Site security
Alarm Response in Melbourne: What Actually Happens When Your Alarm Goes Off
Your alarm is monitored. But who physically attends, how fast, and what are they allowed to do? Most business owners find out at 2am, which is the wrong time.
Ask a business owner whether their alarm is monitored and the answer is almost always yes. Ask who physically attends the site when it activates at 2am, and the answer is a pause.
That pause is the gap where most alarm systems quietly stop being security and become a noise generator. Here is what actually happens during an activation, and the questions worth asking before you need the answers.
Monitoring and response are two different services
This is the distinction that catches people out, and it is usually hidden in the difference between two line items on an invoice.
Monitoring means a centre receives the signal from your panel and follows a procedure — typically calling your nominated contacts. That is it. The monitoring centre does not come to your site.
Alarm response means a licensed officer is dispatched to physically attend, inspect and report. That is a separate service, and a great many businesses are paying for the first while assuming they have the second.
If nobody has told you who attends, it is worth checking today rather than finding out during an activation. The common discovery is that the procedure ends with "call the owner" — and the owner is asleep, or interstate, or has changed their number.
What actually happens, step by step
The panel sends a signal. Zone information travels to the monitoring centre — a rear door contact, a motion detector, a glass break.
The centre applies your procedure. Some activations are filtered, some trigger calls, some dispatch a patrol immediately. This procedure is written by you, and most sites have never reviewed theirs.
An officer is dispatched. Ideally one already patrolling nearby rather than one starting from a depot across the city.
The officer arrives and inspects the exterior first. They are looking for a forced door, broken glass, a vehicle that should not be there — evidence of whether this is real before anyone goes inside.
If there are signs of entry, they call police and hold the scene. They do not clear a building where an offender may still be present. That is not caution for its own sake; an officer entering alone destroys evidence and risks a confrontation nobody wants.
If the exterior is secure, they check the interior — if they have keys and codes — identify the likely cause, reset the panel and secure the site.
You get a report. Time of activation, time on site, zone, what was found, what was done, photographs. This is the part that makes the service auditable, and the part cheap providers skip.
Police will usually not attend
Worth stating plainly, because a lot of alarm systems are sold on an implication that they will.
Police prioritise incidents by threat to people and by whether something is confirmed. An unverified alarm activation — of which the overwhelming majority are false — sits low on that list, and on a busy Friday night it will not be reached.
What changes the priority is verification. A licensed officer on site reporting a forced rear door and a vehicle in the loading bay is a confirmed incident, and it is treated as one. That is the real function of alarm response: it converts a low-priority signal into something the system will act on.
False alarms are the real cost
Most activations are false, and the causes are mundane: a door not latched properly at close, a detector aimed at a heater vent or a hanging sign, insects, a cleaner with an old code, a flat backup battery, a roller door flexing in the wind.
Two problems follow. The first is financial — you pay for each attendance whether or not anything happened. The second is worse: a site with a reputation for false alarms gets deprioritised by everyone, including the people you are paying. When a real activation eventually arrives, it looks exactly like the last forty that did not.
Cutting the rate is unglamorous and effective. Walk-test every detector rather than assuming the install was right. Re-aim anything pointed at a vent, a sign or a skylight. Give cleaners and contractors their own codes and deactivate them when they leave. Replace backup batteries on a schedule. Fix the doors that do not latch first time. Then review your activation log quarterly and chase the top zone.
The questions that decide whether response actually works
What is the response time, and measured from when?
Get it in writing, measured from dispatch to arrival on site, with a stated consequence for missing it. A 30 to 45 minute metropolitan target is realistic. "Immediate" with no measurement point means nothing.
Who holds keys and codes?
Without them an officer can inspect the outside and report, and that is all — no interior clearance, no panel reset, no securing a broken door. Ask how keys are stored, whether issue and return are logged, and who has access to the register.
What is the officer authorised to do?
Can they enter? Clear the interior? Reset the panel? Arrange a make-safe for a broken door at 3am? Wait on site until you arrive? Each of these needs to be agreed in advance, because 3am is not when you want to discover the limits.
What does the escalation list look like?
Most escalation lists are out of date. Someone on it has left the business, someone's number has changed, and nobody has checked in two years. Review it every six months — it is the cheapest improvement available to you.
What reporting do you get?
A written report per attendance with times, findings, actions and photographs. If all you receive is an invoice, you have no way to know whether anyone attended at all.
What a response officer can and cannot do
A licensed officer can attend, inspect, verify, secure the site, call police, hold a scene, take photographs and report. They can ask an unauthorised person to leave private property.
They cannot pursue someone who has left, use force beyond very limited circumstances, or clear a building where an offender is likely still inside — that is a police task, and an officer who treats it otherwise is a liability to you and to themselves.
The point of the attendance is verification and evidence, not confrontation.
Vacant, seasonal and shut-down sites
Alarm response earns its keep hardest on sites where nobody is expected for weeks — a tenancy between leases, a building site over the Christmas shutdown, a factory closed for the holidays, a school across the term break.
Three things change on a vacant site. Every activation is meaningful, because there is no legitimate reason for anyone to be there — which makes the false alarm rate worth driving to near zero before the closure starts. Nobody local is available to attend, so the escalation list you never reviewed is now the whole plan. And a small breach has time to become a large one: water running for a fortnight or a door left open across a long weekend does more damage than the theft that caused it.
Before any extended closure, walk-test the system, confirm who holds keys and who is actually reachable, agree in advance that an officer may arrange a make-safe without waiting for authorisation, and put patrols across the period rather than relying on the panel alone. Long weekends and the Christmas period are the two highest-risk windows in the Victorian calendar, and they are the two most predictable.
Alarm response, patrols, or both
Alarm response is reactive: it costs you nothing until something triggers, and it does nothing to prevent the trigger. Mobile patrols are proactive: randomised attendance that deters before an activation, with checkpoint logs proving the visits happened.
They work best together, and for a good practical reason — a patrol already working your area is far closer to your site than a vehicle dispatched from elsewhere, so pairing the two usually improves your response time as a side effect.
For a site with valuable stock or a genuine history of incidents, cover through the high-risk hours after close with a static guard, patrols through to dawn, and alarm response underneath both. Our comparison of static guards and mobile patrols works through how to split a budget between them.
What to do this week
Three things, none of which cost anything: confirm whether you are paying for monitoring, response, or both. Read your escalation list and fix the names and numbers that are wrong. Pull your activation log and find out how many of last quarter's alarms were real.
That last number tells you whether you have a security system or a doorbell. We cover alarm response across Melbourne, Dandenong, Frankston and Geelong — talk to us about your site.
Questions this article answers
Ask for it in writing, measured from when the monitoring centre dispatches to when the officer arrives on site, and ask what happens when it is missed. A metropolitan target of 30 to 45 minutes is realistic; anything promised as "immediate" without a measurement point is marketing. Regional sites will be longer and a provider should say so plainly.
Not necessarily, but understand what you are buying if you do not. Without keys or codes, an officer can only inspect the exterior and report — they cannot clear the interior, reset the panel or secure a broken door. Most providers keep keys in an audited system with logged issue and return. If you will not release keys, plan for a key holder to attend.
You do, in almost every arrangement, because the officer attended regardless. That is why false alarm rates matter commercially rather than just operationally — a site generating several false activations a week is paying for callouts that protect nothing. Fix the cause and the response service starts earning its keep.