An alert stream nobody reads is worse than none.
A geofence-and-schedule rule on this fleet fires 186 times a week. That is 37 a day, almost all of it legitimate work, and it gets muted by the second week. After reconciling against dispatch and approvals, 11 are left. Those you can actually act on.
- 186
- raw alerts a week
- 78
- distinct episodes behind them
- 11
- with no job or approval
- 2.2
- a working day to review
Neither place nor time means anything alone
A vehicle at the yard is normal. That vehicle at the yard at 02:40 on a Friday is not. The unit of analysis is the cell.
One week · vehicles moving each hour
The shaded block is the authorised window. Everything outside it is the tail — 49 hours of the week, 186 vehicle-hours in total.
Sunday starts the week. Friday is closed and Saturday is a short day. Hover any hour for the count.
100 of the week's 168 hours sit outside the authorised window, and 49 of them saw movement. Fade the normal hours and the shape is obvious: the tail is concentrated in the evenings, where work overruns, not in the deep night, where almost nothing happens at all.
186 down to 11, without a human reading anything
Every stage here is arithmetic against data you already have. None of it decides whether something is theft — it decides what nobody needs to look at.
This is the part vendors skip. Detecting out-of-hours movement is trivial and every system does it. Making the output small enough that a real person reads all of it, every morning, is the entire problem.
- 186
Alerts a plain rule fires
One per vehicle, per hour, outside the authorised window. This is what a geofence-and-schedule rule hands you, and it is the number that gets the notifications muted in week two.
- 78
Collapsed into episodes
−108A vehicle out at 21:00 and still out at 23:00 is one thing that happened, not three. Nothing has been judged yet — only counted properly.
- 25
After matching dispatch
−53Most out-of-hours movement is a job that overran or a callout raised that evening. Reconciling against the job list clears it with nobody reading anything.
- 11
After matching approvals
−14Approved overtime and shift extensions are already on file. What is left is movement with no job, no approval and no note against it.
What arrives on Sunday morning
Not an inbox. A list of 11, each one a vehicle, a window and the reason it did not clear itself.
Most of these resolve into a phone call and a note that should have been written at the time. That is the honest outcome and it is still worth having — the ones that do not resolve are the only ones you were ever going to find.
| Ref | Vehicle | When | Duration | Why it is here |
|---|---|---|---|---|
| E001 | VEH-198 | Sun 01:00 | 41m | Route did not touch any customer site |
| E016 | VEH-124 | Mon 19:00 | 67m | Movement began and ended at the same yard |
| E021 | VEH-180 | Tue 00:00 | 29m | Movement began and ended at the same yard |
| E027 | VEH-161 | Tue 18:00 | 132m | Driver assigned to a different vehicle that day |
| E032 | VEH-187 | Tue 20:00 | 32m | No job, no approval, no note |
| E036 | VEH-123 | Wed 00:00 | 45m | No job, no approval, no note |
| E054 | VEH-167 | Thu 21:00 | 134m | Route did not touch any customer site |
| E067 | VEH-212 | Fri 23:00 closed | 110m | Movement began and ended at the same yard |
| E069 | VEH-195 | Sat 06:00 | 44m | Route did not touch any customer site |
| E074 | VEH-176 | Sat 20:00 | 98m | Movement began and ended at the same yard |
| E075 | VEH-189 | Sat 20:00 | 125m | Movement began and ended at the same yard |
That is the entire list for the week — not a sample of it. Every row carries the trip back to the map, so the conversation starts with a route rather than an accusation.
Four things go missing, in ascending order of value
Fuel gets the attention because it is the one with an obvious number attached. It is also the smallest of the four.
- Fuel
- The one everybody starts with, and the smallest number. A siphon is a step down in the tank trace with no refuel receipt against it and the engine off.
- The load
- Worth more than the vehicle and easier to move. A door opening at a place that is not a delivery point is the signal, which needs a sensor on the door rather than a fix on the map.
- The asset itself
- Plant, gensets and trailers, which have no ignition to watch and go missing over a weekend rather than in a night. Movement without a tow booking is the only tell.
- The vehicle's time
- The largest and least dramatic of them. A van doing private work on a Friday costs more over a year than the fuel anyone siphons out of it, and it is the one nobody calls theft.
Remote immobilisation, and why we argue with you about it
It is the first thing asked for on almost every call and the feature we are least enthusiastic about selling. Here is the whole position, before you ask.
- It is a recovery tool, not a deterrent
- It does nothing until the vehicle is already gone, and by then the useful question is where it is, not whether it can be stopped.
- Never above walking pace
- Cutting the starter circuit on a moving vehicle is how a theft becomes a fatality. The command is refused above a speed threshold, and no amount of urgency on a phone call overrides it.
- Two people, and a record
- It needs a second authorisation and it is written to an audit log with who asked and why. Every operator who has this feature eventually has a story about it being used in an argument.
- We would rather you did not buy it
- Recovery works better through the tracking and the police report. We ship it because customers ask and because a competitor will otherwise, not because it is good.
What this does not do
Security is the easiest thing to oversell in this industry, because the failure is invisible until the one time it matters.
- None of this catches a professional
- A unit can be found and pulled, and a vehicle loaded into a closed container reports nothing at all. What this catches is opportunistic loss by people who work for you, which is where almost all of it comes from.
- The unexplained pile is not a guilty pile
- It is a pile of things nobody wrote down. Most of it resolves into a phone call and a note. Treating the residue as accusations is the fastest way to lose the drivers you need.
- It only works if the job data is there
- The reconciliation is the whole value, and it depends on dispatch and approvals being in the system. A fleet that keeps its schedule in a group chat gets the raw stream and nothing better.
Across 120 vehicles this ends up being a short weekly conversation rather than a security operation. If a vendor is promising you more than that, ask them how many alerts a week it produces and whether anyone at their existing customers still has them switched on.