Nobody's Watch: The Dangerous Assumption That Powers After-Hours Security Failures
The Shift That Changes Everything
At five o'clock on a Tuesday afternoon, most American office buildings undergo a quiet transformation. The employees who populate the space during business hours begin filing out. The lights in executive suites go dark. The parking lot empties in waves. And then, gradually, a different population arrives.
Cleaning crews. HVAC technicians. IT contractors running overnight maintenance windows. Security guards—sometimes one per floor, sometimes one per building, sometimes one for an entire campus. Delivery drivers dropping off supplies for the morning shift. The occasional employee working late on a deadline.
This population is smaller, less familiar with one another, operating under looser supervision, and governed by a patchwork of overlapping—and often contradictory—assumptions about who is responsible for what. It is, in almost every meaningful sense, a more vulnerable environment than the one that existed three hours earlier. And most businesses treat it as though it were safer.
The Assumption Economy
The core problem with after-hours security is not a shortage of personnel or technology. It is a surplus of assumptions.
When a cleaning contractor arrives at a commercial facility at 7:00 p.m., they assume that building security has been briefed on their presence. Building security, if present at all, may assume that the cleaning contractor's employer has conducted thorough background screening. The cleaning company assumes that the client has defined which areas are accessible and which are restricted. The client's facilities manager assumes that the cleaning company's supervisors are on-site to manage their team's movements. And the overnight security officer assumes that any individual moving through the building with a mop and a cart has a legitimate reason to be there.
None of these assumptions may be correct. And none of them are verified.
This is what might be called the assumption economy of after-hours operations: a system of mutually reinforcing, largely unexamined beliefs that create the appearance of oversight without the substance of it. Incidents that occur within this system—thefts, vandalism, unauthorized access, data breaches facilitated by physical intrusion—often go undetected not for hours but for days or weeks, because no single party believes the incident falls within their responsibility to investigate.
Who Is Actually in the Building?
One of the most underappreciated security challenges in commercial facilities is the simple question of occupant awareness: at any given moment during off-hours operations, does anyone actually know who is in the building?
During normal business hours, the answer is usually yes—imperfectly, but approximately. Employees badge in. Visitors sign in at reception. Deliveries are logged. The presence of people is, if not precisely tracked, at least broadly observable.
After hours, this visibility collapses. Cleaning crews may arrive through a service entrance that bypasses the main access control system. Contractors may use master keys or codes that don't generate individual audit trails. Employees working late may prop doors for convenience. The result is a building where the occupant roster, at any given moment, is essentially unknown—and where an unauthorized individual could move through the space for hours without being challenged.
This is not a hypothetical concern. Security professionals who conduct after-hours vulnerability assessments consistently report that unauthorized access during off-hours periods is far easier than clients expect. The barriers that feel robust during business hours—staffed reception desks, visible employee populations, ambient social accountability—simply do not exist after the last manager leaves.
The Skeleton Crew Problem
Facilities that operate with reduced overnight staffing face a particular version of this challenge. When a building transitions from full occupancy to a skeleton crew, the social dynamics of the space change in ways that compound security risk.
Small groups of employees working late tend to be task-focused rather than security-conscious. They are aware of their colleagues and largely indifferent to anyone else in the space. An unfamiliar face—a cleaning crew member, a contractor, a visitor—is unlikely to be questioned, because questioning strangers feels socially awkward in a quiet building, and because everyone present assumes that someone else has already verified that person's presence.
This is the same psychological dynamic that security researchers describe in other contexts: the diffusion of responsibility. When no single individual is explicitly designated as responsible for a security outcome, the probability of that outcome being managed effectively drops precipitously. Skeleton crews are, by their nature, environments where responsibility is diffused across a small number of people who are all focused on tasks other than security.
Maintenance Windows and the IT Security Parallel
IT departments are well acquainted with the concept of the maintenance window: a scheduled period, usually overnight or on weekends, during which system updates, patches, and configurations are applied. These windows exist because changes to live systems carry risk, and that risk is best managed during periods of low activity.
What IT departments understand—and physical security operations often do not—is that maintenance windows require heightened oversight, not reduced oversight. The fact that a system is in a non-standard state makes it more vulnerable, not less. The same logic applies to physical facilities during off-hours maintenance periods.
When HVAC technicians, elevator maintenance crews, or electrical contractors are working in a building after hours, the facility is in a non-standard state. Access controls may be temporarily suspended. Restricted areas may be opened. Normal workflows are disrupted. This is precisely the moment when security attention should be most acute—and it is frequently the moment when it is most relaxed, because the building is quiet and the activity appears routine.
Closing the Assumption Gap: A Practical Framework
Addressing the after-hours security problem requires replacing assumptions with explicit, verified protocols. Several interventions are particularly effective:
Establish a confirmed occupant roster for all after-hours periods. Every individual present in a facility after normal operating hours—whether employee, contractor, cleaning crew, or visitor—should be logged through a consistent access control process. This roster should be accessible to the overnight security officer in real time.
Assign explicit security responsibility for each after-hours period. Someone must own the security function during every hour the building is occupied. That ownership must be explicit, not implied. The designated responsible party should have clear authority to challenge unauthorized presence and a defined escalation path for doing so.
Brief cleaning and maintenance vendors on access protocols before they arrive. Vendor personnel should receive documented guidance on which areas of a facility they are authorized to access, during which hours, and under what supervision. This guidance should be specific, not generic.
Conduct periodic unannounced after-hours walkthroughs. Security managers or supervisors should make irregular, unscheduled visits to facilities during off-hours periods to verify that protocols are being followed and to identify conditions that routine oversight might miss.
Treat the end-of-day transition as a formal security event. The period between the departure of the regular workforce and the establishment of overnight security protocols is among the most vulnerable in any operational day. It should be managed as a deliberate handoff, not an informal drift.
The Cost of Comfortable Assumptions
The after-hours economy of American business is larger and more complex than most executives realize. It is populated by people who are unfamiliar with one another, operating under minimal supervision, and governed by assumptions that have never been tested against reality.
At Alert Guarding Force, we understand that protection cannot be conditional on the time of day. The vulnerabilities that develop when everyone assumes someone else is watching are among the most preventable in the security landscape—and among the most costly when they are not addressed.
Nobody's watch is the most dangerous watch of all.
