KPIs to measure your security company
Measure your security company on six indicators: post coverage, checkpoint completion, replacement time, incident response and reporting time, report completeness and staff turnover on your site. Define each with a formula and a data source, write them into the contract and review them with your provider every month. An indicator without a precise definition measures nothing.
Updated: 6 min read
Which KPIs should I track for a security company?
Track six things: whether posts were staffed, whether patrols were done, how fast a gap was filled, how fast an incident was handled and reported, whether reports are complete, and how stable the team on your site is.
Guarding mostly happens when you are not there. Indicators exist to answer one question: did you get what you paid for? So they measure outcomes that can be checked, not impressions.
- Post coverage: was every post staffed for all the hours in the contract?
- Checkpoint completion: were the patrol checkpoints scanned within the planned time windows?
- Replacement time: when a guard is missing, how long until the post is covered?
- Response and reporting time: how quickly did the guard act on an incident, and how quickly did you hear about it?
- Report completeness: do reports contain every field you agreed?
- Turnover on your site: how many different guards worked your post, and how many were new?
How is each security KPI defined exactly?
Each indicator needs three things: a formula, the exact point where measurement starts and stops, and a data source. Without them, you and your provider will measure different things under the same name.
- Post coverage (%) = hours with a guard present at the post ÷ hours in the contract × 100. Define “present”: for example, from the logged start of shift at the post to its end, with every gap subtracted.
- Checkpoint completion (%) = scans inside the agreed time window ÷ scans the patrol plan requires × 100. A scan outside its window is counted separately, not as a success.
- Replacement time (minutes) = from the moment the post is left uncovered (or the guard reports they will not come, if earlier) to the logged arrival of the replacement at the post.
- Response time (minutes) = from the alert or detection of the incident to the guard’s first logged action on the spot.
- Reporting time (minutes or hours) = two measurements: from detection to the moment you are informed, and from detection to the completed written report.
- Report completeness (%) = reports with every mandatory field filled ÷ reports due × 100. The mandatory fields come from a template annexed to the contract.
- Turnover on your site = number of guards who worked your post for the first time that month, compared with the post’s regular team. It measures stability at your site, not the company’s turnover overall.
One indicator is missing from the list on purpose: the number of incidents. Fewer reported incidents can mean a safer site or simply fewer reports. Watch it, but never make it a target.
Where does the data for security KPIs come from?
From time-stamped records created while the work is done: shift start and end, checkpoint scans, shift reports and the incident log. Not from summary tables compiled at the end of the month.
The same indicator is worth more or less depending on its source. A percentage the provider calculates in its own spreadsheet asks you to trust it. A percentage that comes straight from records you can open can be checked.
- Ask for access to the underlying records, not just the percentages.
- Agree which system is the official source for each indicator.
- Spot-check: pick one night and compare its shift report with its patrols and incidents.
OVIT brings patrols, incidents and reports together in the Guardly platform, so clients see the same live picture as the operations team instead of an end-of-month summary.
How do I write KPIs into a security contract?
In an annex to the contract, with the definition, the data source, the target you agreed and what happens when it is missed. Targets are not market standards: you agree them with your provider, for your own site.
There is no verified “right” number for any of these indicators. A site with one static post and a construction site with night patrols need different targets. So a target is the result of a conversation, not something you copy.
- Definition and formula for each indicator, as above.
- Data source: which system or document does the measuring.
- Target: e.g. “client informed of any incident involving people within 15 minutes” — an example, not a market standard; you agree the number with your provider.
- Exclusions: what does not count (e.g. a delay the client itself caused).
- Consequence: what happens when a target is missed — a written explanation, a corrective plan with a date, and what follows if it happens again.
- Reporting frequency: monthly, with that month’s data attached.
For the contract as a whole, see what to ask before you sign and how to choose a security company.
How do I run a monthly KPI review with my security provider?
As a short meeting with a fixed agenda: the six indicators against their targets, every deviation with its cause, the month’s incidents, and corrective actions with an owner and a date.
- This month’s indicators next to the targets and last month’s figures.
- Each deviation: what happened, why, and what changes so it does not recur.
- The month’s incidents: what happened, how fast, what the team learned.
- Open items from the last review: are they closed?
- Changes at your site that affect guarding (new entrances, hours, events).
- Written minutes with actions, owners and deadlines.
Look at the trend, not just the month. An indicator that falls three months running tells you more than one bad month.
What mistakes make security KPIs useless?
Indicators without definitions, targets that reward hiding problems, too many indicators, and percentages nobody checks against the underlying records.
- A “fewer incidents” target: it encourages not logging them. A guard who reports a problem is doing the job.
- Percentages with no detail: 98% coverage does not say whether the gap was an hour every night or one whole shift.
- Twenty indicators instead of six: nobody reads them, and the important ones get lost.
- Self-assessment: the provider declares, nobody checks.
- Reviews with no consequence: if a deviation never leads to action, the indicator becomes a formality.
At a glance
- Six indicators are enough: post coverage, checkpoints, replacement, response and reporting, report completeness, turnover on your site.
- Every indicator needs a formula, a start and stop point for the measurement, and a data source.
- There are no verified market numbers: targets are agreed with your provider for your own site.
- Never make the number of incidents a target — it rewards not logging them.
- A monthly review with a fixed agenda, the underlying records and written actions.
Frequently asked questions
What is the most important KPI for a security company?
Post coverage: hours with a guard present ÷ hours in the contract. If the post is empty, no other indicator matters.
Are there standard targets for replacement or response time?
There are no verified market figures. The target depends on the site, the hours and the distance, and you agree it with your provider in the contract.
How often should I review KPIs with my security company?
Every month, in a meeting with a fixed agenda and the underlying data attached. Serious incidents reach you immediately, not at the review.
Want us to look at your site?
Talk to the OVIT operations team — a real person answers.