Theft Happens on a Schedule, Not at Random

The instinct is to think of jobsite theft as opportunistic. The data tells a more specific story.

More than 40% of confirmed break-ins happen on Saturdays and Sundays, when sites are empty and there’s no crew around to notice anything out of place. Within that, the heaviest concentration of incidents falls between 11 p.m. and 3 a.m. — after any late-night activity in the area has died down and well before the first crew member shows up in the morning.

There’s a seasonal pattern too. Incidents climb in spring, when longer daylight gives criminals more time to scope a site before dark, and climb again through the back half of the year, when construction activity peaks and more sites have more material staged and ready to move.

If a project is ramping up heading into spring or summer, its risk profile is higher than it was in January — and that’s exactly when the gaps in a site’s plan need to be closed, not after the first loss.

Most Break-Ins Aren’t Sophisticated. They’re Just Easy.

It’s tempting to picture jobsite theft as a break-in with bolt cutters, a cut fence and someone climbing over a wall in the dark.

In practice, the far more common scenario is simpler and less dramatic: a truck drives onto the site through a gate that was never locked, backs up to a conex box or a laydown area, loads up in 10 or 15 minutes and leaves.

Unlocked or unsecured gates are a common enabler of site theft. Not a cut lock — no lock at all, or a gate left open at the end of a shift because closing it wasn’t part of anyone’s actual job. A determined criminal can get past a fence regardless.

We’ve seen plenty climbing fences that looked impossible to climb or sliding under them, but the fence and the gate only work as a deterrent if closing them is a documented, checked step, not an assumption.

What gets taken tracks with what’s easiest to move and resell: copper wire and conduit, lumber and roofing material staged in laydown areas, generators and temporary power equipment, and heavy equipment left overnight with keys still accessible.

The Insider Problem Most Companies Don’t Want to Look At

External theft gets the attention. Insider activity gets ignored, mostly because no one wants to be the one who raises it.

After-hours access by credentialed workers, such as someone with a badge or a key showing up outside normal hours, without a documented reason, is one of the most common things that shows up in monitoring reviews. Sometimes that’s completely innocent, like a superintendent checking on something or a foreman dropping off gear. Sometimes it isn’t. Either way, this activity rarely gets logged as theft in a post-incident review, because there’s no single incident that triggers one. Material simply doesn’t reach the count, and the loss gets absorbed into “shrinkage” instead of investigated.

The fix is a documented standard: After-hours presence requires supervisor sign-off, material staging areas get the same coverage as the perimeter, and any material shortage triggers a log review, not just a confirmed break-in. That standard is only as good as the verification behind it. A live monitoring team reviewing footage as it happens, working from a schedule of who’s supposed to be on-site, can tell the difference between an authorized worker and a problem in real time instead of reconstructing it after the shortage.

Why Most Security Setups Fail

Fencing, signage and padlocks slow a determined person down by only minutes, and they generate no information about what actually happened. A camera that only records gives a company a video of the loss after the fact, which is useful for the insurance claim, not for stopping anything.

The sites that get hit once instead of repeatedly are the ones that layer physical controls with an active response — something that can tell the difference between a foreman checking on the site at 9 p.m. and a stranger backing a truck up to a conex box — and can act on that difference in real time rather than waiting for someone to review footage on Monday morning. In monitoring data reviewed across thousands of sites, routine employee activity accounts for close to a third of all triggered alarms, which means without a way to filter for context, most “security systems” are just generating noise, and noise gets ignored.