Vacant Property Security: A 2026 Playbook

You've had the tenant hand back the keys, the fit-out team hasn't arrived yet, and the floor in Mayfair is sitting dark behind a compliant-looking door that still feels exposed. Or maybe it's a retail unit between leases, a few empty flats in a residential block, or an office waiting on refurbishment. In London, that gap between “occupied” and “gone live” is where vacant property security stops being a box-tick and becomes an operational plan.

Table of Contents

• Why Vacant Property Security Starts Before You Buy a Camera - Start with the vacancy brief - Decide the tier, then build the stack

• Running a Four-Step Risk Review Before Vacancy - Asset audit - Access audit - Environment and exposure audit - Turn the review into a tier

• Hardening the Building Layer by Layer - Build from the entry points inward - Make the building look watched, not abandoned - Match the hardening to the vacancy type

• Choosing the Right Monitoring Mix - CCTV with remote operators - Scheduled and randomised mobile patrols - Keyholding and rapid response

• Staffing, Reception and Concierge Decisions - Use people where access control still matters - Know when not to staff the building - Keep the front of house disciplined

• Compliance, Insurance and Choosing the Right Contractor - Check the policy before the service - Score contractors against the same questions

• Incident Response, Reporting and the Long Game - Keep the record useful, not decorative

Why Vacant Property Security Starts Before You Buy a Camera

A floor going empty in Mayfair is not the same problem as a retail unit between fittings, and neither is the same as a half-empty residential block. The location, the access pattern, the value of what's left on site, and the length of the vacancy all change what good protection looks like. That's why the first deliverable is never a camera quote, it's a vacancy risk profile.

The practical question is simple. What's on the site, who can get in, who notices if they do, and how long will the building sit empty? Those four answers usually tell you whether the site needs basic lock-up support, a monitored perimeter, a guard presence, or a full layered package.

Practical rule: if you can't explain the vacancy in one paragraph, you're not ready to buy controls yet.

Start with the vacancy brief

A one-page brief works if it names the asset, the exit date, the expected empty period, the known entry points, and the local exposure. It should also note whether the site sits in a busy street, a service yard, a quiet back alley, or a mixed-use block where residents or contractors are still coming and going. That context matters more than a brochure full of product names.

Use the brief to separate short, low-drama vacancies from the ones that need escalation. A small retail unit with a locked frontage and daily footfall outside can often be handled differently from a vacant office with roof access, service risers, and no natural surveillance. Residential blocks are their own category because people may still live next door to the empty unit, and that changes both detection and escalation.

For teams already running crime-prevention measures elsewhere, the vacancy brief should sit alongside existing site controls, not outside them, and the internal reference on crime prevention strategies is a useful companion point for that wider thinking.

Decide the tier, then build the stack

One practical way to structure the assessment is to classify the vacancy as low, medium or high risk.

The tier can then help determine the appropriate control mix.

That tier isn't paperwork for the sake of it. It's the bridge between the building and the rest of the playbook. Once it's clear, the rest becomes logical, assess the site, harden the weak points, choose the right monitoring, decide whether people are needed on-site, then line up compliance and response.

A manager who can write that vacancy brief cleanly can usually defend the plan to a landlord, an insurer, or a board without sounding vague. That's the standard to aim for.

Running a Four-Step Risk Review Before Vacancy

The risk review should be practical, not academic. A facilities lead doesn't need a long consultant deck to identify the weak spots, they need a repeatable method that spots what a thief, trespasser, or arsonist would notice first. The point is to map the site in the same order a problem would unfold, asset, access, environment, exposure.

The latest government dwelling-stock figures recorded 754,264 vacant dwellings in England in October 2025, up 4.8% from the previous year. Of these, 303,185 were classed as long-term vacant. Although these figures relate to residential dwellings rather than commercial property, they illustrate the scale of vacant-property management nationally.

Vacant properties can also face increased exposure to vandalism, unauthorised access, theft and fire, making ongoing inspection and security controls important rather than treating vacancy as a one-off lock-up exercise.

Asset audit

Start by listing what's in the building, not what should be there. Copper cabling, branded fit-out, plant, fixtures, loose tools, stock, and any equipment left behind all change the risk. If the site still carries items that are easy to remove or easy to damage, you're already beyond a simple padlock-and-leave setup.

The more visible and portable the asset, the more likely it needs protection before the site goes dark.

Access audit

Walk every door, window, roof hatch, fire escape, loading bay, basement opening, and shared lobby route. Don't assume the main frontage is the only problem. Vacant-property guidance in the UK repeatedly stresses checking secondary and service entrances, because a property is only as secure as its weakest point, and security measures that ignore one hatch or communal door are false comfort securing the unoccupied guide.

Environment and exposure audit

Look at lighting, sightlines, neighbouring activity, and whether anyone nearby is likely to notice tampering. Then check the insurance wording, contractual obligations, and reputational exposure. If the policy expects certain controls and the site doesn't meet them, the operational risk becomes a claims risk as well. That's not theory, it's the point where a preventable incident turns into a dispute.

Turn the review into a tier

A high tier site usually combines long vacancy, valuable contents, multiple access points, or a poor street environment. A medium tier site has some vulnerability but not enough to justify the most intensive package. A low tier site is short-term, tidy, and straightforward to inspect. Once the tier is fixed, the controls in the next stages stop being guesswork.

Hardening the Building Layer by Layer

Physical hardening works when it follows sequence, not shopping habits. The order matters because a reinforced shutter on the front means very little if the roof hatch is left weak, and a smart camera doesn't compensate for a service door nobody checked. UK guidance on unoccupied buildings is clear enough on this point, complete a risk review first, then secure every access point, then add proportionate steel protection, improve the site's presentation, and only then add monitoring where the risk profile justifies it securing the unoccupied guide.

A short vacancy may, following a risk assessment, require little more than appropriate locks, lighting and regular checks. A longer or higher-risk vacancy usually justifies reinforced entry points, internal steel screens or polycarbonate protection, and external shutters where street-level exposure is a problem vacancy duration and control bands.

Build from the entry points inward

Start with every access point, not just the obvious front door. That includes side doors, rear shutters, fire exits, communal access, roof entries, and loading bays. In commercial buildings, loading areas are often the weakest practical point because they're designed for movement, not resistance. In residential blocks, communal doors and stairwell access need the same attention because an empty flat is still part of a live building.

Then add the next layer only where the tier justifies it. Steel screens and shuttering make sense where the building has visible street exposure or a track record of interference. Internal protection over vulnerable glazing is useful where you want to reduce casual entry without turning the whole site into a construction zone.

Make the building look watched, not abandoned

Presentation matters more than many organizations admit. If the frontage is covered in old posters, the grounds are untidy, and the bin area looks forgotten, the site signals neglect. Clean lines, tidy perimeters, and visible upkeep don't solve every risk, but they do reduce the impression that nobody is paying attention.

Practical rule: a vacant building should look managed, not empty.

Graffiti-resistant coatings, removed waste, clean sightlines, and regular grounds tidying all support that impression. They also make it easier for patrols and cameras to spot what changed since the last visit, which is where real security value starts to show.

For teams already sorting access hardware elsewhere in the estate, the related internal guidance on access control systems fits neatly into the same decision set.

Match the hardening to the vacancy type

Retail sites need special care around frontage, display glazing, and loading access. Residential sites need emphasis on communal routes, parcel areas, and the line between occupied and unoccupied homes. Commercial offices need the roof, risers, and service entrances checked with more discipline than the reception door. The controls are similar, but the weak points are not.

A contractor should be able to read your brief and turn it into a layered spec without inventing their own assumptions. If they can't, the plan isn't clear enough yet.

Choosing the Right Monitoring Mix

Monitoring only works if it fits the site and the response behind it. A recorded camera with no one watching live is not the same thing as active CCTV, and a patrol that turns up at the same time every night soon becomes part of the pattern. On empty London sites, the practical choices usually come down to CCTV with remote operators, scheduled and randomised mobile patrols, and keyholding with rapid response.

Industry guidance on vacant commercial premises and risk notes that vacancy increases both criminal exposure and insurance concern. The same guidance also points to academic research showing that blocks with vacant properties were more likely to see drug and theft crime, and that blocks with unsecure properties saw more crime overall. Those figures are not UK-specific, but the operational lesson is the same on a London site, vacancy changes the risk profile fast.

CCTV with remote operators

CCTV works well where the site is large, dark, or awkward to staff, especially a multi-floor office or a vacant commercial building with no on-site team. Its strength is visibility and evidence. Its weakness is plain, if nobody is actively watching or escalating, the camera records incidents instead of controlling them.

Use CCTV where you need live challenge, real-time alerts, and a clean audit trail. It is a poor fit if the building has unstable power, blind spots, or a frontage that cannot be covered properly. If the whole plan depends on cameras, it is too thin.

Scheduled and randomised mobile patrols

Patrols fit sites where a physical presence changes behaviour, such as a cluster of retail units on a high street or mixed-use properties with a visible uniformed visit. The value is not only inspection, it is unpredictability. Once visits become too regular, the pattern becomes part of the risk.

A proper patrol service should produce a verifiable record of visits, including relevant perimeter and lock checks and, where appropriate, supporting photographic evidence.

It should also show when the site was visited and what was found, because that record matters for operations and for insurance. If you need a practical comparison of front-of-house cover alongside monitoring, London concierge services can sit in the same decision set when a building still has limited occupancy or controlled access.

Keyholding and rapid response

Keyholding is the right bolt-on for alarm activations, out-of-hours callouts, and sites that need fast entry after an event. It does not replace monitoring, but it closes the response gap when a sensor or alarm triggers. For many London buildings, that matters more than adding another passive layer.

The strongest setup is usually layered. CCTV gives awareness, patrols add unpredictable presence, and keyholding closes the response loop. One supplier can bundle those services, but the controls still need to be chosen as separate functions, not treated as a generic package. Solomon's Facilities Management is one London option that combines CCTV monitoring, mobile patrols, keyholding, and front-of-house cover under one contract, which suits sites that need fewer handovers and clearer escalation.

Staffing, Reception and Concierge Decisions

Not every vacant building needs a person on-site, but some absolutely do. The deciding factor is whether the building still has people moving through it, even partially, and whether the remaining activity creates access risk. That's where static guarding, reception cover, or concierge staffing becomes a security decision rather than a hospitality one.

Use people where access control still matters

A static guard makes sense when the building has ongoing contractor traffic, shared entry points, or a history of trespass that technology alone hasn't controlled. Reception or concierge cover is a better fit when the site still has tenants, visitors, or residents who need a professional front-of-house presence. In residential blocks, concierge staff can also handle parcels, assist residents and report signs of interference or unusual activity in accordance with the site's agreed procedures.

Where staff are carrying out licensable security activities, make sure they hold the appropriate current SIA licence. Continuity matters too. The same dedicated team learns who belongs on site, what the normal routine looks like, and which anomalies deserve escalation.

Know when not to staff the building

If the site is empty and the main need is perimeter control, patrols plus monitoring may be enough. Adding a person just because the contract budget allows it isn't a security strategy. It can create unnecessary cost without improving the actual risk picture.

A person on-site is most valuable where judgement and challenge matter more than constant observation.

That's why mixed-use and partially occupied buildings need a sharper call than fully vacant offices. If there are still residents, live tenants, or regular contractors, a person can stop bad access decisions before they become incidents. If the building is fully dark and sealed, the same spend might be better directed into monitoring and response.

Keep the front of house disciplined

Reception and concierge cover only works if the process is consistent. Check-in, badge issuance, visitor directions, contractor verification, and incident escalation all need defined routines. A polished front desk without a real access procedure just makes the site look busy.

For buildings that need a combined security and front-of-house model, London concierge services are often the closest operational fit, because they can support both visible deterrence and routine access control without fragmenting the handover chain.

Compliance, Insurance and Choosing the Right Contractor

A vacant-site plan can fail on paperwork long before it fails on the ground. If the contractor cannot show what they did, or the setup does not match the policy wording, the whole arrangement becomes shaky. Compliance and procurement need to be handled together. Insurers may require evidence of compliance, while landlords and boards need a plan that can stand up to scrutiny after an incident.

Check the policy before the service

Start with the insurance wording. Vacancy clauses often change cover once the building is unoccupied, and the conditions can include inspection frequency, utility isolation, secure openings, and evidence of ongoing control. If the site does not meet those conditions, an informal check may not be enough to satisfy the requirements of the policy.

Keep the duty of care clear too. If anyone still has access to the building, including contractors, residents, or visitors, the site must be managed as a live risk environment.

Appropriate risk assessments and, where the nature of the work requires them, method statements should be in place.

Score contractors against the same questions

Before you sign, ask for SIA licensing, proof of insurance, vacant-site experience, incident reporting standards, escalation procedures, and evidence of clip retrieval speed where CCTV is involved. Ask how patrols are logged, how quickly issues are escalated, and whether the provider can coordinate security, cleaning, and concierge if the site needs all three. The answer matters because vacant offices, residential blocks, and retail units fail in different ways, and a contractor who only knows one type of site can miss the key weak points.

Criterion	What to ask for	Why it matters
SIA licensing	Appropriate current SIA licences for personnel carrying out licensable security activities	Confirms that the relevant licensing requirement has been met.
Insurance cover	Employer's liability and public liability details	Reduces exposure if an incident happens on site
Vacancy experience	Examples of empty-site work, not generic security	Vacant buildings fail in different ways
Reporting	Sample patrol logs and incident records	Insurers and boards require concrete evidence
Escalation process	Named contacts and response steps	Stops delay when a breach or alarm happens
CCTV handling	Clip retrieval process and response time	Useful for claims, police, and internal review
Single-supplier scope	Security, cleaning, concierge where needed	Cuts handover gaps and responsibility drift

Incident Response, Reporting and the Long Game

When something does go wrong, speed matters, but sequence matters more. The response should run in order, detection and verification, escalation to the keyholder or police, on-site attendance, digital logging, then review. If the team skips logging because the event was minor, the next incident will be harder to understand and harder to prove.

CCTV clip retrieval, police liaison, and tenant or resident updates all need to happen without drama. People want facts, not speculation. The report should say what was found, when it was found, who attended, what was secured, and what needs to be fixed next.

Keep the record useful, not decorative

A good incident log helps with the claim, but it also shows patterns across multiple sites. If the same type of access issue keeps appearing at different buildings, the controls need adjusting. If patrol notes keep flagging one loading bay or rear alley, the site plan should change before the next callout.

That's the long game, use each event to tighten the model. The vacancy brief, the tier, the hardening spec, the monitoring mix, and the staffing decision all need to stay live, not frozen in the file drawer.

For a quick recap, short vacancies often sit on lock-up, lighting, and targeted checks. Medium-risk sites usually need layered monitoring and tighter access control. High-risk, long-duration, or partially occupied sites need the full programme, people, process, evidence, and escalation.

If you're managing an empty office, a vacant retail unit or a residential block with unoccupied flats, Solomon's Facilities Management can coordinate SIA-licensed security personnel, mobile patrols, CCTV monitoring, reception and concierge services across London.

Visit Solomon's Facilities Management to discuss a vacancy plan that fits the site, the policy, and the way your building works.