About threat levels

2026-02-23Last updated

A threat level is a predefined scenario that you activate for a specific area or the entire system to manage special situations, such as a business event or emergency evacuation. Activating a threat level triggers a series of actions tailored to the scenario. Deactivating the threat level returns the system to regular operation.

Each threat level has a name and a color, and includes two action lists that define system behavior. One list runs when the threat level is activated, and the other runs when it is cleared. You can configure a threat level using any Security Center SaaS action, along with actions specific to threat levels, such as denying access to certain cardholders or forcing particular users to log off.

Understanding the effect of threat levels on unlock schedules

Note:
Areas are assigned a minimum security clearance level ranging from 0 to 7 (where 0 represents the highest security and 7 the lowest). A cardholder must possess a security clearance equal to or higher than the minimum requirement of a given area to gain access. This requirement is in addition to any restrictions imposed by access rules.

By default, the minimum required security clearance for an area is set to 7, meaning no special clearance is needed for access. When a threat level is activated for an area with a minimum security clearance level other than 7, the unlock schedules are bypassed while the threat level is in effect. Once the threat level is cleared, the unlock schedules will resume normal operation.

It is important to note that activating a threat level in an area does not affect the following:
  • Manual Override unlock schedule commands from Security Center SaaS
  • Manual Unlock commands for specific doors from the Security Center SaaS door widget
  • Temporarily override unlock schedule action executed by an automation
  • REX activation, meaning the REX activation can still unlock the door
  • Unlocking doors from inside the area, meaning that access rules for exiting areas are not affected
  • Captive doors inside the area
  • Hardware zone I/O linking

Required privileges for threat levels

Specific privileges are required to use this feature.
Configuration desktop
To configure threat levels in Configuration desktop, you must have standard administrator privileges. This allows you to view, modify, add, and delete threat levels.
Security Center SaaS activation
To activate threat levels on areas in Security Center SaaS, you must have the Set threat level privilege.
Note:
Users without the Set minimum security clearance privilege can still change an area's minimum security clearance using the threat level feature.
System-level activation
To activate threat levels at the system level, you must have the following additional privileges:
Set system-wide threat level
Allows you to set a threat level at the system level across all areas in the system, including areas that are normally inaccessible through partitions. Users who do not have this privilege can only set threat levels for areas they can access through their partitions.
Reset system-wide minimum security clearance
Allows you to set the minimum security clearance back to its lowest level (7) across all areas in the system, including areas that are normally inaccessible through partitions. When you have this privilege, a Reset () button appears next to the system entity () in the Threat levels dialog box in Security Desk.

Limitations of threat levels

The following limitations apply when using the threat level feature:
  • Threat levels operate independently of partitions. This means that a threat level set at the system level by users in one partition can impact entities in another partition, especially if the actions have a broad scope, such as when they apply to All entities.
  • Threat levels cannot be directly applied to federated areas. This means that when the Federation™ host sets a threat level for a federated area, only the associated threat level actions are sent to the federated site, not the actual threat level itself. Local users at the federated site will not be able to see that a threat level has been set by the Federation™ host.
  • Actions to trigger door locks (Trigger output) are restricted unless the area security clearance is at its lowest level (7).