Analytics - Security Dashboard & Incident Trends

Available to Guard+ roles when the analyticsAccess feature is enabled for your organization. The team-specific analytics page remains an Admin+ workflow.

What the Analytics Tab Answers

Every incident your team handles generates data: timestamps, severity levels, response durations, resolution outcomes. The Analytics tab takes that raw data and transforms it into visual patterns you can act on.

Before diving into the individual charts, here are the kinds of questions this screen is designed to answer:

Are we handling more or fewer incidents compared to last month?
How fast is my team resolving incidents?
Which severity levels dominate our workload?
Which incident types occur most frequently?
Where are the biggest delays in our resolution pipeline?

Open Analytics from the sidebar. Everything on this page updates from your incident data within the selected time range.

Setting the Time Window

The date range filter at the top of the page controls every chart and metric card below it. Select one of the four preset ranges:

Option	Best used for
Last 7 Days	Weekly operations briefing or performance check
Last 30 Days	Monthly management report or trend identification
Last 90 Days	Quarterly review or seasonal pattern analysis
Last Year	Year-over-year comparison or annual audit preparation

Changing this filter instantly recalculates every number and chart on the page. Start broad (30 days) to spot trends, then narrow down to investigate specific anomalies.

The Six Metric Cards

These cards sit at the top of the Analytics page. Each one distills a key performance indicator into a single number.

1. Total Incidents

The count of all incident reports filed within your selected time range. This is your workload indicator. A sharp increase may signal a genuine escalation in security threats, or it could reflect improved reporting discipline from your team. Compare it against previous periods to understand which.

2. Critical

The number of incidents classified as Critical severity. Track this number week over week. A rising count may indicate deteriorating conditions at specific sites, while a declining count could validate that preventive measures are working.

3. Active

The number of incidents that are still open and not yet resolved or published. If this number stays high relative to Total Incidents, your team may have a backlog building up.

4. Resolved

The count of incidents that have been resolved or published within the selected time range. Compare this against Total Incidents to gauge throughput.

5. Resolution Rate

The percentage of incidents that have been closed (resolved or published) out of the total. A consistently low resolution rate suggests bottlenecks in your workflow or incidents that are being created but not followed through.

6. Avg Resolution Time

The average time (in hours) from incident creation to closure. Long resolution times do not always indicate poor performance -- complex investigations take longer. But if routine incidents (access control breaches, parking violations) are taking hours to close, your workflow may have bottlenecks.

Charts Explained

Incident Trends Over Time

This stacked area chart plots incident volume across your selected date range, with each severity level represented by a separate colour-coded area:

Red - Critical
Orange - High
Yellow - Medium
Green - Low

What good looks like: A relatively flat or gently declining trend across all severity levels, with no sustained spikes.

What to investigate: A sudden vertical spike in the Critical or High areas. Narrow the date range and cross-reference with shift rosters, weather events, or site-specific changes. Recurring spikes on the same day of the week often point to staffing gaps during specific shifts.

Practical use: If you notice that Medium-severity incidents consistently rise on Friday evenings, that is a data-backed argument for increasing coverage during that window.

Severity Distribution

This pie chart breaks down your total incident count by severity level. It answers one question: What proportion of our work is urgent versus routine?

Healthy distribution: The majority of incidents fall under Low or Medium, with Critical and High making up a small slice. This indicates that your operation handles mostly routine security matters, with genuine emergencies being the exception.

Concerning distribution: If Critical and High segments together exceed 40% of the pie, your sites may be experiencing elevated threat levels, or your team may be over-classifying severity. Review a sample of recent Critical incidents to determine whether the ratings are accurate.

Incident Type Breakdown

This donut chart shows the top incident types by volume, with a legend listing each type alongside its count and percentage. Use it to identify which categories consume most of your team's attention. If a single type dominates (for example, trespassing at 40%), that points to a specific operational issue worth addressing at the site level.

Response Time Distribution

This bar chart groups resolved incidents by how long they took from creation to closure.

Time Bracket	What it means
Under 1 hour	Fast turnaround. Straightforward incidents handled promptly.
1 to 4 hours	Acceptable for most non-critical events, especially at large sites or for incidents requiring investigation.
4 to 24 hours	Slow. Investigate whether the delay was caused by staffing gaps, communication issues, or complexity.
Over 24 hours	Extended resolution. Check whether these are complex investigations or workflow bottlenecks that need attention.

What good looks like: The tallest bar sits in the "Under 1 hour" bracket, with progressively shorter bars as the time increases.

What to investigate: A large bar in the 4-24 hour range, or a growing "Over 24 hours" segment. Pull the specific incidents from that bracket and trace the delay back to its root cause: insufficient coverage, slow acknowledgment, or the nature of the incident itself.

Team Analytics (Separate Page)

The Team Analytics page under Team > Team Analytics focuses on guard-level reporting for Admin+ users on organizations that have the guard-tracking feature available.

It currently has two tabs:

Performance - Guard response time, success rate, workload, and team comparisons.
Certificates - Certification and specialization visibility built from guard profile data.

This page is separate from the main Analytics dashboard. Use the main Analytics page for incident trends and response time patterns across the organization, and use Team Analytics when you need to review individual guard performance or certification coverage.

Using Analytics to Improve Operations

Data only creates value when it changes decisions. Here are four concrete ways to apply what the Analytics tab reveals:

1. Adjust shift coverage based on trend patterns. If the incident trends chart shows consistent spikes between 22:00 and 02:00, that is evidence for adding a guard to the late-night rotation. Present the chart in your next staffing meeting. It is more persuasive than an anecdotal observation.

2. Set resolution time targets and track progress. Choose a benchmark (for example, 90% of incidents resolved within 4 hours) and monitor the response time histogram each week. Share the results with your team so they understand the standard.

3. Investigate outliers, not just averages. An average resolution time of 2 hours looks acceptable, but if 15% of incidents took over 24 hours, the average is masking a serious problem. Always look at the distribution, not just the summary card.

4. Use severity distribution to validate classification accuracy. If 60% of your incidents are marked Critical, the label has lost its meaning. Work with your team to calibrate severity definitions so that Critical truly represents situations requiring immediate executive attention, and Low represents informational records.

What Analytics Does NOT Include

No AI or ML-powered analytics
No predictive modeling or forecasting
No anomaly detection
No custom date range picker (preset ranges only)
No patrol compliance metric on this page (patrol data appears in Reports, not in the analytics dashboard)
No client satisfaction surveys or ratings
No status distribution chart

Live Control Room Dashboard - the real-time operational view that generates the data behind these analytics
QR Patrol Verification System - how patrol checkpoint scans are captured
Prove Guard Presence - linking on-duty records to operational data