The cannabis industry has matured, but many operators are still approaching security and risk management as a compliance exercise rather than a business-critical discipline.
Cameras are installed because regulators require them. Guards are hired because the license application said they would be there. Access control systems are added because the floor plan required limited-access areas.
That is not enough.
A true cannabis risk assessment should answer a more important question:
Where is the business most vulnerable to a loss, and what controls are in place to prevent, detect, delay, respond to, and document that loss?
For cannabis operators, the answer is rarely limited to one issue. The risk profile often includes:
High-value inventory
Cash handling
Internal theft
Robbery and burglary
Product diversion
Employee safety
Transportation exposure
Extraction and manufacturing hazards
Regulatory scrutiny
Insurance claim documentation
Reputational harm
A strong cannabis risk assessment looks at these exposures together, because losses rarely happen in isolation.
A weak exterior door, poor lighting, an unmonitored camera, loose visitor control, and finished product left in a staging area can combine into one expensive claim.
Cannabis Risk Is Different
Cannabis facilities are not ordinary retail stores, warehouses, farms, or manufacturing operations.
They are often a hybrid of all of those business models, layered with strict regulatory obligations and a product that remains attractive to criminals because it is valuable, portable, and easy to divert.
A cultivation facility may have risks tied to:
Perimeter fencing
Greenhouse access
Employee movement
Camera blind spots
Product staging
Harvest timing
Drying and curing rooms
Trim areas
A manufacturing facility may have risks involving:
Volatile extraction rooms
Packaging areas
Finished goods storage
Employee theft
Fire and explosion hazards
Product contamination
Equipment failure
Chain-of-custody documentation
A dispensary may face:
Robbery
Cash exposure
Customer conflict
Point-of-sale vulnerabilities
After-hours burglary
Smash-and-grab attempts
Employee access problems
Product display and vault procedures
A distributor may have risks involving:
Loading docks
Fleet exposure
Route security
Driver safety
Product handoffs
Inventory reconciliation
Chain-of-custody gaps
The risk assessment should not treat these as separate boxes on a checklist. In cannabis, security, compliance, operations, safety, and insurance are connected.
Compliance Is the Floor, Not the Standard
State cannabis regulations often prescribe minimum security requirements. Those rules matter, but minimum compliance does not always equal effective protection.
California’s commercial cannabis rules, for example, require licensed premises to maintain a digital video surveillance system with minimum resolution requirements, fixed camera placement, and coverage of areas such as entry points, exits, and locations where cannabis activity occurs. (Legal Information Institute)
Those requirements create a baseline. They do not answer the more important operational questions:
Can the cameras clearly identify a person’s face?
Can they see the hands of an employee handling finished product?
Are roll-up doors, vault entrances, cash rooms, and loading docks clearly visible?
Are cameras positioned too high to capture useful detail?
Are there blind spots near fencing, storage rooms, trim areas, or exterior doors?
Is footage retained long enough for claims, litigation, regulatory requests, and internal investigations?
Can management quickly export video for law enforcement, insurers, attorneys, or regulators?
Is the video system tested, maintained, and protected against tampering?
Operators should stop asking, “Do we have cameras?”
They should start asking, “Can our cameras prove what happened?”
That distinction matters. In a theft claim, premises liability incident, employee dishonesty investigation, product tampering allegation, or regulatory inquiry, poor footage can be almost as damaging as no footage at all.
The Core Elements of a Cannabis Risk Assessment
A cannabis risk assessment should be structured, documented, and prioritized.
The most practical model is to classify findings by likelihood and severity:
Low — minor issue with limited financial or operational impact
Medium — correctable exposure that could contribute to a loss
High — likely or serious exposure involving theft, injury, regulatory issues, or claim problems
Critical — immediate concern involving life safety, major theft potential, business interruption, license risk, or severe insurance implications
The assessment should produce a ranked action plan, not just a list of observations.
At a minimum, the assessment should review the following areas.
Perimeter Security
The perimeter is often the first point of failure.
A proper review should evaluate:
Fencing
Gates
Exterior lighting
Vehicle access
Tailgating risk
Landscaping and concealment areas
Exterior camera coverage
Roof access points
Adjacent properties
Remote lots or cultivation areas
Loading dock visibility
For cultivation and distribution operations, the exterior environment is often more important than operators realize. Many losses begin with someone testing the property after hours, watching employee patterns, identifying blind spots, or determining whether police or security response is likely.
Entry and Visitor Control
Visitor control is one of the simplest areas to document and one of the easiest to ignore.
A risk assessment should examine:
Front-door procedures
Reception protocols
Driver license verification
Visitor badges
Vendor access
Contractor access
Employee escort rules
Delivery driver procedures
Check-in and check-out records
After-hours access procedures
The goal is simple: the operator should know who entered, why they were there, where they went, who approved it, and when they left. Poor visitor control creates exposure for theft, diversion, workplace violence, product tampering, regulatory violations, and premises liability claims.
Camera Coverage and Video Quality
Video surveillance is not just a compliance requirement. It is a claims tool, investigation tool, training tool, and management tool.
The assessment should review:
Camera placement
Image clarity
Low-light performance
Exterior visibility
Interior coverage
Camera height
Retention period
Time/date accuracy
Remote access
User permissions
Export capability
Backup systems
Camera health monitoring
Tamper alerts
The question is not whether footage exists. The question is whether the footage is useful.
A camera that records the top of someone’s head, misses the cash drawer, fails to capture the license plate, or loses visibility at night may satisfy a checklist but fail during a claim.
Access Control
Access control should be tied to job function, not convenience.
A strong review should examine:
Key control
Fobs and badges
PINs
Biometric systems
Door contacts
Duress codes
Access logs
Terminated employee procedures
Role-based permissions
Dual-control access for vaults and cash rooms
Shared codes or shared credentials
One of the most common weaknesses in cannabis operations is access creep. Employees receive access when they are hired, change roles, move locations, or leave the company — but permissions are not consistently updated.
That creates a serious insider-risk problem.
If a former employee can still enter a secured area, or a current employee can access rooms unrelated to their role, the system is not functioning as a risk control.
High-Value Product Storage
Finished cannabis goods are one of the most important areas of the risk assessment.
Operators should review:
Vaults
Safes
Cages
Locked rooms
Finished goods staging
Trim rooms
Freezer or refrigerated storage
Quarantine areas
Product awaiting testing
Product awaiting destruction
Product awaiting transfer
Inventory reconciliation procedures
The assessment should also compare actual practices against insurance requirements. This is critical. Many cannabis property policies include protective safeguard conditions, storage requirements, alarm requirements, safe/vault warranties, or theft-related limitations. If the operator stores product outside required secured areas, fails to arm the alarm, disables a camera, or does not maintain required safeguards, the insurance claim may become more difficult.
Security is not just about preventing the loss. It is also about preserving the ability to prove and recover the loss.
Cash Management
Cash remains a major risk for many cannabis businesses.
A proper assessment should review:
Cash drawer limits
Cash drops
Safe ratings
Bolting and anchoring
Time locks
Dual-control procedures
Armored car pickups
Cash counting rooms
Bank deposit procedures
Employee access
Robbery response training
Panic button placement
Opening and closing procedures
Cash exposure creates more than theft risk. It can also increase the likelihood of employee injury, workplace violence, internal theft, and reputational harm.
If employees are moving large amounts of cash without clear procedures, the business has a security issue, a workers’ compensation issue, and a management issue.
Manufacturing and Extraction Safety
Extraction and manufacturing exposures require a different level of review.
The assessment should examine:
Fire-rated construction
Ventilation
Classified electrical equipment
Gas detection
Emergency shutoffs
Suppression systems
Equipment maintenance
Standard operating procedures
Employee training
Engineering review
Hazardous material storage
Emergency response plans
Extraction environments involving flammable vapors require careful C1D1/C1D2 analysis, including ventilation, electrical classification, gas detection, suppression, and code review before layouts and equipment decisions are finalized.
This is not an area where operators should rely on assumptions or vendor assurances alone.
A manufacturing loss can involve fire, explosion, employee injury, OSHA scrutiny, property damage, business interruption, regulatory consequences, and potential insurance disputes.
Guarding and Post Orders
Security guards should not simply be “present.”
They need clear, site-specific post orders.
A risk assessment should review whether guards understand:
Patrol routes
Access rules
Visitor procedures
Alarm response
Emergency contacts
Severe weather protocols
Intruder response
Employee access rules
Vendor handling
After-hours procedures
Escalation protocols
Incident report requirements
Law enforcement notification procedures
Poorly trained guards can create liability instead of reducing it.
If a guard does not know when to observe, when to report, when to call law enforcement, when to avoid confrontation, and how to document an incident, the operator may have a serious premises liability and security management issue.
Documentation and Testing
The most overlooked part of cannabis risk management is often documentation.
The facility should maintain records showing that key systems are tested regularly, including:
Cameras
Alarms
Door contacts
Panic buttons
Access control
Video retention
Emergency lighting
Fire systems
Extraction safety systems
Duress codes
Communication procedures
If a claim occurs, the operator should be able to show not only that a system existed, but that it was maintained and functioning before the loss.
That distinction can matter to insurers, regulators, law enforcement, landlords, lenders, and investors.
New Technology Is Changing Cannabis Security
The cannabis industry is moving from passive security to active risk control.
Traditional video surveillance records what happened. Newer systems can help detect what is happening and allow intervention before the loss occurs.
That is a major shift.
Modern security platforms increasingly combine:
AI-assisted video analytics
Cloud-based video management
Remote monitoring
Audio talk-down
Video-verified alarms
License plate recognition
People and vehicle detection
Line-crossing alerts
Loitering alerts
Camera tampering alerts
Access-control integration
Centralized multi-location dashboards
Live video monitoring, for example, pairs camera feeds with automated analytics and human operators who can detect, verify, and respond to suspicious activity in real time. (Pioneer Security Services, Inc.) Some systems also include audio talk-down and video-verified alarm escalation, allowing a remote operator to warn intruders and support faster law enforcement response. (DGA Security Systems, Inc.)
For cannabis operators, this technology is especially relevant around:
Fence lines
Gates
Loading docks
Roll-up doors
Exterior storage areas
Secured storage rooms
Trim rooms
Packaging rooms
Cash rooms
Distribution staging areas
After-hours parking lots
Roof access points
The goal is not to replace people. The goal is to make people faster, better informed, and less dependent on luck.
AI-Assisted Cameras and Video Analytics
AI-assisted video analytics can help identify events that ordinary camera systems may only record passively.
Common capabilities include:
Person detection
Vehicle detection
Loitering alerts
Line-crossing detection
Restricted-area alerts
Object detection
Camera tampering alerts
After-hours movement detection
Unusual activity alerts
License plate recognition
People counting
Searchable video events
For cannabis operators, this can be valuable because the most important event is not always the break-in itself.
It may be what happens before the break-in:
A vehicle circling the facility
Someone walking the fence line
A person testing a gate
Loitering near a loading dock
Movement near a roll-up door
A camera being blocked or redirected
An employee entering a restricted room after hours
AI does not eliminate the need for human judgment, but it can reduce the chance that suspicious activity sits unnoticed until the next morning.
Live Video Monitoring and Audio Talk-Down
One of the most useful developments for cannabis operators is live video monitoring with audio talk-down.
With this model:
AI analytics or motion detection identifies suspicious activity.
A remote monitoring center verifies the event in real time.
If the activity appears unauthorized, a live operator speaks through a loudspeaker.
The operator warns the individual that they are being recorded and that law enforcement is being contacted.
If needed, the monitoring center escalates the event under pre-established protocols.
This matters because many cannabis losses occur after hours.
A traditional alarm may notify a call center after someone has already breached the perimeter. Live monitoring with talk-down creates an opportunity to intervene earlier — when someone is approaching the fence, testing a door, hiding near a loading area, or attempting to force entry.
For operators with large exterior perimeters, industrial buildings, limited overnight staffing, cultivation facilities, distribution yards, or remote lots, this can be a meaningful upgrade.
It is also valuable from an insurance and claims perspective because it can create a clearer incident timeline.
A well-documented event may show:
When the person entered the property
What they did before the breach
Whether warnings were issued
Whether law enforcement was contacted
What areas were accessed
What property was taken or damaged
Whether internal procedures were followed
That documentation can become extremely important in a claim.
Cloud Video and Multi-Location Visibility
Cloud-based and hybrid video management systems are also changing cannabis risk control.
For multi-location operators, centralized video management can be a major improvement. Instead of each dispensary, cultivation site, or manufacturing facility operating in a silo, leadership can review exceptions, monitor system health, manage user access, and verify whether sites are maintaining standards.
Cloud or hybrid video systems may provide:
Remote access
Offsite backup
User permission controls
Audit logs
Camera health alerts
Searchable footage
Faster video exports
Centralized monitoring
Multi-location dashboards
Integrated access-control records
This is especially important for operators scaling across multiple locations or states.
A growing cannabis company may believe its controls are consistent across all sites. In reality, one location may have a strong closing checklist, another may have weak vault procedures, and another may have outdated cameras with poor night visibility.
Centralized visibility allows leadership to manage exceptions instead of assuming compliance.
The Cyber Risk Inside Modern Security Systems
Modern security systems create a new exposure: cyber risk.
Cameras, access-control systems, intercoms, sensors, cloud video platforms, alarm panels, and IoT devices are now part of the operator’s technology environment. NIST’s IoT cybersecurity program emphasizes standards and guidance for improving the cybersecurity of connected systems and the environments where they are deployed. (NIST)
That matters because a connected camera system can become a vulnerability if it is poorly configured.
Cannabis operators should require:
Strong passwords
No shared administrator credentials
Multi-factor authentication where available
Role-based user access
Prompt firmware updates
Secure remote access
Network segmentation
Vendor access controls
User access reviews
Audit logs
Cybersecurity review of security vendors
Termination procedures for former employees and vendors
The irony is clear: a security system designed to protect the business can become a security problem if it is not managed properly.
This is especially important for cannabis operators because surveillance footage, facility layouts, cash procedures, inventory movement, employee patterns, and vault locations are sensitive business information.
If the wrong person gains access to that system, the result may be more than a privacy problem. It may become a roadmap for a physical loss.
The Human Side of Cannabis Security
Technology is only one layer.
Many cannabis losses are made easier by human behavior:
Doors are propped open.
Employees share codes.
Visitors are not escorted.
Guards lack clear instructions.
Product is left unattended.
Closing checklists are rushed.
Cameras are not tested.
Alarms are bypassed.
Terminated employees remain active in the access-control system.
Managers assume someone else verified the system.
A strong risk assessment should ask practical questions:
Are employees trained on robbery response?
Do they know what to do if someone tries to force access to a secured room?
Are visitors visibly identified?
Are vendors escorted?
Are terminated employees removed from access systems immediately?
Are doors checked at closing?
Are product movements documented?
Are panic buttons accessible in the rooms where employees actually need them?
Are guards trained to observe, report, de-escalate, and escalate appropriately?
Does management test the system, or simply assume it works?
The best security system in the world can be undermined by poor procedures.
Realistic Claim Scenario: The Camera Was There, But the Control Failed
Consider a cannabis distributor storing finished goods overnight before scheduled delivery.
The facility has cameras, an alarm system, and restricted-access storage. On paper, it looks compliant.
But during a risk assessment, several weaknesses are identified:
The exterior camera near the roll-up door has poor night visibility.
A side gate does not fully latch.
The alarm contact on one warehouse door has not been tested in months.
Finished product is staged outside the secured storage room for early morning loading.
Multiple employees share the same access code.
The security vendor has remote access, but no one has reviewed user permissions.
Two months later, burglars enter through the side gate, force the warehouse door, and remove staged inventory before the police arrive.
The operator submits a theft claim.
The insurer asks for:
Video footage
Alarm records
Access logs
Inventory records
Proof of forced entry
Storage procedures
Protective safeguard compliance
Employee access records
Police report
Evidence that required systems were operational
The problem is not simply that a theft occurred.
The problem is that the operator cannot prove the product was stored as required, cannot clearly identify the individuals, cannot show the alarm was functioning properly, and cannot explain why finished goods were left outside the secured storage area.
This is how a security issue becomes an insurance issue.
Risk Assessment and Insurance
A cannabis risk assessment is not just an operational tool. It is also an insurance tool.
Insurers increasingly want to understand how cannabis operators protect:
Inventory
Cash
Employees
Customers
Visitors
Vehicles
Premises
Data
Security systems
High-value rooms
Finished goods
Strong controls can improve underwriting confidence, support better claim outcomes, and help defend the business after a loss.
Camera footage can be critical in:
Theft claims
Employee dishonesty claims
Product tampering allegations
Premises liability incidents
Robbery investigations
Regulatory reviews
Workers’ compensation investigations
Vendor disputes
Customer injury claims
Internal investigations
But footage is only useful if it exists, is clear, is retained, and can be produced.
A documented risk assessment also helps show that the operator is acting like a serious, professional business. That matters to carriers, landlords, lenders, investors, regulators, and potential acquirers.
Where Insurance Can Fail If Controls Are Weak
Cannabis operators should pay close attention to policy wording.
Depending on the policy, the loss, and the carrier, coverage may be affected by:
Protective safeguard endorsements
Alarm warranties
Safe or vault requirements
Inventory storage conditions
Theft limitations
Employee dishonesty exclusions
Unexplained disappearance exclusions
Sublimits for cash or property of others
Requirements for forced entry
Reporting obligations
Valuation limitations
Business interruption waiting periods
Exclusions for illegal activity or dishonest acts
Conditions requiring functioning security systems
The key lesson is simple:
A cannabis business should not assume that having insurance means every theft, robbery, inventory shortage, or security failure will be paid.
Coverage depends on the facts, the policy language, the documentation, and whether required safeguards were actually in place.
A strong risk assessment helps close the gap between what the operator thinks is protected and what the policy may actually require.
What Better-Run Cannabis Operators Do Differently
The best cannabis operators do not simply buy more equipment.
They build layered risk-control systems around actual loss scenarios.
They combine:
Physical barriers
Camera coverage
Access control
Lighting
Live monitoring
Audio talk-down
Alarm verification
Employee training
Cash procedures
Inventory controls
Visitor management
Emergency response
Incident reporting
Vendor oversight
Cyber controls
System testing
Insurance review
They understand that no single control is perfect.
The objective is to create layers that:
Deter unauthorized activity
Detect suspicious behavior early
Delay access to high-value areas
Document what happened
Respond quickly and appropriately
Preserve insurance and legal defensibility
That is the difference between passive compliance and active risk control.
Practical Cannabis Risk Assessment Checklist
Cannabis operators should regularly ask:
Have we walked the property at night to see what our cameras actually capture?
Do our cameras clearly show faces, hands, license plates, cash areas, and product movement?
Are all secured rooms tied to access-control logs?
Are terminated employees removed from all systems immediately?
Are alarms, cameras, panic buttons, and door contacts tested and documented?
Are guards working from written post orders?
Are cash procedures written, trained, and followed?
Are finished goods stored exactly as required by policy and regulation?
Do we have live monitoring or video verification for high-risk after-hours areas?
Are security vendors reviewed for cybersecurity and access permissions?
Can we quickly export footage for law enforcement, regulators, or insurers?
Has our insurance policy been reviewed for protective safeguards, warranties, sublimits, and theft conditions?
If the answer to any of these questions is unclear, the risk assessment has already found something useful.
Conclusion: Risk Assessment Is a Living Discipline
Cannabis operators do not need to turn their facilities into fortresses.
They need intelligent, practical, documented systems that match the value of the product, the risk of the operation, and the scrutiny of the industry.
In cannabis, risk assessment is not a one-time report. It is a living discipline.
As the business grows, adds rooms, changes layouts, expands delivery, increases production, opens new locations, or adopts new technology, the assessment should evolve with it.
The operators who understand this will be better positioned to:
A cannabis risk assessment is a structured review of the physical, operational, safety, security, compliance, cyber, and insurance exposures facing a cannabis business. It identifies where losses are likely to happen and what controls exist to prevent, detect, delay, respond to, and document those losses.
Compliance usually reflects minimum regulatory expectations. A facility can technically satisfy a rule but still have poor camera angles, weak access control, inadequate lighting, loose visitor procedures, or inadequate documentation. Effective risk control asks whether the system will actually work during a real incident.
AI-assisted cameras can help identify people, vehicles, loitering, line crossing, after-hours movement, camera tampering, and restricted-area activity. They can reduce reliance on passive video review and help security teams respond before a loss occurs.
Live video monitoring uses remote operators and video analytics to verify suspicious activity in real time. Audio talk-down allows a remote operator to speak through a loudspeaker, warn intruders, and escalate the event to security or law enforcement when appropriate.
A documented risk assessment can improve underwriting confidence, support claim documentation, and identify policy conditions that could affect coverage. It can also help operators address protective safeguard requirements, theft conditions, storage warranties, sublimits, and other coverage issues before a loss occurs.
