Introducing suspicion levels: why we replaced binary alerts

Most retail security systems give you a binary signal: something happened, or nothing happened. That sounds simple, but in practice it creates two equally bad failure modes — too many alerts that staff start ignoring, or too few that let real incidents slip through.

When we designed Lexerus, we wanted a system that gives staff context, not just noise.

The five levels

**NONE** is the baseline. No unusual activity detected. The camera is watching but not raising any flags.

**LOW** is triggered purely by dwell time. Someone has been in the same area for longer than the configured threshold (default: 30 seconds). This isn't necessarily suspicious — but it's worth noting.

**ALERT** means one or more suspicious behaviours have been detected in addition to presence. This could be unusual body movement consistent with concealment, a bag being opened near merchandise, or a combination of signals that individually wouldn't trigger an alert.

**HIGH** means multiple independent signals have fired simultaneously: extended dwell time plus a detected behaviour, or two different behaviour types in the same frame window. A staff member should be informed.

**CONFIRMED** means a behaviour has been detected consistently across multiple frames within a short time window — not just a single-frame anomaly. This is the threshold at which push alerts are dispatched to loss-prevention staff.

Why confirmation windows matter

A single video frame is unreliable. Lighting changes, camera noise, and occlusion can all produce false detections. Our confirmation pipeline requires a behaviour to appear in a configurable number of frames within a rolling time window before it escalates to CONFIRMED.

The defaults — 3 detections within 5 seconds — were tuned against real footage from partner retailers. You can adjust them in detection settings if your environment has different characteristics.

The result

In internal testing, suspicion levels reduced actionable false positives by over 80% compared to single-frame detection, while missing fewer than 5% of confirmed theft incidents. More importantly, staff reported significantly less alert fatigue — they now trust that a CONFIRMED alert means something.