Why handoffs drop incidents.
Every monitoring operation has a version of this story. The evening guard saw a person at the back fence at 10:40, called the client, left a voicemail and was waiting for a callback. At 11:00 the overnight guard sat down, glanced at the wall, saw nothing moving and started the tour. The callback came to a guard who had never heard of the fence. Nothing was technically lost. Everything was effectively lost.
Handoffs fail for predictable reasons:
- State lives in someone’s head. The outgoing guard knows which alert is waiting on a callback. The log says “called client”.
- Acknowledged looks like finished. An alert that was seen is not an alert that was resolved, but many consoles show them the same way.
- Evidence is scattered. Clips exported to a desktop, screenshots in an email, notes in a paper book.
- The wall looks calm. The incoming guard reads the current screens, not the last eight hours.
- Everyone is in a hurry. One guard wants to leave, the other wants to settle in.
What a good handoff covers.
Keep it short and structured. The same items, in the same order, every shift:
- Open incidents. Every alert that is not closed: what happened, what has been done, what is being waited on and when to follow up.
- Pending callbacks and dispatches. Police or patrol en route, client contacts not yet reached, case numbers issued.
- Site status changes. Cameras down or dark, doors propped for contractors, special events, authorized after-hours visitors.
- Watch items. A vehicle that circled twice, a person who left in a particular direction, a gate that did not close properly.
- Evidence saved. Which incidents have clips or frames preserved and where.
- Equipment. Workstation, radio, phone, monitoring software status and any capture or network problems.
Write the standard into the post orders so it survives staff turnover, and have supervisors spot-check it.
Acknowledged is not closed.
The most useful single rule for handoffs: an alert is only closed when someone records an outcome. Seen, called about or “probably nothing” are all still open. If your tools treat acknowledgement and closure as the same click, the open list at shift change is meaningless.
The same goes for priority. The incoming guard should see what matters first: critical and high items at the top, then anything not yet assessed. See our guide to alert triage and priority levels.
Outgoing: clean the list
Ten minutes before change, close what is finished with an outcome. Everything else stays open with a note on what is pending.
Walk it together
Go through open items top to bottom on the same screen. The incoming guard opens each one and looks at the evidence.
Incoming: take ownership
Confirm the handoff in the log with the time and both names. From that moment, every open item is theirs.
Evidence travels with the incident.
A handoff note that says “see footage from 10:40” forces the next guard to go hunting. Better: the frames that triggered the alert, the camera and the timestamps are attached to the incident itself. When the police officer calls back at 2 a.m. asking what the person was wearing, the overnight guard opens the incident and looks. For preservation rules, see incident report video evidence.
Where Semaphor fits.
Semaphor was designed so the monitoring state lives in the system, not in a guard’s memory. Start with what Semaphor is. The guard inbox sorts alerts Critical, High, Unassessed and Low, and keeps acknowledge separate from close after review, which records an explicit outcome. Unresolved incidents persist across restarts; a quiet camera, a missing view or a model failure never closes an incident on its own. New activity on the same camera updates the same open card, and new urgent activity reopens attention.
Every card carries the original frames, source timestamps and hashes — evidence and an audit trail the incoming guard can open in one click. The handoff becomes a walk down one list. See it on a live shift: start a pilot on one monitoring station, or book a live demo on your own camera screens.
Shift handoff FAQ
What should be included in a security shift handoff?
Open incidents with their pending actions, callbacks and dispatches, camera and site status changes, watch items, where evidence is saved, and equipment status. Use the same order every shift.
How do you hand off open alerts between monitoring shifts?
Close finished alerts with an outcome, leave everything else open with a note on what is pending, and walk the open list together on the same screen before the outgoing guard leaves.
What is the difference between acknowledging and closing an alert?
Acknowledging means someone has seen it. Closing means someone reviewed it and recorded an outcome. Only closed alerts should drop off the handoff list.