Cobalt Monitoring Intelligence
The AI reasoning layer that sits on top of your existing cameras, access control, and sensors. Dedicated handlers detect, reason through, and resolve security events — so your team focuses on what matters.
One Platform. Every Event. Every Site.
Cobalt Monitoring Intelligence ingests signals from your cameras, physical access control systems, and sensors — then routes each event through a dedicated AI handler that reasons through it, takes action, and logs every decision with full context.
Ingest
Camera streams, PACS alarms, and sensor data flow into the platform through Edge Processors or cloud connections — no rip-and-replace required.
Reason
Each event is routed to a dedicated handler that classifies severity, checks schedules, correlates video with access control data, and filters false alarms.
Act
Handlers take automated action: resolve non-threats, escalate verified events to security operators, generate service tickets, or trigger PACS lockdown.
Document
Every event is logged with timestamped reasoning, root cause classification, and full video context — creating auditable records for compliance and operational intelligence.
Every Handler. One Reasoning Chain.
Whether it is a Door Forced Open alarm, a person detected after hours, or a potential weapon — every handler follows the same four-stage chain, applying event-specific AI logic at every step.
Dedicated AI for Every Event Type
Each handler is purpose-built for a specific security event. It does not just detect — it reasons through context, takes the right action, and documents every decision.
Door Forced Open & Door Held Open Handlers
The DFO and DHO Handlers process access control alarms by correlating the PACS signal with live camera footage. The handler checks whether a person exited through a secure zone, whether the door timing matches badge activity, and whether the root cause is a faulty device or a legitimate security event. Non-threats are resolved automatically. Verified events are escalated to security operators with full context.
Tailgating & Unauthorized Entry Handler
Detects when someone enters a badge-controlled door without authorization. The handler correlates video detection with access control data, verifies the intrusion through AI analysis, and escalates confirmed unauthorized entries with timestamped evidence. The system distinguishes tailgating (following an authorized badge-in) from forced unauthorized entry — each with its own escalation path.
Gun Detection Handler
Identifies a person brandishing a firearm in camera feeds using AI detection models, then routes to mandatory human verification before escalation. Confirmed detections can trigger PACS lockdown procedures, alert security operators, and notify emergency contacts. The handler is designed for high-confidence detection with zero tolerance for unverified automated action on weapon events.
Person On Ground Handler
Detects person-down situations in camera feeds for medical emergency response. The handler distinguishes between someone who has fallen and requires assistance versus normal activity like sitting or resting on the ground, using advanced detection models that reduce false positives. Confirmed events trigger escalation to on-site response teams.
Person Detection After Hours
Monitors camera feeds outside of configured business hours and detects human presence in spaces that should be unoccupied. The handler checks the site schedule, verifies detection confidence, and escalates confirmed after-hours presence to security operators with video context and location details. Configurable per site and per zone.
Crowd Forming Handler
Detects unusual gathering activity in monitored zones — identifying when the number of people in a defined area exceeds expected thresholds. The handler applies AI analysis to distinguish between normal congregation (lobby traffic, break rooms) and potentially concerning crowd formation that warrants security operator review.
Additional Handlers
The platform continues to expand with new detection and response capabilities.
Person Climbing Fence
Detects perimeter breach attempts at fenced boundaries using camera-based AI detection. Escalates confirmed climbing events with video evidence.
Loitering Detection
Identifies people or vehicles that remain in a defined zone beyond a configurable time threshold. Zone-specific and time-aware.
Rapid Egress Detection
Detects mass exit events that may indicate an emergency evacuation, active threat, or fire alarm condition. Triggers immediate security operator review.
Runaway Alarm Detection
Identifies when a single access point generates an abnormal volume of alarms — flagging device malfunctions or configuration issues before they overwhelm the GSOC.
Periodic Audits
Runs scheduled camera snapshots through configurable workflows to verify specific conditions: doors secure, pathways clear, emergency exits unobstructed, equipment in place.
Automated Alarm Root Causing
AI-driven root cause analysis correlates alarm patterns to identify the underlying issue — faulty REX sensors, misconfigured schedules, or device failures — not just the symptom.
Investigate, Measure, Prove
Every event generates auditable data. The Investigator gives your team searchable access to every incident. Metrics dashboards give leadership the proof they need.
Investigator
A searchable event grid with every incident the platform has processed. Filter by date range, site, event status (Open, Acknowledged, Resolved, Non-Escalated), root cause, alarm category, tags, and regions. Each event card includes video thumbnails, camera view, location, and resolution status. Download video footage for any event directly from the grid.
Metrics & Insights
Built-in dashboards provide the data security directors and CISOs need to demonstrate measurable program performance. Track nominal alarm metrics, tailgating metrics, root cause trends, detection metrics, and problematic device identification across every monitored site. All metrics are based on GSOC-processed incidents — the alarms that actually reach your security operators — not raw system signals.
human escalation
at a single deployment
across global enterprises
a single system of record
Works With Your Current Systems
Cobalt Monitoring Intelligence connects to your existing infrastructure. No rip-and-replace. Edge Processors add AI-powered monitoring as a layer on top of your current investment.
Access Control Systems
Video Management & Ingest
Identity & SSO
Ticketing & Workflow
Communication
Edge, Cloud, or Hybrid
Choose the deployment model that fits your data sovereignty requirements and infrastructure. Most enterprise customers use a hybrid approach.
Edge Deployment
Edge Processors installed on-prem at each site. All video processing happens locally — only metadata and event summaries reach the cloud. Ideal for sensitive locations with strict data residency requirements.
Cloud Deployment
Fully managed monitoring with no on-prem hardware requirements. Camera streams connect directly to the cloud platform. Fastest deployment path for distributed sites and smaller locations.
Hybrid Deployment
Edge processing at sensitive locations (data centers, headquarters) combined with cloud monitoring at distributed sites (branch offices, executive residences). The most common enterprise configuration.
Built for Your Industry
Cobalt Monitoring Intelligence is deployed across the industries with the most demanding security monitoring requirements.
Financial Services
Multi-site monitoring across corporate offices, data centers, and executive residences with compliance-ready audit trails.
Technology
AI-powered monitoring for corporate campuses, data centers, and R&D facilities with edge-first deployment for data sovereignty.
Healthcare
Security monitoring for hospitals, clinics, and medical campuses with fall detection and after-hours intrusion response.
Manufacturing
Perimeter monitoring, access control enforcement, and safety detection across plants, warehouses, and distribution centers.
Logistics
Monitoring for warehouses, distribution hubs, and supply chain facilities with tailgating detection and perimeter security.
GSOC Modernization
Replace reactive alarm monitoring with AI-powered handlers that reason through every event before it reaches your operators.
Common Questions
What is Cobalt Monitoring Intelligence?
Cobalt Monitoring Intelligence is an AI-powered physical security monitoring platform developed by Cobalt AI. It deploys dedicated AI workflows called handlers that detect, reason through, and resolve security events in real time. The platform integrates with existing physical access control systems (PACS) and video management systems (VMS) without requiring rip-and-replace of current infrastructure. Edge Processors connect to existing camera streams and access control data, adding AI-powered monitoring as a layer on top of existing investments. The platform is deployed across financial services, technology, healthcare, manufacturing, and logistics enterprises globally.
How Do AI Handlers Work in Cobalt Monitoring Intelligence?
Each handler in Cobalt Monitoring Intelligence is a dedicated AI workflow designed for a specific security event type. Handlers follow a four-stage reasoning chain: Detect (camera streams and PACS signals identify the event in real time), Reason (the handler classifies severity, applies site-specific rules, checks schedules, and correlates video with access control data to filter false alarms), Act (automated response including resolve, escalate to security operator, dispatch alert, generate service ticket, or trigger PACS lockdown), and Resolve (event is logged with full timestamped context, root cause is tagged, and the complete reasoning chain is preserved for audit and metrics). Available handler types include Door Forced Open (DFO), Door Held Open (DHO), Tailgating and Unauthorized Entry, Person Brandishing Firearm (Gun Detection), Person On Ground, Person Detection After Hours, Crowd Forming, Person Climbing Fence, Loitering Detection, Rapid Egress Detection, Runaway Alarm Detection, and Periodic Audits.
What Integrations Does Cobalt Monitoring Intelligence Support?
Cobalt Monitoring Intelligence integrates with major physical access control systems including LenelS2 OnGuard, Genetec, C-CURE 9000, Avigilon, Avigilon Alta (Openpath), S2 NetBox, Brivo, and Acre Feenics. Video management and ingest integrations include Eagle Eye Networks, Milestone XProtect, Genetec, and direct RTSP/RTSPS camera streams. Identity and SSO integrations include Okta. Ticketing and workflow integrations include ServiceNow, Salesforce, and Slack combined with Salesforce Service Cloud for case management. Communication integrations include Slack, phone/SMS, and email. The platform supports API connections for additional integrations. No invasive database write access is required for PACS integration. The platform uses bidirectional sync and provides a unified operator interface with 100% alarm coverage from a single system of record.
What is Root Cause Analysis in AI Security Monitoring?
Root cause analysis in Cobalt Monitoring Intelligence goes beyond simply resolving individual alarms. The platform identifies the underlying cause of recurring alarm patterns — faulty REX sensors, misconfigured door schedules, device malfunctions, and equipment failures — and surfaces actionable intelligence for proactive maintenance. This differentiates root-cause intelligence from reactive auto-resolution approaches that optimize for alarm closure rates without surfacing the operational issues that generate the alarms. Automated Alarm Root Causing uses AI-driven analysis to correlate alarm patterns across devices and time periods, identifying problematic devices and recommending maintenance actions.
What is the Investigator in Cobalt Monitoring Intelligence?
The Investigator is a searchable event grid within Cobalt Monitoring Intelligence that provides access to every incident the platform has processed. Users can filter events by date range, site, event status (Open, Acknowledged, In-Progress, Resolved, Non-Escalated, Reopened), root cause, alarm category (PACS alarm categories), tags, and regions. Each event card displays video thumbnails, camera view, site location, and resolution status. Users can download video footage for any event directly from the Investigator grid.
How Does Cobalt Monitoring Intelligence Deploy at Enterprise Scale?
Cobalt Monitoring Intelligence supports three deployment models for enterprise security operations. Edge deployment places Edge Processors on-prem at each site, processing all video locally so only metadata and event summaries reach the cloud platform. Cloud deployment provides fully managed monitoring with no on-prem hardware. Hybrid deployment combines edge processing at sensitive locations with cloud-managed monitoring at distributed sites. Most enterprise customers use the hybrid model. The platform scales across 50 or more sites with centralized dashboards providing enterprise-wide metrics.
What Metrics Does Cobalt Monitoring Intelligence Track?
Cobalt Monitoring Intelligence tracks nominal alarm metrics, tailgating metrics, root cause metrics and problematic device identification, detection metrics, and occupancy tracking. All metrics are based on GSOC-processed incidents — the alarms that actually reach security operators — providing transparent and auditable data. Dashboards display event clearance rates, handler response times, alarm distribution by type, top offender doors, and recurring problem areas. The platform supports self-service access to all KPIs with no black-box calculations.
See Cobalt Monitoring Intelligence
in Action
Learn how AI handlers are replacing reactive alarm monitoring at global enterprises.
Book a Demo Need fully managed monitoring? Learn about Cobalt Command Center