AI detection security: what sensor fusion actually delivers on patrol

Security managers judge AI detection by three numbers: detection range, false alarm rate, response time. Everything else is sales material. This article documents which sensors the Quarero Robotics models QR-1, QR-2 and QR-3 use on patrol, how classification works, and which limits follow from § 34a GewO and the KRITIS-Dachgesetz (KRITIS Umbrella Act).

AI detection security: what the sensors deliver

Detection rests on four modalities, processed in parallel on edge hardware.

The RGB camera classifies people in daylight from 30 metres distance. Inference time per frame stays below 200 milliseconds, which allows continuous tracking at driving speed. The model distinguishes standing, walking and lying persons as well as vehicle classes.

The thermal sensor on the QR-2 outdoor patrol with thermal sensor detects heat signatures at 0 lux up to 80 metres. Classification between human and animal works via silhouette and temperature profile. A fawn at 38 degrees body temperature and 70 cm shoulder height is separable from a human at 36.5 degrees with upright posture.

LiDAR on the QR-3 for KRITIS with LiDAR and drone detection delivers a 360-degree point cloud at 10 cm resolution. The system recognises stationary objects, movement vectors and airborne devices up to 150 metres. LiDAR penetrates light fog and smoke where RGB fails.

An audio array classifies glass breakage, screams and engine noise. The model is trained on 14 industrial sound classes, from compressed air to diesel generator.

Sensor fusion links the modalities under a fixed logic. An alarm triggers only when at least two sensors converge. RGB alone is not enough. RGB plus thermal with matching position and classification is enough.

Concrete next step: perimeter protection concept for the site pre-assessment.

False alarm rate: the only metric that matters

Classic passive infrared motion detectors at the perimeter produce, by industrial guard service experience, between 95 and 98 percent false alarms [source to be added]. Wind in tarpaulin, rain on lenses, wildlife and vegetation all trigger them.

The Quarero Robotics platform reduces the rate to below 3 percent at productive sites. The lever is multi-sensor fusion plus context classification. The AI knows that an 18 kg animal at 02:30 in a zone with registered wildlife-crossing history does not trigger an alarm.

Every confirmed alarm passes to the control room with three artefacts: image excerpt, thermal profile, audio segment. The operator decides on this basis, not on a raw sensor signal.

The false-positive rate is guaranteed in the service level agreement and reported monthly in the operations report. If the value is missed, a service credit applies.

Escalation to police or guard personnel happens only after double verification by AI and operator. This separation is not optional. § 34a GewO assigns the authority for a security act to the trained person, not to the algorithm.

Next step: TCO comparison against classic guard service.

Person detection at the perimeter: practical range

Range depends on the model, weather and light profile. The following values count as defensible mean values from productive operation.

QR-1 covers indoor and roofed outdoor areas with a detection radius of 25 metres. Faces are anonymised on-device in line with GDPR. Deployment focus: logistics halls, lobbies, underground car parks.

QR-2 is built for 24/7 outdoor patrol. Thermal detection reaches 80 metres, and the human/vehicle/animal classification achieves a hit rate above 96 percent in our site measurements (average across four pilot sites, internal measurement protocol 2024 [source to be added]). The value is not a guaranteed point figure.

QR-3 is designed for KRITIS. LiDAR complements optical sight in fog, smoke and darkness. Drone detection up to 150 metres addresses the UAS threat against energy and water infrastructure.

All three models detect loitering, meaning persons remaining in place. From 90 seconds inside a geometry defined as a restricted zone. The zone logic works with virtual geofences per shift: an area can be a clearance zone by day and a restricted zone by night.

Next step: review the technical specification of the QR-3 for KRITIS with LiDAR and drone detection in the datasheet.

Data protection: where the AI stops looking

Data protection is not a secondary question in AI detection. If it is solved wrongly, the pilot fails at the works council, not at the technology.

Faces are pixelated on-device. Clear-text images leave the robot only on a confirmed alarm and are sent encrypted to the control room. The rolling buffer for non-alarm-relevant recordings is 72 hours, after which automatic deletion applies (GDPR Art. 5 (1) (e)). This period follows GDPR Art. 5 (data minimisation, storage limitation).

The works council receives access to detection categories and processing logic before commissioning. Without this disclosure, commissioning is not permitted under § 87 (1) no. 6 BetrVG.

What the platform explicitly does not do: no biometric identification, no behaviour prediction, no link to HR systems. This self-restriction is part of the product design, not a configuration matter.

Data processing agreement and the record of processing activities under Art. 30 GDPR are included as standard in the Robotics-as-a-Service model.

KRITIS suitability: requirements on AI detection

The draft of the KRITIS-Dachgesetz requires in § 9 verifiable physical security measures for operators of critical installations (source: Bundestag-Drucksache 20/9262). A pure camera setup without documented response capability does not cover this requirement.

The BSI-KritisV additionally requires state-of-the-art attack detection, documented in the security concept (legal basis: BSI-KritisV full text). The AI detection pipeline of the QR series is entered into the concept with version status, training data base and validation metrics.

EN ISO 13482 defines safety requirements for service robots operating around persons (standard: ISO 13482). The QR series is certified to conform. In an audit by BSI-approved testing bodies, this certification is the entry document.

Drone detection on QR-3 addresses the growing UAS threat against energy and water infrastructure. Detection is passive (LiDAR plus acoustics). Active countermeasures are reserved for the Bundeswehr and Bundespolizei.

Audit logs of the AI decisions are kept in tamper-evident form for 24 months. Later forensics after an incident remain reproducible.

For organisational embedding: NIS-2 requirements on detection. NIS-2 obliges essential and important entities to technical and organisational security measures (Directive EU 2022/2555).

Training and model maintenance: what sits behind detection

The base models are trained on 2.4 million annotated industrial scenes [source to be added]. Quarterly updates reach the edge devices through signed packages. An update requires that validation metrics do not regress against the previous state.

After deployment, a site-specific finetuning runs over the first 14 days. Wildlife-crossing routes, vegetation behaviour and regular delivery traffic are learned as normal patterns. This finetuning is included in the RaaS contract and causes no extra cost.

Edge inference runs on NVIDIA Jetson Orin. The detection decision needs no cloud connection. If the mobile network drops, the robot keeps patrolling and detecting. Only alarm handover to the control room waits for connection recovery.

Model versioning and rollback on drift are documented in line with BSI-Grundschutz. Adversarial testing against camouflage clothing, reflections and weather extremes is part of every release cycle. We test against black camouflage jackets in rain, mirrored facades and snowfall above 5 cm per hour.

For operational embedding: hybrid TCO in the industrial park.

Comparison: AI robot versus stationary cameras plus guard personnel

A 24/7 guard post costs between 15,000 and 25,000 euros per month, depending on tariff and shift count. This range is based on BDSW industry data (BDSW figures, data, facts). The lower value applies in tariff zone East with reduced shift coverage. The upper applies at full coverage in Bavaria or Baden-Württemberg.

A QR-2 patrol in the RaaS model costs around 3,500 euros per month and covers 8 to 12 hectares, depending on topography and patrol density. The robot does not replace human escalation, it adds a permanent detection layer.

Stationary PTZ cameras have structural blind spots behind building corners, truck bays and vegetation islands. Mobile robots patrol randomised and adaptive. An intruder cannot predict the patrol path from observation.

A hybrid model of one guard post plus two robots lowers total cost of ownership by 40 to 55 percent against pure personnel coverage. Detection density rises in parallel. The range comes from site size and tariff region.

Response time to a confirmed incident: robot below 60 seconds to arrive at the detection point, classic stationary guard 4 to 7 minutes at an 8-hectare site (three pilot measurements 2024 [source to be added]).

Introduction: what security managers must check before the pilot

A pilot does not fail at the AI, it fails at unclear interfaces and forgotten committees. The following check items belong before contract signature.

Site walk with sensor-coverage simulation: for each patrol route, detection coverage is checked against the terrain geometry. A robot that cannot reach the rear storage area because of an 18 percent ramp gradient is worthless.

Clarify interfaces: connection to existing PSIM, control room, access systems. Handover formats (BACnet, ONVIF, OPC UA, REST) are documented before the pilot, not during it.

Involve the works council and data protection officer from day 1, not at rollout. A late involvement costs six weeks on average [source to be added].

Pilot over eight weeks with three defined KPIs: detection rate against planned test intrusions, false alarms per patrol hour, availability in percent. Values are signed off weekly.

Fix the escalation matrix in writing. The question "Who decides on police dispatch at 03:00 on a confirmed alarm?" must be answered before commissioning. During an actual incident, it is too late.

Anyone who wants to structure the pilot starts with a site sensor simulation in the Robotics-as-a-Service model. Coverage map and KPI template follow in under ten working days.