Expert-Derived Risk Matrix Turns Building Sensor Alarms into Five-Level Security Grades

Security monitoring centers face a paradox that has quietly undermined building protection for years: the sensors keep getting smarter, but the judgment about what those sensors mean still rests on whoever happens to be watching the screens. Video analytics flags an unauthorized entry, access control reports a failed authentication, and a vibration sensor registers a shock, yet each device issues its alarm in isolation, per device and per event. A new study published in Architectural Research on 30 October 2026 argues that this fragmentation makes risk judgments inconsistent and slow, and it proposes a concrete remedy: a risk matrix that fuses heterogeneous sensor data with spatial and temporal context into a single five-level risk grade, with parameters derived from twenty experts and tested against their own scenario judgments.

The research team, led by Hyoeun Seol and including Jiwon Yang, Jae Young Jang, Dongsic Choi, Gisung Han, and Seung Hyun Cha, confined the scope of physical security risk to intrusion, theft, and vandalism. These are the threat classes that video analytics, access control, and physical security sensors are standardized to detect, they share the structure of an antecedent breach followed by a harmful act, and safety incidents such as falls, which involve no intentional agent, were explicitly excluded as requiring a separate system. The study addresses a gap that individual detection technologies have not closed despite rapid progress. Deep learning-based video analytics can classify abnormal behaviors such as unauthorized entry, loitering, and illegal dumping, and person re-identification can trace movement across cameras, but detection accuracy does not translate directly into risk judgment. Video analytics judges only whether a behavior is threatening, access control only the authentication result, and sensors only whether an event occurred, each a facet of a threat rather than the risk level of the situation.

The gap widens in compound threat situations. The risk of the same video event varies with the character of the space, the time of occurrence, and whether access authorization matches, yet current systems do not reflect such context systematically. Because the grounds of judgment are not explicit, operators may reach different conclusions in the same situation, and the process cannot be reproduced or reviewed. Checking multiple alarms sequentially also takes time, and since detection, delay, and response compete within a fixed window, delayed judgment is itself a cause of protection failure. The framework therefore rests on three design principles: judgments from the three device families are converted to a common scale of risk evidence strength and combined at the level of judgment outputs; zone importance, defense-line stage, and operational status by time period are defined as independent indicators at the same level as event information rather than as adjustment coefficients; and the computation structure is kept common while threat behavior base scores are set per facility type.

Six key risk indicators emerged from the design stage, covering abnormal behavior, spatial context, temporal context, access-control anomaly, sensor evidence, and event correlation. Video-based abnormal behavior covers eleven threat behaviors detected by video analytics under the three threat classes. Spatial context comprises the defense-line stage, running from perimeter and public areas through access-controlled zones to critical protected assets, and zone importance across five levels from public to critical protected asset zones. Temporal context uses four divisions: regular operating hours, non-operating hours, night, and holidays. Access control anomaly spans authentication success and failure, no authorization, unregistered users, user-zone authorization mismatch, and multiple passages on a single authentication. Physical sensor evidence covers PIR detection, vibration, shock, door opening, fence detection, and electric strike fault. Event correlation and recurrence targets relations among events, including simultaneous and sequential occurrence, combination of video with access or sensor events, repeated access by the same person, repetition of same-type events, and event duration.

The computation proceeds in five steps: event collection, per-indicator score conversion, normalization, weighted integration, and grade determination. Because evidence-strength indicators use a 0-to-20-point scale while contextual indicators use 0 to 10, each score is normalized by its scale ceiling before integration. The normalized scores are combined in a weighted sum whose weights come from expert evaluation, producing a final risk value between zero and one that is multiplied by 100 for field interpretation and discretized into five grades by four thresholds. The weighted-sum form was chosen deliberately over alternatives: Bayesian networks require conditional probability tables in advance, the Noisy-OR model presupposes independence among variables, and evidence-theory fusion produces outputs that are difficult to decompose into per-element contributions. The linear combination lets each indicator’s contribution be decomposed to trace which factors a computed value stems from, and it suits an initial-stage framework without operational data. Interactions among events, which the additive form does not cover, are operationalized as the separate correlation indicator.

Twenty experts with research or practical experience across physical security and access control, video monitoring, architectural planning and crime prevention through environmental design, facility safety management, criminology, and disaster safety management completed the evaluation in July 2026 in individual face-to-face sessions. Their career length had a median of 17 years, with a mean of 16.2 and a range of 6 to 30. For weights among key indicators, the panel answered fifteen comparison pairs on Saaty’s nine-point scale under the analytic hierarchy process, aggregated by the geometric mean of individual judgments. The aggregated matrix achieved a consistency ratio of 0.012, well below the 0.1 criterion. Temporal context received the highest weight at 22.61 percent, followed closely by video-based abnormal behavior at 21.20 percent, just 1.41 percentage points apart. Together the top two account for 43.81 percent of the total weight, while physical sensor evidence at 14.26 percent, spatial context at 13.61 percent, and event correlation at 11.56 percent form a supporting tier that contributes in combination rather than individually.

The sub-indicator scores revealed a clear structure in expert perception. Authentication success scored a median of 1.0, while unregistered user and user-zone authorization mismatch were rated highest at 17.0 each, showing that attempts outside the authorization system are perceived as stronger evidence than failures of the authentication procedure itself. In the physical sensor indicator, the difference across items was only 2.0 points, from shock detection at 17.0 to vibration, fence, and electric strike at 15.0, suggesting that the contribution of physical sensors lies in the occurrence itself rather than the kind of sensor. Night, holidays, and non-operating hours all scored 8.0 points, more than double regular operating hours at 3.0. Sequential occurrence and video-access or sensor combination scored highest at 8.5 each in the correlation indicator, while repetition of same-type events and event duration were lower, indicating that events of different families connecting in sequence are perceived as stronger signals than events merely repeating or persisting.

Threat behavior profiles diverged sharply by facility type. The five demonstration sites in City B, Gyeonggi Province, comprised an open plaza, a transit facility, an industrial and energy facility, a health center, and a public administration and control facility. At the open multi-use facilities, robbery, rated 16.0 to 17.0, and assault, rated 16.0 to 16.5, were dominant, whereas at the access-controlled facilities unauthorized entry, off-hours entry, and equipment tampering were rated high. Equipment tampering at the industrial and energy facility recorded 19.5 points, the maximum across all items, against 7.0 at the open plaza. The correlation within the open facility group was 0.91 and within the access-controlled group averaged 0.75, while the cross-correlation between the two clusters averaged only 0.29, forming two clusters with distinct threat characteristics and supporting threat behavior base scores differentiated by facility type rather than a single uniform set.

Validation came from seventeen scenarios composed to reflect the actual environments and operating conditions of the five sites, with thirteen to sixteen experts judging each scenario. Experts’ primary-threat-type selections placed intrusion, theft, and vandalism at 82.6 percent, confirming that each scenario was recognized as intended. Inter-rater reliability was moderate, with Krippendorff’s alpha at 0.399. Two scenarios showed strong consensus and nine moderate consensus, and both strong-consensus scenarios were intrusion followed by arson, each reaching 93 percent agreement on the highest grade. With equal-interval thresholds, the matrix reproduced expert judgments within one adjacent level in 88 percent of scenarios, with no disagreement in the high-risk range, though exact agreement was only 29 percent. Calibrating the two upper thresholds by quantile matching, setting each threshold at the score quantile equal to the cumulative share of labels at or below that grade, raised exact agreement to 47 percent in-sample and 35 percent under leave-one-out cross-validation and repeated five-fold validation, with adjacent agreement of 88 to 94 percent. A search for maximum agreement, by contrast, reached 53 percent in-sample but fell to 24 percent under leave-one-out refitting, fitting the sample rather than the scale.

The authors are candid about the limits. The parameters are expert-grounded initial values not yet validated with operational data, and the two lower thresholds could not be estimated because no scenario scored below 46 points. Two open-plaza scenarios had identical inputs, so the matrix assigned them the same score, yet experts labeled them two grades apart, showing that part of the residual disagreement lies in the labels themselves. The additive form double counts some correlated evidence, the scenario set concentrated in upper-middle grades, and the multi-field panel trades consensus for coverage. What the study delivers is an independent judgment layer that converts device-level detections into a decomposable, context-adjusted risk grade, one that can present which indicators drove a computed grade alongside the grade itself. The researchers state that future work should confirm the thresholds and weights with operational data from the demonstration sites and extend to machine learning-based parameter updating, turning an expert-seeded framework into one that learns from the event histories it will eventually monitor.

Subject of Research: Development and expert validation of a physical security risk matrix that integrates heterogeneous sensor data and spatiotemporal context into a five-level risk grade.

Article Title: Development of a Physical Security Risk Matrix Integrating Heterogeneous Sensor Data and Spatiotemporal Context: Expert-Derived Parameters and Scenario-Based Validation

Article References: Seol, H., Yang, J., Jang, J. Y., Choi, D., Han, G., & Cha, S. H. (2026). Development of a Physical Security Risk Matrix Integrating Heterogeneous Sensor Data and Spatiotemporal Context: Expert-Derived Parameters and Scenario-Based Validation. Architectural Research, 28(1), Article 28. https://doi.org/10.1007/s44515-026-00035-9

Image Credits: AI Generated

DOI: 10.1007/s44515-026-00035-9

Keywords: physical security, risk matrix, sensor fusion, video analytics, access control, spatiotemporal context, analytic hierarchy process, expert evaluation, intrusion detection, facility security, convergent validity, security monitoring