Issue 03 | The Refraction

I sat in on two webinars on the same Wednesday last month. The first was a workforce session arguing that analyst burnout is a systems problem, not a personal failing. The second was a technology panel where a hospital security leader walked through the AI systems his command center runs. Neither speaker mentioned the other's subject, and neither one seemed to notice they were describing two halves of the same problem.

The morning session made a clean argument that task saturation is what causes operator error. A worker pushed past their cognitive limit is a hazard, not a hero, and the fix is to change the system instead of telling the worker to toughen up. It was a good session, and nobody in the room said a word about cameras.

The afternoon panel was just as sharp inside its own frame. The speaker described a virtual fence on the perimeter, AI cameras inside watching for weapons and for tailgating through secured doors, anomaly detection that flags anything off baseline, and environmental hazard alerts routed straight to the operations center. Faster decisions, fewer blind spots, more coverage for a team that never has enough people. It was a good session too, and nobody in that room said a word about burnout.

Both speakers were right, and they were describing the same system from opposite ends. Every capability the afternoon panel celebrated generates an alert, and every one of those alerts lands in the same place: the command center.

A command center doesn't run hot all day. The job runs like that old line about combat, long stretches of boredom punctuated by sudden chaos. When a call comes in, one dispatcher takes it, enters it into the CAD, dispatches a unit, and documents the whole thing, usually with the radio still going and the next call already ringing. That was the job before anyone said the word AI: take the call, run it, write it down, and stay ready for the one that turns the shift sideways.

The new systems don't replace any of that. They pile on top of it. AI cameras watch the perimeter and flag anything moving wrong outside. More AI cameras watch the inside for a weapon or for someone tailgating through a secured door. Then come more sensors, more feeds, more dashboards, and every one of them reports back to the same dispatcher who's still taking calls and running the CAD. Each alert is one more decision: dispatch, escalate, document, or dismiss. A false alarm is work that bought nothing. A real alarm is work the operator's graded on. None of the original job went away. The systems just kept getting stacked on top of it, onto the person the morning session was trying to protect.

Vendors call this labor-saving, but on the command center floor it's labor-shifting.

The hour the system saves a patrol officer in the field is an hour, and sometimes more, that the dispatcher spends clearing the alerts that hour generated. The pitch counts the field time saved and goes quiet on the command center time added, and in plenty of real deployments that ratio runs past one to one.

The fatigue shows up in the machine too. One line from the afternoon stuck with me: the speaker mentioned, almost in passing, that a good anomaly system can be tuned to stop flagging small changes over time so it doesn't wear the operators out. That sounds like a convenience feature. What it actually describes is a system raising its own alerting threshold because the people watching it can't keep up with the volume. The operator learns to wave off alerts as noise, and the machine quietly learns to send fewer of them, and both adjustments are bending toward whatever the crew can survive instead of toward what the operation actually needs to see.

A command center that handled twenty alerts a shift a few years ago can handle ten times that today, because the capabilities multiplied and every one of them reports back to the same room. Treat those numbers as illustration rather than a survey, but the shape is real and you've watched it happen. The alert volume went vertical while the staffing, the training cadence, and the shift design all stayed flat. The burnout the morning room wanted to solve is being driven, in part, by the systems the afternoon room was celebrating.

It's worth asking why neither panel caught it.

Part of it is the silo. Workforce wellness is a people-operations conversation with its own conferences and its own speakers. AI security is a technology conversation with different conferences and different speakers. The two audiences barely overlap and the vocabulary doesn't match, so the two halves of one problem never sit in the same room. The rest of it is who pays. An AI security vendor gains nothing from a frank conversation about the command center workload its product creates. A wellness vendor gains nothing from a frank conversation about the technology spend driving the saturation it treats. Each one's happy to own its half, and neither gets paid to name the seam between them.

None of this is an argument against the technology. A virtual fence that catches a breach your overnight crew would've missed is worth having. AI cameras that flag a weapon at the door are worth having. The variable that decides whether the tool helps is the operational design around it. AI alerting with the design to carry it beats no AI alerting. AI alerting without that design is worse than none, because now you've got the old blind spots plus a saturated crew and a false sense that the room is covered.

I'll own a bias here. When I was writing the standard for AI and automated systems in the Spectrum almanacs, this is the seam I kept backing into. You can't write a serious requirement for an AI security system without also writing the human review and the workload accounting that keep it honest, because the moment you leave those out you've specified a machine that quietly tunes itself down to whatever the crew can survive. The discipline behind that standard is what matters here. Name the workload before you buy the capability.

The move costs nothing but the discipline to ask before you sign. Make a command center workload analysis a required part of every AI alerting purchase, and put three questions in the RFP.

1. What's the projected alert volume per shift in our actual building, not a generic benchmark. Make them estimate against a comparable site and say what made it comparable, meaning the square footage, the staff density, and the baseline incident rate. A round number with no environment behind it is just a guess.

2. What's the field-hour-to-command-center-hour conversion in your reference deployments. They'll gladly tell you the field hours saved. Push for the command center hours added. If they've never measured it, you've just learned that the people selling you the system don't know what it does to the room that has to run it.

3. What's your recommended audit cadence for threshold drift. Any self-tuning system needs a person checking what it's quietly stopped reporting. The vendor should be able to name the cadence and name what gets audited. If they can't, the audit was never engineered, and the gap will keep widening on its own.

There's a liability side to this the burnout conversation never reaches. The day you put an AI system on your perimeter or your doors, you've documented that the threat was being watched. So when a saturated operator misses the real alert, or the system has quietly tuned itself down until it stops sending the one that matters, that gap doesn't stay inside the command center. It lands in the incident report, and eventually in discovery. Telling a plaintiff's attorney you had AI covering it won't help you if you never accounted for whether the room could act on what the AI sent. A coverage gap you planned around is a defensible position. A blind spot you bought and called coverage isn't.

The next time someone tells you their system's going to save your team a pile of time, don't argue the claim. Just ask the two questions that decide whether it's true: whose time does it actually save, and how do they handle dispatcher overload.

No CRF, no entry.

When I worked at a Fortune 50 GSOC, a contractor who showed up without a Contractor Request Form, a CRF, got turned around at the door. It didn't matter how legitimate they looked or how irritated they got, because that form was the one thing the officer could trust and the contractor couldn't fake on the spot. It meant someone inside had already vetted this person and scheduled them to do specific work on this specific date.

A uniform can be bought and a story can be rehearsed, but a request that has to exist in someone else's records before they show up is much harder to fake. Before letting a vendor in, confirm the job against an internal source such as the facilities contact, the scheduled work list, or the department that called them in.

Legitimate contractors might grumble, but a single phone call can stop a major breach. It also hands you a metric leadership actually cares about, because every vendor you turn away is unauthorized access that didn't happen, and that's risk you can put a dollar figure on.

Doors are only one part of security, and a single breach can cripple an organization that did everything else right. Verifying everyone who comes through them, even when it seems silly because Patty comes every Tuesday, will not only protect you from physical damage, but from liability as well.

The drones over the World Cup are a preview, not an exception.

During the USA-Australia World Cup match in Seattle last week, 11 drones were confiscated by the FBI. Soccer games are only two hours long, which means a drone was confiscated about every ten minutes.

Every World Cup venue and fan zone is running counter-drone coverage. In Atlanta, the FBI has confiscated 42 drones since the tournament started and DHS has stood up a dedicated counter-UAS office with significant funding. Operators flying drones inside the no-drone zones around the venues face civil fines up to $75,000 and possible criminal charges for violating the temporary restrictions from the FAA and FBI.

Almost all of these drones are fans after an overhead shot, not attackers, but detection can't tell the difference. Ukraine and the Middle East have already shown that a few hundred dollars of commercial hardware delivers high ROI along with explosives.

At your own facility, you can watch a drone and document everything it does, but you cannot legally touch it. Knocking one down, jamming its signal, or taking over its controls is a federal power held by a handful of agencies, and a private security team is not one of them. The bills in Congress that would loosen that are written for police, not corporate operators, and they won't mean anything on the ground until federal agencies finish the rules behind them.

Drone detection is a must-have for critical infrastructure at this point. An attacker can get everything they need for a drone attack in a single trip to Home Depot or Lowe's, no background check, same-day pickup. Even if you can't detect them yet, document and escalate every drone that does get spotted. The paper trail is what wins the grant or the budget line when you go ask for the system.

dictated by Ricky Portezzo, Senior Security Supervisor in Center City, Philadelphia

Slow night, nothing on fire anymore, so here is the one thing worth writing down.

Adrian comes every week to stock the vending machines. I wave, I say "Yo Adrian!", and let him in, like always. But of course Mikey says we have to hold everybody up to super double check that they can come in. I told him, "Mikey, I've known Adrian longer than they've been slicing bread." But he's the boss, so we get annoyed looks while we call the SOC.

Anyway, tonight a guy shows up, HVAC, real polished, here for the roof unit. Normally I walk him right up, because who fakes being an HVAC guy at eleven at night. But Mikey said everybody, so I call it in, and facilities never heard of him. Second I'm on the phone the guy gets twitchy, says he'll come back tomorrow, and he runs out to his van and leaves. Tag's in the report.

I guess Mikey has a point. If Adrian gets fired or something and I let him in then that's a problem.

Adrian left the good pretzels on two, get there before day shift. Ramp by the garage is slick, cone is out. Heading home, the baby is up early and so am I.

Holy crap this new speech to text thing is amaz-