Shopping Malls, Lifestyle Centers, and Mixed-Use Retail Properties: The 2026 AI Physical Security Sector Playbook for Property Management, Common-Area Security Directors, and REIT Risk Officers

In January 2026, the Indiana Supreme Court heard oral arguments in a lawsuit brought by survivors of the July 2022 mass shooting at Greenwood Park Mall, a case that turns on a question every shopping center owner in the country now has to answer: what does reasonable security look like in a space that no single business controls. The gunman entered the mall's food court carrying a backpack loaded with weapons, spent more than an hour inside before opening fire, and killed three people. Attorneys for Simon Property Group and its security contractor, Universal Protection Service, argue the attack could not have been foreseen. Attorneys for the survivors argue the opposite. The Indiana Supreme Court's ruling on whether the case can proceed will shape premises liability law for common-area security nationally, not just in Indiana.

This playbook is written for the people who own and operate that in-between space: property managers, common-area security directors, REIT risk officers, and asset managers responsible for enclosed malls, open-air lifestyle centers, and mixed-use retail properties. A shopping mall is not a big-box store with more tenants, and it is not an office tower with more foot traffic. It is a structurally distinct security problem: one owner is legally responsible for common areas that dozens of independent businesses share, no single tenant can secure the space on its own, and the crime, liability, and regulatory exposure that follow do not map cleanly onto either the retail loss-prevention playbook or the commercial office security playbook already written for those adjacent property types. This report covers the threat surface specific to multi-tenant retail properties, the regulatory doctrine that assigns responsibility across landlord and tenant, the AI detection architecture built for shared common areas, and the economic and liability case for property operators evaluating the technology in 2026.

Why a shopping mall is a different security problem than the stores inside it

The FBI's National Incident-Based Reporting System draws a formal line between a shopping mall and the stores inside it. Under NIBRS Data Element 9 (Location Type), a shopping mall is defined and coded separately from department stores, specialty stores, and parking facilities: a grouping of retail stores in one or more buildings having common ownership and shared maintenance, surrounded by or adjacent to a common parking facility, with the classification covering the mall's common areas but explicitly excluding the parking lots and the individual stores themselves. That distinction is not a reporting technicality. It reflects a genuine jurisdictional split that shapes who is responsible for what happens where.

Every individual retailer in a mall, from the anchor department store to the kiosk in the center court, controls and secures its own leased square footage. None of them controls the corridor outside its storefront, the food court, the atrium, the restrooms, the service corridors, or the entrances. That space belongs to the property owner or its management company, and the property owner cannot delegate its exposure there to any tenant's loss-prevention program no matter how well resourced that program is. A department store with strong detection technology at its own entrances still shares a mall corridor with forty other businesses that may have none, and the shooting, the assault, or the organized retail crime sweep that happens in that shared corridor is the landlord's problem regardless of which store's customer it was.

The federal government has already built a legal framework for exactly this kind of split-responsibility environment, and it comes from an unexpected source: OSHA's Multi-Employer Citation Policy. Under Directive CPL 02-00-124, OSHA's Multi-Employer Citation Policy, a controlling employer, defined as the party with general supervisory authority over a worksite and the power to correct hazards or require others to correct them, can be held responsible for conditions on a site even where its own employees are not directly exposed. OSHA's own guidance uses a shopping mall construction project as the illustrative example of how liability distributes between a general contractor and a subcontractor on a shared site. The same controlling-employer logic maps directly onto an operating mall: the property manager is the controlling party for the common areas, and individual tenants are analogous to the subcontractors responsible for their own leased space. A mall operator that has not systematically assessed and monitored its common areas is in a materially weaker position, both operationally and in any subsequent litigation, than one that has documented an active security program for the space it alone controls.

The 2026 threat surface: what is actually happening in America's shopping centers

Organized retail crime does not stop at a single storefront. When a transnational ORC group targets a mall, it typically hits multiple tenants during the same operation, moving through anchor stores and specialty retailers on a coordinated sweep before mall security or local law enforcement can respond to the first alarm. The National Retail Federation and the Loss Prevention Research Council, in the 2025 edition of their annual Impact of Retail Theft & Violence study, found that retailers reported an 18% increase in the average number of shoplifting incidents per year in 2024 versus 2023, and that threats or acts of violence during shoplifting or theft events increased 17% over the same period. Sixty-seven percent of retailers surveyed reported that a transnational organized retail crime group had been involved in thefts against their company in the past year. For a mall operator, that 67% figure is not an abstraction about the retail sector generally; it is a description of the criminal exposure landing on the majority of the businesses inside the property at once, in the same common areas the landlord alone is responsible for monitoring.

Violence in mall common areas has produced the kind of concrete, high-consequence incidents that drive the standard-of-care question. The Greenwood Park Mall shooting is the case now before the Indiana Supreme Court, but it is not an isolated data point. In September 2025, a shooting inside Augusta Mall in Georgia killed a 17-year-old and injured another person after a fistfight escalated into gunfire in a common area; local reporting from WRDW noted that security incidents at the property have recurred with some regularity since 2020, and the mall has faced prior litigation and settlements tied to earlier shootings. Mall security's own camera network played a documented role in that case, providing footage that helped investigators identify and arrest two suspects within hours, evidence of what active common-area monitoring can contribute even after an incident has already begun.

The Greenwood Park Mall litigation illustrates why the foreseeability question is now central to how courts, insurers, and property operators think about common-area risk. The plaintiffs' attorneys argue that mall ownership and its security contractor were negligent in failing to prevent a gunman from entering with a backpack full of weapons and spending over an hour inside before the attack. Defense attorneys argue the event was not foreseeable and that the claim should be dismissed on that basis. Whichever way the Indiana Supreme Court rules, the case has already put every mall operator in the country on notice that the standard for what constitutes reasonable common-area security is being actively litigated, not settled.

Live Detection Cam 12 — Loading Dock Perimeter

Actual IntelliSee detection output. A person detected outside authorized hours near a facility perimeter, with a visible bounding box and confidence score generated in real time. This is the same detection modality deployed at mall loading docks, service corridors, and rear perimeter fence lines, the exterior common areas a property manager controls but rarely staffs after closing. No facial recognition is used. No video is stored. An alert routes to security dispatch within seconds of detection.

The AI detection architecture for shared common areas

A deployment that treats mall common areas the same way a single retailer treats its sales floor misses the defining constraint of a multi-tenant property: the landlord's detection layer has to cover space that dozens of independent businesses share and none of them owns, without duplicating or conflicting with whatever detection each tenant separately runs inside its own leased footprint. That requires a zone-based architecture built around who actually controls each space and what threat pattern dominates there.

The architecture is deliberately landlord-scoped. IntelliSee's detection layer for common areas runs against the property's existing camera network through the on-site video management system, requires no camera replacement, and routes alerts to the mall's own security operations center or contracted guard force, independent of whatever detection technology any individual tenant separately deploys inside its own store. That separation matters operationally: a property manager does not need tenant cooperation, tenant camera access, or a shared technology vendor relationship with forty different businesses to secure the space the landlord alone is responsible for.

Data governance across landlord and tenant: the multi-tenant privacy question

Negligent security liability: the standard of care for common areas in 2026

Negligent security claims against property owners turn on foreseeability: did the owner know, or should it have known, that criminal activity presented a risk to lawful visitors, and did it fail to deploy reasonable countermeasures in response. For a single-tenant retailer, that analysis is bounded by the store's own incident history. For a mall operator, it is bounded by the incident history of the entire property, across every tenant's foot traffic, in space the landlord alone controls and cannot delegate. The Greenwood Park Mall case is being argued on exactly that foreseeability question, and whichever way the Indiana Supreme Court rules, the litigation itself is evidence that courts are actively recalibrating what reasonable common-area security looks like given the technology now available.

The International Council of Shopping Centers, the trade association representing shopping center owners and operators, has responded to the rise in organized retail crime and violent incidents by expanding its security training curriculum, including a Shopping Center Security Terrorism Awareness Training Program built with security professionals to help on-site personnel assess suspicious behavior and respond to criminal activity. That kind of trade-association response is itself part of the emerging standard-of-care picture: as more properties adopt structured threat-assessment training and active monitoring, the comparator group courts use to judge "reasonable" security shifts, and a property that has done neither is increasingly exposed relative to its peers.

Insurance underwriting is moving in parallel with the legal standard. Carriers pricing commercial general liability and excess liability coverage for retail properties are beginning to treat documented AI-assisted common-area monitoring as a factor in risk assessment, the same shift already underway in commercial office and parking-facility underwriting. For the full picture of how carriers are pricing this technology, see IntelliSee's 2026 Insurance Underwriting Market Intelligence Report.

Single-Tenant Retail Security vs. Multi-Tenant Mall Common-Area Security

Building the investment case for property operators

The business case for AI-assisted common-area detection rests on three connected variables. First, liability exposure: a documented, active monitoring program in the space the landlord alone controls is directly relevant to a negligent-security defense in a way that passive CCTV footage of an incident after the fact is not. Second, tenant retention: anchor and specialty retailers evaluate a property's common-area security posture as part of lease renewal decisions, particularly after a documented incident at a comparable property, and a mall that can point to an active detection program has a materially different retention conversation than one that cannot. Third, insurance cost: as carriers begin pricing AI-assisted monitoring into commercial liability underwriting, the properties that have already deployed it are positioned ahead of that pricing shift rather than reacting to it.

IntelliSee holds DHS SAFETY Act Full Designation as a Qualified Anti-Terrorism Technology. For mall operators, that designation provides direct liability protection under the Act in a terrorism-related event and is increasingly referenced in RFP language from institutional and government-adjacent tenants evaluating a property's security posture as part of a lease decision. For the full economic model, see IntelliSee's True Workplace Violence Cost framework and the Four-Variable ROI Framework for AI Physical Security.

Where to start: a common-area security assessment

The assessment process for a mall or lifestyle center begins with an incident-pattern audit scoped to the property as a whole rather than to any single tenant: a zone-by-zone review of prior incidents at entrances, the food court, corridors, restrooms, loading docks, and the parking transition zone, cross-referenced against the property's current camera coverage and staffing pattern by time of day. That audit typically surfaces the same finding across most properties: coverage and staffing are concentrated during peak retail hours and thin to nonexistent during the early morning and late evening hours when loading-dock and service-corridor intrusion is most common.

Deployment prioritization should follow the same landlord-controlled hierarchy mapped in the five-zone framework above: entrances and the food court first, given dwell time and incident concentration; corridors and restrooms second; loading docks and service corridors third, with particular attention to after-hours coverage; and the parking-to-entrance transition zone coordinated jointly with whatever parking-specific program the property already runs. For the full procurement and evaluation methodology, see IntelliSee's 2026 AI Security System Evaluation Guide. For platform-level detail, see how IntelliSee's detection system works and the full solutions overview.

Frequently Asked Questions

• Who is legally responsible for security in a shopping mall's common areas?

  The property owner or its management company is responsible for common areas, including corridors, food courts, restrooms, and entrances, that no individual tenant controls. Individual retailers are responsible for security within their own leased footprint. This split mirrors the controlling-employer and exposing-employer structure OSHA uses for multi-employer worksites under Directive CPL 02-00-124, where the party with general supervisory authority over shared space carries a distinct duty of care for that space regardless of which tenant's customer is affected.

• How is a shopping mall classified differently from an individual retail store in crime data?

  The FBI's National Incident-Based Reporting System (NIBRS) classifies a shopping mall as a distinct location type under Data Element 9, defined as a grouping of retail stores with common ownership and shared maintenance, with the classification covering the mall's common areas but not the individual stores or parking lots. That distinction reflects the same jurisdictional split that governs security responsibility: common areas are a separate risk category from any single tenant's leased space.

• Does AI detection in mall common areas use facial recognition or store video?

  IntelliSee's system does not use facial recognition and does not collect, store, or transmit biometric identifiers. Detection analyzes behavioral patterns and object characteristics, such as weapon presence and unauthorized dwell time, without creating an individual-level biometric record. That architecture matters more in a shared property than a single store, because a mall's common-area cameras capture visitors to every tenant, most of whom have no direct relationship with the property's security vendor.

• How does a mall's negligent security liability differ from a single retailer's?

  A single retailer's negligent security exposure is generally bounded by that store's own incident history. A mall operator's exposure is bounded by the incident history of the entire property across every tenant's foot traffic, in space the landlord alone controls and cannot delegate to any individual business. The lawsuit over the 2022 Greenwood Park Mall shooting, argued before the Indiana Supreme Court in January 2026, turns directly on this foreseeability question for common-area security.

• Why are malls implementing parental escort and youth curfew policies?

  Properties including Mall of America, Meadows Mall in Las Vegas, and Lenox Square in Atlanta now require unaccompanied minors under a set age to have an adult escort after a specific evening hour, most commonly 3 p.m. on weekends and holidays. These policies respond to documented patterns of youth congregation and altercations in common areas, a security dynamic that is specific to properties with shared public space and does not arise for a single-tenant retail store operating its own controlled entrance.

• Can AI detection for mall common areas integrate with individual tenants' own security systems?

  IntelliSee's common-area deployment runs against the property's own camera network and video management system, independent of whatever detection technology any individual tenant separately runs inside its own leased space. This separation means a property manager does not need cooperation, camera access, or a shared vendor relationship with every tenant to secure the common areas the landlord alone is responsible for, though alert routing can be coordinated with tenant security teams where a property chooses to do so.

• What is the first step in evaluating AI security for a shopping center or lifestyle center?

  The assessment begins with an incident-pattern audit scoped to the entire property: a zone-by-zone review of prior incidents at entrances, the food court, corridors, restrooms, and loading docks, cross-referenced against current camera coverage and staffing by time of day. This typically reveals a coverage gap during early morning and late evening hours, when loading-dock and service-corridor intrusion is most common and staffing is thinnest.