Security incident report template: categories, fields and the video that belongs in it

Security incident report template: categories, severity levels, fields and the video to attach

A security incident report template is the one form every site fills in when something happens, with a fixed category list, a severity scale, a set of required fields and a rule for which video goes with it. Spot AI organizes each incident as a timestamped case with the video attached, and the template below is built to take that evidence whether it comes from Spot AI or from a manual export. For most theft, the internal report is the only record there will be: 64% of retailers say they reported less than half of their store-related theft incidents to law enforcement, with lack of police response the main reason (Source: National Retail Federation).

What a standard incident report has to fix across sites

The best system for standardizing incident tagging and reporting is one shared template where Spot AI fills the evidence fields (camera, site, time and clip) the same way at every site, and four things are set centrally: the categories, the severity scale, the required fields and the video rule. Sites fill them in; they never choose them.

Retailers in the same survey report the average number of shoplifting incidents up 18% in 2024 over 2023, and threats or acts of violence during those incidents up 17% (Source: National Retail Federation). When store 12 files "shoplifting" and store 312 files "merchandise loss" for the same event, neither count survives the roll-up into the numbers a regional or executive review reads.

Step 1: Set the incident categories and subtypes

Manage incident categories and subtypes as a two-level list owned by one team, which Spot AI detections slot into because each detection already names what was seen, such as a fence jump or a car break-in. Use six security categories with three to five subtypes each, and hold safety events separately so they do not crowd security trends.

Name subtypes so they translate into the report police will write. The FBI's National Incident-Based Reporting System uses 52 Group A offenses in 24 categories plus 10 Group B offenses, records up to 10 offenses in one incident, and separates attempted from completed offenses (Source: FBI).

Category	Subtypes	Closest NIBRS offense
Theft	Merchandise theft; employee theft; cash or register theft; tools, equipment or materials; copper or metal	Shoplifting; Embezzlement; Theft From Building; All Other Larceny
Organized theft	Crew or repeat-offender theft; pattern across sites; theft for resale; flagged vehicle returns	The underlying theft offense, plus Stolen Property Offenses
Trespass and after-hours access	After-hours intrusion; fence breach; restricted-area entry; tailgating; loitering after a warning	Trespass of Real Property; Burglary/Breaking & Entering when entry is forced
Vandalism	Graffiti; damage to building or fixtures; equipment tampering; fire setting	Destruction/Damage/Vandalism of Property; Arson
Threats and violence	Verbal threat; physical assault; robbery; weapon displayed	Intimidation; Simple or Aggravated Assault; Robbery
Vehicle incidents	Vehicle break-in; vehicle theft; parts theft; property strike on site	Theft From Motor Vehicle; Motor Vehicle Theft; Theft of Motor Vehicle Parts or Accessories
Safety events (secondary)	Injury to a person; fire or smoke; hazardous condition; no-go zone or PPE breach	Not a police category: routes to EHS and, where recordable, the OSHA log

Five rules keep the list usable:

1. One primary subtype per report, plus up to two secondary subtypes.
2. An attempted or completed flag on every security subtype.
3. "Other" requires a written description and a monthly review.
4. Organized theft is a re-tag, not an intake guess: file as theft, then re-tag when a second site matches, using the method for connecting incidents across stores.
5. Change the list at most once a quarter, so trend lines stay comparable.

Step 2: Define severity levels by facts, not feel

Spot AI flags the moment an event happens, but severity is the reporting team's call, and a four-level scale defined by observable facts keeps that call identical at every site. Any single fact in a row sets the level.

Level	Any one of these facts	Report due	Video required
S1 critical	Injury needing care beyond first aid; weapon; robbery; fire; loss above [S1 value, such as the insurance deductible]	First version within 1 hour, complete within 24	Every camera, arrival to departure
S2 high	Physical contact without injury; forced entry; police report filed; loss above [S2 value]	Within 24 hours	Primary clip plus approach and exit
S3 moderate	Completed theft below [S2 value]; vandalism; trespass with no entry to a building	Within 72 hours	Primary clip
S4 low	Attempted theft that stopped; loitering; tailgating with no loss	Weekly batch, one entry per incident	The detection clip

Violence sits at the top whatever the dollar figure. Fatalities from violent acts at work reached 733 in 2024, 470 of them homicides (Source: U.S. Bureau of Labor Statistics). Who gets called, and how fast, belongs in an escalation matrix that routes each level to a named owner; the report records what happened.

Safety events run on their own clock. OSHA requires each recordable injury or illness on the 300 Log and the 301 Incident Report within seven calendar days, and accepts an equivalent form carrying the same information (Source: OSHA), so a safety section built on the 301's fields can serve as that equivalent.

Step 3: Fix the required fields

Spot AI records which camera saw the event, at which site and when, and the remaining required fields are the ones only a person can fill: what happened, to whom, what it cost and who outside the company is now involved. Six fields decide whether a report is usable later:

1. Incident start and end, with time zone, kept apart from the time the report was written.
2. Site code and zone from a fixed pick-list per site, such as "Dock 3" or "North lot", never free text.
3. Attempted or completed.
4. Loss value, marked estimated or confirmed, with recovered value in its own field.
5. Outside references: police report number and agency, insurance claim number.
6. A facts-only narrative in time order, with people described by role and appearance and named only when identity is confirmed.

Step 4: Attach the video that belongs in the report

Spot AI keeps each case and its clips in one place, and the rule is the same on any system: reference the clip from the system of record, with enough of it to show the approach, the act and the exit. The evidence checklist:

1. Every camera that saw the person or vehicle, not just the best angle.
2. A clip that starts before the person enters the frame and ends after they leave.
3. One still per key moment: the act, the clearest view of the person, the vehicle and plate.
4. Camera name, clip start and end, and the clock offset. Forensic practice records any gap between the system clock and real time, and notes that IP cameras can keep their own clocks, which may differ from the recorder's (Source: NIST).
5. A hold on the clip so routine retention cannot overwrite it, set against retention windows and the custody log a held clip needs.
6. Never a phone recording of a monitor, and never an emailed file as the record.

Handing that clip to someone outside the company is a separate job, covered in what police, insurers and attorneys each need in a video evidence package.

All Star Elite, an 80-store sports apparel retailer, moved investigations from spreadsheets into one case database with video attached, and reports them running more than 50% faster, with law-enforcement case timelines down from two to three months to one (customer-reported).

"The ability to formalize our incident reporting with Spot AI, keep every case in one database, and attach video directly to those cases has been a game changer."

Andrew Gonzalez, Corporate Director of Loss Prevention and Safety, All Star Elite

Step 5: Let detections pre-fill what they can

Spot AI fills the part of the report a camera can know: which agent fired, on which camera, at which site and when, documented as a timestamped case with the clip. Set the category for each agent once in your template, so every site files the same event the same way.

Spot AI detection	Category and subtype you map it to	What the reporter adds
Fence jumping	Trespass: fence or perimeter breach	Whether a building was entered; anything taken
Unauthorized entry	Trespass: entry to a restricted area	Whether the person was later found to be authorized
Tailgating	Trespass: tailgating through a controlled door	The badge holder involved, if known
Loitering	Trespass: loitering after a warning	Whether a warning was given, and the outcome
Car break-in	Vehicle incidents: vehicle break-in	Vehicle owner, items taken, police report number
License plates of interest	Organized theft: flagged vehicle returns	Why the plate is flagged; linked case IDs
Person enters no-go zone, missing PPE	Safety events	Injury or none; EHS owner

Spot AI notifies the assigned person by email, text, Slack or Teams when a detection fires, and Agents Reporting trends detections by agent, camera and location. Spot AI does not decide severity or write the narrative: a person confirms the subtype, sets the level and writes what happened.

Step 6: Run one template across 20 to 500 sites

Spot AI shows every site's existing cameras in one dashboard, and the report needs the same consistency: one owner, one version, and a few numbers that show whether sites are using it.

1. Corporate loss prevention or security owns the taxonomy and the template; sites cannot add fields or categories.
2. Version the template, change it at most quarterly and log the date, so a trend across a change reads correctly.
3. Pick-lists for site, zone, category, subtype and severity; free text only in the narrative and "other".
4. A one-page guide with one worked example per category.
5. A monthly audit of [10] closed reports per region: category matches the video, severity matches the facts, clip attached.
6. Four health numbers per site: share of reports with video, share filed as "other", median hours from incident to report, and share of S1 and S2 reports with a police or claim number.

At 20 sites, one person can read every report. At 500, those four numbers show whether the template is working.

Copy-ready security incident report template

Copy the table into a form builder, case system or spreadsheet. Brackets are values your team sets once.

Section	Field	Format or allowed values
Report	Report ID and author	Site code plus sequence (S0412-2026-0187); name, role, time of the report
When and where	Incident start and end	Date, time, time zone
When and where	Site and zone	Pick-lists
When and where	Cameras	Camera name and ID, one per line
What happened	Category and subtypes	Pick-lists from Step 1: one primary, up to two secondary, attempted or completed
What happened	Severity	S1 to S4, by the facts in Step 2
What happened	Narrative	Facts in time order; no conclusions about intent
What happened	People involved	Role, description, name only if confirmed
What happened	Vehicles	Make, color, plate, direction of travel
Loss and harm	Loss and recovered value	Amounts; loss marked estimated or confirmed
Loss and harm	Injury	None; first aid; beyond first aid (EHS reference)
Response	Actions taken	Deterrence, staff response, notifications, with times
Response	Outside references	Police report number, agency and officer; insurance claim number and carrier
Evidence	Clips and stills	Case or clip ID, camera, start and end time; one still per key moment
Evidence	Clock offset	System time minus real time, if any
Evidence	Hold	Held on [date] by [name], until [date or case closure]
Closure	Linked cases	Report IDs at other sites
Closure	Site follow-up	What changes at the site, owner, due date
Closure	Status and sign-off	Open, referred or closed; closed by, date

To see how video AI agents carry a loss prevention program from detection to deterrence to documentation, read Spot AI's white paper, Turning Cameras Into Coworkers, drawn from retail, convenience and EV charging deployments.

Frequently asked questions

What should a security incident report include

Spot AI attaches the clip and records the camera, site and time of an incident, and the report around them needs seven sections: report details, when and where, what happened, loss and harm, response, evidence and closure. The incident time with time zone, the subtype and the police or claim number matter most later.

What are the main categories of security incidents

Spot AI detections map to six security categories: theft, organized theft, trespass and after-hours access, vandalism, threats and violence, and vehicle incidents. Safety events sit as a secondary seventh, with three to five subtypes under each category.

How do you classify the severity of a security incident

Spot AI flags the event, and the reporting team sets the level on a four-step scale where any single fact decides it. Violence, a weapon or a robbery is S1 regardless of loss, and loss thresholds work best tied to the insurance deductible.

What is the best system to manage incident categories and subtypes

Spot AI fits a two-level list owned by one central team, where every site picks from the same categories and subtypes and only the narrative is free text. Subtypes named after FBI NIBRS offenses make the police handoff cleaner.

Should video be attached to every incident report

Spot AI keeps timestamped video with every case it documents, and any report describing something a camera could have seen should carry a clip. Reference it from the system of record and place a hold on it so retention cannot delete it.

About the author

Dunchadhn Lyons, Director of AI Engineering

Dunchadhn Lyons leads Spot AI's AI Engineering team, building real-time video AI for operations, safety, and security, turning video data into alerts, insights, and workflows that cut incidents and boost productivity.