From patchwork systems to a unified SOC

The company

Pikes Peak Library District (PPLD) is one of Colorado Springs’ most-used public institutions, serving the El Paso County community across multiple branches with 780 cameras and more than 150 doors under active monitoring.

Their physical security program had been trying to keep pace. Legacy systems dating back to the late 1980s. Cameras and access control systems that didn’t talk to each other. A small team buried under too many alarms.

The model was reactive, and it was overdue for a rethink.

The challenge

PPLD’s footprint was growing in a few ways, through new construction and the addition of more rural buildings under its umbrella – and Chief Facilities & Security Officer Michael Brantner needed more visibility across all of the buildings. Combining the systems in place to protect these locations, plus the new ones, required a new approach: bring decades of legacy security technology into a unified, modern operation that could scale alongside the district’s growth.

PPLD wanted to centralize the management of the district’s security function, which led Michael to explore the creation of a new security operations center (SOC).  

“We had a lot of technology that didn’t talk to each other,” Michael said. “We wanted to be able to consolidate it into one place where we can manage what’s happening across our sites.”

When he started building PPLD’s SOC, the mandate was clear: bring decades of legacy security technology into a unified, modern operation that could scale alongside the district’s growth. But he also needed to consolidate disconnected systems, prove ROI to the C-suite, and staff and train a team that could actually move the program forward.

At the time, PPLD’s setup was a patchwork: 

• Cloud-based cameras and access control sitting next to legacy equipment, with no shared view across them
• Operators who were refreshing screens to see new alarms
• Panic alerts, door alarms, and intercom calls each requiring a different screen, a different workflow, and a different response 
• Notifications were inconsistent
• Response times couldn’t be measured
• No centralized SOC to manage alarms cohesively 

Most incoming alarms generated by PPLD’s ACS were false: held-open doors, cleaning crews, and after-hours trip alarms. But every single alarm still demanded a response from someone on the team, even if there was no safety issue.

The complexity was real. PPLD’s branches serve a diverse community that includes families, students, and residents experiencing homelessness across locations with very different security profiles. Some deal with routine access events. Others face behavioral incidents, policy enforcement issues, and higher alarm volumes. Across all of them, public spaces had to stay public, and private staff areas had to stay private. Those boundaries need to be enforced, all day, every day.

The solution

As Michael stood up PPLD’s new SOC, HiveWatch stood out as a way to centralize the security program and allowed the growing team a single, active view of every incident across every system. 

The platform connected directly to PPLD’s existing cameras and access control systems. This meant operators were able to view door alarms, access events, video clips, panic alerts, and environmental sensors (including vape and smoke detection) in one single incident list in a web-based browser. Instead of refreshing screens and guessing at what they might have missed, operators could see every active incident and incoming alarm the moment it surfaced and respond from the same place.

Alarm deduplication cut volume on day one, killing redundant alerts before they hit an operator. Noisy doors became easy to spot and fix. When specific issues surfaced, like a flood of DHO alarms, for instance, the system helped the SOC adjust alarm timing. That adaptability, tuned to actual door and user behavior without loosening security, kept the program compliant and cut the alarm load the SOC had to manage.

Operators, along with field officers, made use of the mobile app, too. The team’s ability to acknowledge, investigate, and resolve incidents from anywhere in the building was a huge benefit. Security triage stopped being tied to a desk. Response became coordinated, in real time, across every location.

But the shift went beyond operations. For the first time, PPLD’s leadership had detailed data on its security program: response times, alarm volumes, and incident trends. Michael could walk into a leadership meeting with numbers that proved the program’s value. He could spot which operators were hitting targets, which branches were generating outliers, and where more operator or officer training was needed.

What it looks like in practice

Every shift, PPLD’s operators manage a single active queue. Door forced at a branch. Vape detection in a restroom. Held-open back door after a cleaning crew shift change. An intercom call from a side entrance. All surfaced in one view without screen-refreshing or system-hopping.

When an access control alert comes in, the response is immediate. The operator sees the alert with the connected camera feed in the same view, follows the built-in standard operating procedure (SOP), and, if warranted, dispatches the field officer with full context from within the platform. Audible alerts mean the SOC can run HiveWatch in a single tab without sacrificing a full monitor, freeing operators to handle more important work like footage pulls, door testing, and badge creation between incidents.

“HiveWatch makes the operators more flexible and makes them more versatile, as well,” Michael said. “They’re able to focus on something else and it will prompt them and say, hey, pay attention. We have to interact. They can check it out, dispatch somebody, and then go back to what they’re doing.”

And when something crosses the public-private line, such as a patron drifting into a staff-only corridor, the platform surfaces it in real time. The operator sees it, the field officer responds, and the boundary holds. Public stays public. Private stays private.

No guessing. No discovery after the fact. Incidents are caught early, handled according to protocol, and documented with a full record attached.

“The biggest benefit for us is having the tool that sorts through the noise and focuses the operators on the notifications that are actually coming in that need attention,” Branter said.

The results

• Median time to acknowledge incidents of 21 seconds and median time to resolve of 28 seconds using HiveWatch.
• Scaled the SOC from 2 operators to 6 plus a manager, with the platform absorbing the workload increase.
• Extended the SOC beyond the control room with mobile triage and response for field officers and operators.
• Equipped leadership with real-time data on acknowledgement and response times, and alarm trends, turning a reactive program into a proactive, measurable one.
• Positioned the program to absorb 800 additional cameras and access points without proportional headcount growth.

HiveWatch positions your team to scale. See how it can help your organization. www.hivewatch.com/demo