Pressure, Motion and Contact Sensors: Physical Intrusion Detection

Physical intrusion detection answers a question that access control cannot: not "is this person authorized to enter" but "is anyone here who should not be." Sensors are the detective control layered behind preventive ones, and each sensor type has a characteristic blind spot that determines what you pair it with.

Pressure sensors

A pressure sensor detects weight or force. As a mat under flooring, it registers someone standing in an area that should be empty. Under an object — a server, a safe, a display case — it registers removal, which is a different and often more useful signal.

Strengths: they cannot be defeated by moving slowly, wearing particular clothing, or masking body heat, because mass is mass. They are unaffected by lighting, temperature, and airflow. And an object-removal sensor detects theft rather than presence, which is the specific event you care about in a secure storage area.

Weaknesses: coverage is limited to exactly where the sensor is, so the protected area must be small and well chosen. Installation under flooring is disruptive and expensive. They can be stepped over or around if their location is known, and calibration matters — too sensitive and a dropped tool triggers an alarm, too coarse and a light person does not.

The other common types

Passive infrared detects the movement of heat sources across its field of view. It is the most widely deployed motion sensor because it is cheap, low power, and reliable indoors. It is defeated by slow movement, by insulating clothing, and by a heat source behind glass, and it false-alarms on heating vents and sunlit surfaces.

Microwave sensors emit radio energy and detect Doppler shift in the reflection. They cover larger areas than PIR and see through some materials, which is a strength and a liability — motion in the corridor outside can trigger a sensor inside the room.

Dual-technology sensors require both PIR and microwave to agree before alarming. False alarms drop sharply because the two technologies fail in different circumstances, which is why they are standard in high-value areas.

Ultrasonic sensors work on the same Doppler principle with sound, and are sensitive to airflow. Magnetic contact sensors on doors and windows report the simplest and most reliable fact available: the opening changed state. Glass break sensors listen for the acoustic signature of breaking glass. Vibration sensors on walls, safes, and racks detect drilling and forced entry.

Layering, and why it is the point

Every sensor type has a defeat. The design answer is not a better sensor; it is enough different sensors that any path across the protected area crosses more than one technology.

A workable layout puts contact sensors on every door and openable window, motion coverage in the interior spaces an intruder must cross, pressure or vibration sensors directly on the assets themselves, and cameras covering the same areas for verification. An intruder who defeats one technology still has to defeat a different one that fails for different reasons.

Sensors sit behind the preventive layer rather than instead of it. Entry controls such as access control vestibules stop unauthorized entry at the boundary; detection catches what gets through, including the case where someone came in legitimately and then went somewhere they should not.

Making the alarms useful

An unmonitored sensor is decoration. Every alarm needs a defined response — who is notified, who verifies, and how quickly — and an alarm at 2 a.m. with no one on the other end changes nothing.

False alarms are the failure mode that kills these systems. A zone that alarms nightly from a heating vent trains everyone to ignore it, and the one real event is dismissed along with the rest. Tune aggressively, use dual-technology sensors where the environment is difficult, and track false alarm rates per zone as a metric worth acting on.

Feed alarms into your central monitoring alongside logical events. A badge read at an exterior door followed by a motion alarm in a restricted room the badge holder cannot access is a correlation worth making, and it only happens if both event streams reach the same place — another argument for physical security events landing in the SIEM. Supervise the sensors themselves too: a cut cable or a dead battery should raise a fault, because an attacker who disables a sensor is producing the same silence as a working sensor in an empty room — one of the tampering techniques covered under physical and environmental attacks.

Exam angles

Classify intrusion sensors as detective physical controls, distinct from preventive access control. Know pressure sensors for presence and object removal, PIR for heat movement, microwave for Doppler motion, and dual-technology for false alarm reduction. Recognize that layering multiple technologies is the mitigation for any single sensor's defeat, and that alarms require a defined response and supervision to be meaningful.