Home Watchlists & Safety Screening

Watchlists & Safety Screening

Watchlist management, BOLO alerts, sex offender screening
By KYBER
2 articles

Managing Watchlists

Managing Watchlists Watchlists are one of the most powerful security features in KyberAccess. They allow you to automatically screen visitors during check-in against databases of individuals who should be flagged, denied entry, or monitored. KyberAccess supports both built-in screening databases and custom watchlists that you create and maintain. This guide covers how to configure, manage, and respond to watchlist screenings. Understanding Watchlist Types KyberAccess supports three categories of watchlists: 1. Sex Offender Registry Automatically screens visitors against the national sex offender registry database. - Data Source — National Sex Offender Public Website (NSOPW) and state-level registries - Matching — Compares visitor name and date of birth (from ID scan) against registry entries - Update Frequency — Database is updated daily - Availability — Included on Professional and Enterprise plans 2. Custom Watchlists Create your own lists of individuals to flag or deny. Common uses include: - Former employees who are banned from the premises - Known shoplifters or troublemakers - Individuals with active restraining orders - Terminated contractors - Previously banned visitors 3. BOLO (Be On the Lookout) Alerts Urgent alerts for specific individuals with photo matching capability. Covered in the BOLO Alerts & Threat Management article. Enabling Watchlist Screening 1. Log in to your KyberAccess dashboard at app.kyberaccess.com. 2. Navigate to Settings from the left sidebar. 3. Click Security under the Configuration section. 4. Scroll to the Watchlist Screening panel. 5. Toggle Enable Watchlist Screening to On. 6. Select which watchlists to activate: - Sex Offender Registry — Toggle on/off - Custom Watchlists — Toggle on/off - BOLO Alerts — Toggle on/off 7. Click Save. Adding Watchlist Screening to the Check-In Flow 1. Go to Settings > Check-In Flow. 2. In the Flow Builder, click + Add Step. 3. Select Background Screening. 4. Configure the step: - Screening Databases — Choose which watchlists to check - Screening Trigger — Screen after ID scan (recommended) or after visitor information entry - Action on Hit — What happens when a match is found (see below) - Show Status to Visitor — Toggle whether the visitor sees a "screening in progress" message on the kiosk 5. Click Save. Tip: Place the screening step after ID scanning for the most accurate results. ID data (name + DOB) provides better matching than manually entered names alone. Configuring Hit Actions When a visitor matches a watchlist entry, KyberAccess can take several actions: Automatic Deny - The visitor is immediately denied entry - The check-in flow stops - The visitor sees a message: "We are unable to complete your check-in. Please see the front desk." - Front desk staff receive an immediate alert with the match details Flag for Review - The check-in continues but the visitor is flagged in the system - Front desk staff receive an alert to review the match - The visitor's record shows a warning indicator - Staff can then approve or deny the visitor manually Silent Alert - The check-in continues normally - No visible indication to the visitor - An alert is sent to designated security personnel in the background - Used for monitoring situations where you want to track individuals without alerting them To configure hit actions: 1. Go to Settings > Security > Watchlist Screening. 2. For each watchlist type, select the default action: - Sex Offender Registry: Default is Automatic Deny - Custom Watchlists: Default is Flag for Review (configurable per list) - BOLO Alerts: Default is Automatic Deny with Silent Alert to security 3. Click Save. Creating and Managing Custom Watchlists Creating a New Watchlist 1. Go to Settings > Security > Custom Watchlists. 2. Click + New Watchlist. 3. Enter the watchlist details: - Watchlist Name — Descriptive name (e.g., "Banned Individuals", "Terminated Employees") - Description — Notes about the purpose of this list - Default Action — Automatic Deny, Flag for Review, or Silent Alert - Applies to Locations — All locations or specific ones 4. Click Create. Adding Individuals to a Watchlist Method 1: Manual Entry 1. Click on the watchlist name to open it. 2. Click + Add Person. 3. Enter the individual's information: - First Name (required) - Last Name (required) - Date of Birth (recommended for accurate matching) - Photo — Upload a photo for photo matching (optional but recommended) - Aliases — Known alternate names - Reason — Why this person is on the list (e.g., "Trespassed 2024-06-15", "Former employee - terminated for cause") - Added By — Auto-populated with your name - Expiration Date — Optionally set when this entry should automatically expire and be removed - Notes — Additional context for front desk staff 4. Click Save. Method 2: CSV Import 1. Click Import on the watchlist page. 2. Download the CSV template provided. 3. Fill in the template with your data: first_name,last_name,date_of_birth,reason,expiration_date,notes John,Doe,1985-03-15,Trespassed,2025-12-31,Banned from all locations Jane,Smith,1990-07-22,Former employee,,Do not admit 4. Upload the completed CSV file. 5. Review the import preview showing how many entries will be added. 6. Click Import. Method 3: From a Visitor Record 1. Go to the Visitors page. 2. Find the visitor you want to add to a watchlist. 3. Click on their name to open their profile. 4. Click the More Actions menu (three dots). 5. Select Add to Watchlist. 6. Choose the target watchlist. 7. Enter the reason and any notes. 8. Click Add. Tip: Adding a visitor from their record automatically includes their name, DOB (if scanned), and photo, saving you from manual data entry. Editing a Watchlist Entry 1. Open the watchlist. 2. Click the pencil icon next to the entry. 3. Modify any fields. 4. Click Save. Removing an Entry 1. Click the trash icon next to the entry. 2. Confirm the removal. 3. The entry is permanently deleted. Note: Removing an entry from a watchlist does not delete the visitor's historical records or the log of previous watchlist hits. All past screenings remain in the audit trail. Watchlist Matching Logic KyberAccess uses a multi-factor matching algorithm: Name Matching - Exact Match — Full first and last name match - Fuzzy Match — Accounts for common misspellings, nicknames, and name variations (e.g., "Bob" matches "Robert") - Alias Matching — Checks against any aliases configured for the watchlist entry - Phonetic Matching — Uses Soundex/Metaphone algorithms to catch similar-sounding names Date of Birth Matching - When a DOB is available (from ID scan), it adds a second verification layer - Reduces false positives significantly - A name match without DOB match generates a lower-confidence alert Photo Matching - When a photo is uploaded for the watchlist entry AND the visitor has a selfie captured during check-in, AI-powered facial recognition compares the two - Match confidence score is displayed (e.g., 92% match) - Threshold is configurable (default: 80%) Match Confidence Levels | Confidence | Factors Matched | Default Action | |-----------|----------------|----------------| | High (90%+) | Name + DOB + Photo | Automatic Deny | | Medium (70-89%) | Name + DOB or Name + Photo | Flag for Review | | Low (50-69%) | Name only (fuzzy) | Silent Alert | | No Match (<50%) | No factors matched | No action | You can customize these thresholds under Settings > Security > Matching Sensitivity. Responding to Watchlist Hits Real-Time Alerts When a watchlist hit occurs during check-in: 1. Front desk staff receive an on-screen alert on their dashboard with a red banner. 2. An audible notification sounds (configurable). 3. An email alert is sent to configured recipients. 4. A push notification is sent to the KyberAccess mobile app. 5. If Slack is integrated, an alert is posted to the configured security channel. Review Queue For hits configured as "Flag for Review": 1. Navigate to Visitors > Review Queue (or click the alert banner). 2. The Review Queue shows all pending watchlist hits with: - Visitor name and photo - Watchlist entry that was matched - Match confidence level - Reason the person is on the watchlist 3. For each hit, you can: - Approve — Allow the visitor to continue check-in - Deny — Block the visitor's entry - Override — Approve with notes explaining the override reason 4. All review decisions are logged in the audit trail. Watchlist Reports 1. Go to Reports in the left sidebar. 2. Select Watchlist Activity. 3. View: - Total screenings performed - Number of hits by watchlist - Hit rate (percentage of visitors flagged) - False positive rate - Actions taken (approved, denied, overridden) 4. Export the report as CSV or PDF. Troubleshooting | Issue | Solution | |-------|----------| | Too many false positives | Enable DOB matching by requiring ID scanning before screening. Increase the match confidence threshold. | | Screening taking too long | Ensure the screening step is placed after ID scanning for faster lookups. Check your internet connection. | | Known individual not being caught | Verify the person's entry exists in the correct active watchlist. Check for name spelling variations and add aliases. | | Alerts not being received | Verify notification settings under Settings > Notifications. Check email spam folders. | | CSV import failing | Ensure the CSV follows the template format exactly. Check for special characters in names. | Best Practices - Require ID scanning — ID-scanned data (name + DOB) dramatically reduces false positives compared to manually entered names. - Upload photos — Photo matching adds a powerful third verification layer. - Review regularly — Audit your custom watchlists quarterly. Remove entries that are no longer relevant. - Set expiration dates — Use expiration dates for temporary bans to avoid maintaining stale entries. - Train staff — Ensure front desk staff know how to respond to watchlist alerts and use the Review Queue. - Document reasons — Always include a clear reason when adding someone to a watchlist, for legal and audit purposes.

Last updated on Apr 25, 2026

BOLO Alerts & Threat Management

BOLO Alerts & Threat Management BOLO (Be On the Lookout) alerts are KyberAccess's highest-priority security feature. Unlike standard watchlists that screen visitors passively during check-in, BOLO alerts are designed for active threat situations — when you need to immediately identify and stop a specific individual from entering your facility. BOLO alerts use AI-powered photo matching, trigger instant notifications to all security personnel, and can automatically lock down check-in points. This guide covers how to create, manage, and respond to BOLO alerts. How BOLO Alerts Differ from Watchlists | Feature | Standard Watchlist | BOLO Alert | |---------|-------------------|------------| | Priority | Normal | Critical / Urgent | | Photo Matching | Optional | Required (primary matching method) | | Notification Level | Front desk staff | All security personnel + management | | Alert Style | Dashboard notification | Full-screen alert with photo and audible alarm | | Default Action | Flag for Review | Automatic Deny + Immediate Notification | | Kiosk Behavior | Quiet denial message | Kiosk locks and displays "Please wait" | | Expiration | Optional | Recommended (time-sensitive threats) | Creating a BOLO Alert Step 1: Navigate to BOLO Management 1. Log in to your KyberAccess dashboard at app.kyberaccess.com. 2. Navigate to Security from the left sidebar. 3. Click BOLO Alerts. 4. Click + New BOLO Alert. Step 2: Enter Subject Information 1. Photo (required) — Upload one or more photos of the individual: - Click Upload Photo or drag and drop - Multiple angles are recommended (front, side profile) - Accepted formats: JPG, PNG - Minimum resolution: 200x200 pixels (higher is better for matching) - You can upload up to 5 photos per BOLO 2. First Name — Enter the individual's first name (if known) 3. Last Name — Enter the individual's last name (if known) 4. Aliases — Any known alternate names or nicknames 5. Date of Birth — If known, improves matching accuracy 6. Physical Description — Height, weight, hair color, distinguishing features 7. Last Known Location — Where the individual was last seen Note: A photo is the only required field for a BOLO alert. If you do not know the individual's name, you can create a photo-only BOLO that relies entirely on facial recognition matching. Step 3: Set Threat Details 1. Threat Level — Select the severity: - Critical — Immediate physical danger (e.g., violent threats, active warrant) - High — Serious concern (e.g., harassment, restraining order violation) - Medium — Monitoring required (e.g., suspicious behavior, prior incidents) 2. Threat Description — Detailed explanation of the threat: - What happened or what is the concern? - Any history of violence or threatening behavior? - Relevant context for security personnel 3. Instructions for Staff — What should staff do if this person is identified? - Example: "Do not confront. Call 911 immediately. Notify security director." - Example: "Deny entry. Escort to lobby. Contact HR at ext. 5555." 4. Law Enforcement Reference — Optional case number, officer name, or police report number Step 4: Configure Alert Settings 1. Notification Recipients — Who should be alerted when this BOLO matches: - All Security Staff — Every user with a security-related role - Specific Users — Select individual team members - External Contacts — Add phone numbers or emails for people outside KyberAccess (e.g., local police liaison) 2. Notification Methods: - Push Notification — Immediate push to KyberAccess mobile app - SMS — Text message to configured phone numbers - Email — Detailed email with photo and threat info - Slack — Post to designated security channel - Audible Alarm — Trigger an audible alert on front desk workstations 3. Kiosk Behavior — What happens if the match occurs at a self-service kiosk: - Lock Kiosk — Freeze the kiosk screen and display "Please wait for assistance" - Silent Continue — Allow the kiosk to continue while alerting staff in background - Redirect — Show a message directing the visitor to the front desk 4. Expiration — Set when the BOLO should automatically deactivate: - No Expiration — Remains active until manually deactivated - Custom Date — Specific date and time - Duration — 24 hours, 7 days, 30 days, 90 days Step 5: Activate the BOLO 1. Review all information in the summary panel. 2. Click Activate BOLO. 3. The BOLO is immediately active across all locations. 4. A confirmation notification is sent to all designated recipients. How BOLO Matching Works When a visitor begins the check-in process, KyberAccess runs the following BOLO checks: Photo Matching (Primary) 1. When the visitor's selfie is captured during check-in (at the kiosk or front desk), the photo is compared against all active BOLO alert photos. 2. The AI facial recognition engine analyzes facial features, structure, and proportions. 3. A confidence score is generated (0-100%). 4. If the score exceeds the configured threshold (default: 75%), a BOLO alert is triggered. Name Matching (Secondary) 1. If a name is provided in the BOLO, it is also checked against the visitor's entered or scanned name. 2. Name matching uses the same fuzzy, alias, and phonetic matching as standard watchlists. 3. A name match alone (without photo match) generates a lower-priority alert. Combined Matching When both photo and name match, the confidence level is elevated to Critical regardless of individual scores. Responding to a BOLO Alert What Staff See When a BOLO match is detected: 1. Front Desk Dashboard — A full-screen red alert overlay appears with: - The BOLO subject's photo(s) - The visitor's captured photo (side-by-side comparison) - Match confidence percentage - Threat level and description - Staff instructions - Law enforcement reference (if provided) 2. Audible Alert — A distinctive alarm sound plays (different from standard notifications) 3. Mobile App — Push notification with photo and threat details 4. SMS — Text message: "BOLO ALERT: [Name] matched at [Location]. Confidence: [X]%. See KyberAccess immediately." Recommended Response Procedures For Critical Threats: 1. Do NOT confront the individual. 2. Call 911 or local emergency services. 3. Follow your organization's emergency response protocol. 4. Document the incident in KyberAccess. 5. Notify facility management. For High/Medium Threats: 1. Verify the match visually by comparing the BOLO photos to the visitor. 2. If confirmed, deny entry politely: "I'm sorry, we're unable to complete your check-in at this time." 3. Notify security and management per the BOLO instructions. 4. Document the incident. Logging the Response 1. After responding to a BOLO alert, the alert remains on screen until acknowledged. 2. Click Acknowledge Alert. 3. Enter a response note: - What action was taken? - Was law enforcement contacted? - Was the match confirmed visually? - Was the individual on premises? 4. Select the outcome: - Confirmed Match — Entry Denied - Confirmed Match — Law Enforcement Contacted - False Positive — Entry Approved - Individual Not Present (e.g., someone else triggered the match) 5. Click Submit. Managing Active BOLOs Viewing Active BOLOs 1. Go to Security > BOLO Alerts. 2. The dashboard shows all active BOLOs with: - Subject photo and name - Threat level (color-coded: red, orange, yellow) - Date created - Created by - Expiration date - Number of matches triggered - Status (Active, Expired, Deactivated) Editing a BOLO 1. Click on the BOLO entry. 2. Click Edit. 3. Update any information (photo, threat details, recipients, expiration). 4. Click Save Changes. 5. All changes take effect immediately across all locations. Deactivating a BOLO 1. Click on the BOLO entry. 2. Click Deactivate. 3. Enter a reason for deactivation (e.g., "Threat resolved", "Suspect apprehended", "Restraining order expired"). 4. Click Confirm. 5. The BOLO is deactivated but retained in the system for historical records. BOLO Alert History 1. Go to Security > BOLO Alerts > History. 2. View all past BOLO alerts including: - Active, expired, and deactivated BOLOs - All triggered matches with timestamps - Staff responses and outcomes - Full audit trail of changes 3. Use filters to search by date range, threat level, or outcome. 4. Export the history as CSV or PDF for compliance documentation. Multi-Location BOLO Distribution BOLO alerts are automatically distributed to all locations by default: - All Locations (default) — The BOLO is active at every check-in point - Specific Locations — Restrict the BOLO to certain facilities - Location Groups — Apply to a defined group of locations (e.g., "Northeast Region") To configure location scope: 1. When creating or editing a BOLO, scroll to Location Scope. 2. Select the desired option. 3. Click Save. Integration with Emergency Systems BOLO alerts can integrate with your facility's emergency systems: - Access Control — Automatically lock specific doors or zones when a BOLO match is detected - Camera Systems — Trigger recording on specific cameras near the check-in point - PA System — Send a coded announcement to security staff - Emergency Lockdown — Automatically trigger lockdown mode for the affected location Configure these integrations under Settings > Integrations > Emergency Systems. Troubleshooting | Issue | Solution | |-------|----------| | BOLO not triggering on known match | Check that the BOLO is Active (not expired or deactivated). Verify the photo quality is sufficient. Lower the match threshold. | | Too many false BOLO matches | Increase the photo match threshold (try 85%). Upload higher-quality photos. Use multiple angles. | | Kiosk not locking on BOLO hit | Verify Kiosk Behavior is set to Lock Kiosk in the BOLO settings. | | SMS alerts not sending | Verify phone numbers are in international format (+1...). Check SMS integration (Telnyx) is active. | | BOLO alert not appearing on mobile | Ensure push notifications are enabled for the KyberAccess app on the recipient's device. | Best Practices - Use high-quality photos — The better the photo, the more accurate the facial recognition matching. - Include multiple angles — Front-facing and side-profile photos improve match rates. - Set clear staff instructions — Tell staff exactly what to do. Remove ambiguity. - Always include a threat description — Staff need context to respond appropriately. - Review active BOLOs weekly — Deactivate BOLOs that are no longer relevant to avoid alert fatigue. - Test BOLO response procedures — Conduct periodic drills so staff know how to respond. - Coordinate with law enforcement — For serious threats, involve local law enforcement in your BOLO procedures and share relevant case numbers.

Last updated on Apr 25, 2026