOC deployment.

We had cameras on the roof for years. We just had no idea what they were seeing. Now we know within five seconds.
Physical Security Manager, Southeast Tier III Colocation Facility
Get Started

Your Cameras Are Watching
Every Surface of Your Facility.
Are You Listening?

We'll audit your existing exterior camera positions against your physical access vectors and show you exactly where detection coverage closes your remaining blind spots.