Loitering Detection: Dwell & Suspicious Activity Alerts

Most security events are defined by what someone did. Loitering is defined by how long they did nothing — and that is exactly why it goes uncaught. A person standing beside a fuel pump for ninety seconds at midday is a customer. The same person, same posture, at 03:00 behind a closed pharmacy is a pre-offence indicator that every guard service trains its people to spot and that almost no camera system reports.

Loitering detection turns dwell time into an event. You draw a region, set a duration, optionally restrict it to a time window, and the system alerts when a tracked person remains inside for longer than you allow. It is one of the oldest rules in video analytics and still one of the most useful, provided somebody has thought about which ninety seconds actually matter.

How It Runs on the Cameras You Already Have

A tracker follows each person or vehicle frame by frame and measures how long the tracked object stays inside the zone. When dwell passes the threshold with sufficient confidence, the system raises an alert carrying the camera ID, the timestamp and a short clip. Because that tracker runs on an edge appliance sitting next to your existing Cctv, latency is measured in milliseconds rather than network round-trips: an unreliable connection does not delay the alert, and an isolated site keeps working when the backhaul drops.

You do not replace cameras. An edge AI box ingests your current RTSP or ONVIF streams and runs loitering detection locally, alongside other rules on the same feed.

The Rule Is Simple; the Tuning Is Not

Three parameters define every deployment, and the third is where projects succeed or die. The region is a polygon drawn on the camera view: a doorway recess, a pump island, an ATM vestibule, a stairwell landing, the blind side of a loading bay. The duration is the dwell threshold. The window restricts when the rule is armed — the same region that tolerates a four-minute wait at 14:00 should not tolerate ninety seconds at 03:00.

Getting the duration wrong in either direction is costly. Too short and the rule fires on everyone who pauses to check a phone, and operators disable it within a week. Too long and it fires after the person has moved on. In our deployments the useful range is usually 60 to 180 seconds for exterior areas and 30 to 90 seconds for interior ones, set against footage from the actual camera rather than from a rule of thumb.

What It Can and Cannot Do

Configured properly, the rule does four things reliably:

• Dwell-time alerts — a person or vehicle that overstays a zone is flagged in the minute it happens, not at the next review.
• Zone-specific thresholds — a tight threshold at an ATM and a loose one at a building entrance, because those two spaces do not carry the same risk.
• Class filters — the rule counts only the object types you care about, so a bike rack, a planter or a delivery crate does not trip it.
• Escalation into intrusion detection — a loiterer who then crosses into a restricted area escalates automatically, on the same camera.

Be clear about what it is: an alerting aid that helps a human responder act faster. It is not a judgment about intent, and it does not replace trained security or front-desk staff.

What Separates Loitering from Standing Around

A person standing still is not the same as a person loitering, and the difference is behavioural. Someone waiting for a colleague checks a phone, shifts weight, looks toward the entrance. Someone assessing a target faces the building, scans, moves a few metres and comes back, or repeats the same short path twice. The rule that operators actually keep switched on tends to combine dwell with one secondary signal: re-entry into the same region within a short period, movement along the boundary rather than into it, or presence during a closed-hours window.

That combination is also what keeps false alarms manageable. The tracker behind it is the same one used across the platform for video analytics, and dwell logic is one of the pattern types the Security Industry Association has described as standard since the early days of the category; what changes is the temporal logic layered on top, and the practical guidance in our piece on cutting false alarms applies directly here, because dwell rules are the first thing operators blame when alert volume climbs.

Where It Earns Its Keep

The highest-value regions are almost never the obvious ones. Entrances get covered because they are easy to draw; the places that generate actionable alerts are the unobserved ones — the side of a building between two camera views, the rear of a retail unit after closing, the gap between a car park and a fence line, a stairwell that connects a car park to an office floor. Ask where a person could stand for three minutes without being challenged today, and draw the region there.

Context decides the threshold, and that is why loitering is normally configured alongside other rules rather than instead of them. Outside retail units it pairs with retail loss prevention and abandoned object detection, which covers the case where the person leaves something behind rather than staying with it. On campuses it pairs with school and campus safety rules that distinguish a student waiting for a lift from an unknown adult at the same spot. At forecourts it sits under gas station safety alongside smoking and fire rules. Anywhere a drawn line matters more than a region, line crossing detection is the better primitive, and where the concern is being inside at all rather than how long, intrusion detection is the one to use.

The places where dwell rules pay for themselves look much the same from site to site. ATM vestibules after closing, where lingering at the machine is a known fraud pattern. Transit platforms and shelters, where the task is separating a commuter from someone settling in. Retail entrances and lobbies, where the aim is reducing the loitering that drives customers away without a staff confrontation. Loading bays and fire lanes, where a vehicle blocks an access point far longer than a real drop-off. Critical-infrastructure perimeters, where pairing with intrusion detection means a person loitering just outside the fence is seen before they test it.

Deploying It

A deployment that survives contact with operators follows a short path. Identify the highest-priority zones on day one. Connect the edge box and draw the regions on day two. Tune the dwell threshold against real footage through the first week, then roll out to more cameras once the false-alarm rate is acceptable. Because everything runs on-premises, there are no per-camera cloud fees and the video stays under your control — which keeps the business case simple for security leads, facilities managers and operations directors.

See it applied end to end in our guide to apartment complex security cameras.

For the on-site view, read perimeter security system.

It is one of the detections most often paired with church security cameras.

For the wider picture around this, start from the AI camera vs CCTV comparison.

This is one of the topics we cover in more detail in hospital security.

Frequently Asked Questions

How is this different from intrusion detection?

Intrusion fires on presence inside a region, regardless of duration. Loitering fires on duration and can ignore a person who passes straight through. On a footpath crossing a region, intrusion would alert on every passer-by and loitering would alert on nobody until someone stopped.

Can the threshold change by time of day?

Yes, and it should. Most sites run a tolerant threshold during opening hours and a much shorter one overnight or after closing. Multiple windows per region are supported, so a single camera can carry a daytime rule and a night rule at once.

What happens when someone partially leaves the region?

The tracker holds the identity, so brief excursions across the boundary do not reset the timer. You configure a grace period — typically five to fifteen seconds — so stepping aside to let someone pass does not restart the count from zero.

Do we need new cameras or a cloud subscription?

No. The rule runs on your existing streams on an appliance inside your network, from 2 to 128 channels and 1 to 256 TOPS, with no per-camera licence and no video leaving your site. It works offline, which matters for remote sites with unreliable backhaul.

What does it cost?

Cost scales with the number of channels and the algorithms you activate. You can start on a Starter Kit covering your highest-risk cameras and expand from there; for scopes beyond the standard packages, see custom solutions.

Tell Us Your Scenario

Every site draws its zones differently, and the difference between a rule that works and a rule that gets switched off is usually thirty minutes of configuration. Send us your camera layout and the behaviour you need to catch, and we will tell you which of the 198+ algorithms fit and what accuracy to expect on your footage. Tell Us Your Scenario — or start with a Starter Kit preloaded with tested configurations, running on your own cameras in a single afternoon.