Irisity AI Video Analytics for Transit Surveillance

Surveillance video produces enormous amounts of footage. A station with ten cameras recording 24/7 generates terabytes per month, and manual review is not how operational security works. What matters is whether the system can flag the small percentage of footage containing an actionable event, fast enough to do something about it. Irisity is one of the AI video analytics platforms purpose-built for this — real-time detection of human activity, intrusion, loitering, crowding, and behavioral patterns — integrated directly into the Milestone XProtect environment. This article covers what Irisity does, how the integration works, the transit use cases that justify it, and the design decisions that determine whether the deployment produces alerts operators trust.

What Irisity Does Differently From Motion Detection

Every VMS supports motion detection. Motion detection works until it does not. In a transit environment, motion comes from train movement, vegetation, shadows, weather, headlights, wildlife, passengers, and maintenance crews. Routing every motion event into automated response would fire constantly, and operators stop responding to alerts that fire constantly.

Irisity applies trained AI models — what the platform calls AI Agents — that classify what is actually moving: human, vehicle, or generic motion. Once an Agent identifies a person or vehicle, behavioral rules layer on: was the subject in a defined detection zone, did they cross a tripwire, are they loitering past a dwell threshold, are they part of a crowd exceeding a density count. The result is a much lower false-positive rate and a much higher signal-to-noise ratio for events that actually warrant operator attention.

Out of the box, the detection categories cover most transit security needs: intrusion and perimeter detection, line crossing, loitering, crowd counting and grouping, unattended objects, traffic monitoring (stopped vehicles, jaywalking, accidents), facial recognition with Search for Similar, and fire and smoke detection. Where the standard catalog isn't enough, Irisity offers Personalized AI — custom-trained Agents built against an operation's own video feeds for behaviors specific to that environment.

Live Detection and Forensic Search — Both Matter

Transit agencies need analytics to work in two distinct modes, and Irisity covers both.

Real-time detection is what the diagram above describes — events firing as they happen, routed through the VMS to operators, IP audio, relays, and field response. This is the mode that prevents incidents. A person approaches a tunnel, the system fires within seconds, the warning sequence engages, behavior changes before anything escalates.

Forensic search is the inverse. When an event has already happened, investigators need to search recorded footage by what was in it — humans, vehicles, attributes, direction of movement, time windows, specific detection zones. The same AI classifications that fire real-time alerts also enrich every recorded frame with searchable metadata. A multi-camera review that would take hours of manual scrubbing returns the relevant clips in seconds.

Both modes share the same underlying detection layer. The same investment supports two distinct workflows — the security operations center watching for events as they happen, and the investigations team reconstructing what happened after the fact.

An Open Platform — Not a VMS Plugin

Irisity is camera-agnostic on the input side and VMS-agnostic on the output side. Any IP camera can feed it — Axis (ARTPEC 7+), Bosch, Mobotix, Hanwha, Hikvision, or generic ONVIF/RTSP devices, running simultaneously in one interface. Where on-camera AI is supported, the analytics run on the camera itself. Where it is not, an edge device handles decoding and metadata extraction — converting non-AI cameras into analytics-capable sources without replacing the camera. On the output side, the platform integrates natively with Milestone XProtect, Genetec Security Center, and Immix for central monitoring, with a WebHook API for any other destination. The platform itself runs on Kubernetes and deploys on-premises (including air-gapped), in the cloud, or hybrid — the same architecture scales from a handful of cameras to thousand-camera multi-site deployments.

A few platform features matter operationally beyond the spec sheet. Floating licenses are not bound to a specific camera, so AI coverage can move between cameras as priorities shift. Health monitoring watches video quality, connectivity, blocked or obscured views, and data transmission downstream — operators are alerted to platform problems before they discover them through a missed incident. Centralized management means cameras, Agents, rules, and alerts are configured once for the whole fleet, not site by site.

How It Integrates Operationally

The integration model is straightforward regardless of which VMS sits downstream: cameras stream to the VMS for recording and live view; Irisity processes the same streams and feeds detection events back through the VMS's smart-event or alarm-event integration. The VMS's rule engine then routes events to operator workstations, triggers recordings or bookmarks, fires access control workflows, activates field devices through IP relays, or sends alerts to a security operations center.

For deployments built on Milestone XProtect — the most common pattern in transit programs — surveillance teams keep working in the console they already know. Analytics events appear in the same alert stream as manual events, with the camera view, recording clip, and detection zone visualization attached. One operator console, one workflow. The same pattern holds in Genetec environments. Where a program runs custom or in-house monitoring, the WebHook API turns Irisity events into HTTP calls that any modern operations stack can consume.

Use Cases in Transit

Station perimeter and platform security. Detection zones around platform edges, restricted areas, and after-hours zones turn overnight intrusions from after-the-fact reviews into real-time alerts.

Tunnel and right-of-way intrusion. The high-stakes case, covered in our Tunnel Intrusion Deterrent System article. Detecting human presence approaching a tunnel, where delayed response is measured in injury or fatality risk, is exactly where analytics saves lives.

Parking and approach areas. Loitering and after-hours intrusion detection in station parking lots.

Crowd density on platforms. Operational awareness during events, service disruptions, or weather-driven schedule changes.

Equipment-area monitoring. Substations, communication shelters, fiber huts, signal cabinets — distributed infrastructure that historically depended on physical fencing becomes actively monitored without dedicated guard time.

Fire and smoke early warning. Flame and smoke-signature detection at tunnel portals, station buildings, equipment shelters, and other areas where the cost of late detection is high. The same camera infrastructure used for security analytics doubles as a secondary early-warning layer for fire events.

On an Active Rail Program

Enabled Consultants integrated Irisity into a Tunnel Intrusion Deterrent System workflow on a commuter rail program. Irisity sits between Axis network cameras observing each tunnel approach and the XProtect VMS coordinating the response. When Irisity classifies a person within the defined detection zone, the event fires into XProtect, which triggers a recorded warning through an IP speaker, activates a strobe through an IP-controlled relay, and surfaces an alert to the security operations center with live view and recorded clip attached. The same deployment supports adjacent use cases — perimeter monitoring at maintenance facilities, loitering detection in station areas, after-hours alerting at right-of-way access points. Same platform, rules tuned to each context.

Decisions That Determine Whether It Performs

• Detection zone definition. The polygon must align with the operationally meaningful area, not the wide camera view. Too generous catches incidental activity; too tight fires too late.
• Camera positioning for analytics. Evidentiary recording positions cameras for clear identification; analytics needs clear sightlines into the detection zone with enough resolution for reliable classification.
• Rule tuning against real conditions. Out-of-box rules need iteration against the actual scene — lighting, weather, background activity shift the false-positive rate. Configuration is not optional.
• Compute placement. Centralized simplifies management but requires bandwidth back to the analytics tier; edge keeps bandwidth local but constrains rule complexity.
• Operator workflow. Human attention is the scarce resource. The handoff from "analytics fired" to "operator acts" must be defined and trained, or alerts pile up unread.

Making Analytics a Specified Design Requirement

For transit agencies, security operations directors, or primes evaluating video analytics: which detection categories matter operationally? How does the integration into your VMS work — same operator console, or separate? How are rules tuned after commissioning, and who owns that? Is the deployment sized for the operator capacity to respond to the alerts it produces?

If your program is evaluating Irisity, another analytics platform, or a related video surveillance integration, our team has hands-on integration experience across transit and infrastructure deployments. Reach out to start that conversation.