What Is Surveillance Detection?

Surveillance detection is the practice of identifying hostile reconnaissance — the observation and information gathering that precedes a targeted attack, whether physical or digital.

Its value is that reconnaissance happens before anything else. An organisation that notices it being studied has warning that no later control provides.

The physical form

People or vehicles observing premises, entrances, security arrangements or staff movements. Attempted social engineering to learn about layout, staffing or procedures. Unusual interest in delivery routes, shift patterns or executive travel.

It is a recognised discipline in protective security for facilities and individuals at elevated risk, and it depends largely on staff noticing and reporting rather than on technology.

The digital equivalent

External scanning and enumeration of your infrastructure. Registration of lookalike domains, which is preparation. Certificates issued for names resembling yours. Collection of staff information from professional networks.

Reconnaissance-shaped activity against your applications — enumeration of accounts, probing of interfaces, systematic requests for pages that should not exist. Most of this is visible in logs nobody examines.

Separating signal from background

The internet generates constant automated scanning, which means volume alone says nothing. What distinguishes targeted reconnaissance is specificity: interest in your particular applications, your naming conventions, your named staff.

Lookalike domain registration is the clearest available signal, because it costs the adversary money and has no innocent explanation. See typosquatting.

Reducing what can be gathered

Attack surface management addresses the technical half: knowing and reducing what is externally visible.

The human half is being deliberate about what is published — detailed organisational structure, direct contact details for finance staff, technology specifics in job advertisements, photographs revealing badge designs or internal layout. None of it can be eliminated and some of it can be reduced.

Staff reporting is the mechanism

For the physical form, technology helps very little. What works is staff who notice something unusual and have an obvious, consequence-free way to report it, and someone who correlates reports rather than treating each as isolated.

That correlation is the part most often missing. Three separate reports of someone photographing an entrance mean something that none of them means alone.

Executives and high-risk staff

Senior figures, people handling sensitive negotiations and staff in contested contexts attract targeted attention combining physical and digital reconnaissance — travel patterns, home addresses, family details, personal accounts.

The practical measures are personal rather than corporate: reducing what is publicly discoverable about individuals, hardening personal accounts and devices, and awareness of travel exposure. It is frequently the gap in an otherwise mature programme, because it sits outside the corporate perimeter.

Correlation is what turns observations into a finding. A single report of someone photographing an entrance, a single unexplained scan of an application, a single lookalike domain each mean little alone. Recording them in one place, with dates, is what allows a pattern to become visible — and that record is the part almost no organisation maintains.

Where to start

Set up certificate transparency monitoring for your domain names and give staff a simple route to report anything unusual around your premises. Both are close to free.

See penetration testing. GuardsArm delivers threat intelligence.