Most dispensary security budgets are built around the wrong threat. Cameras pointed at the front door, alarms on the back entrance, a guard for closing shift — all of it aimed at the person who might break in. By at least one industry estimate, that is covering only about 10% of what actually walks out the door. The other 90% never involves a broken window at all. It walks out through the front of the house, logged, badged in, and smiling at the register. No mask, no crowbar, no alarm to trip — just a transaction that looks, on paper, like any other.
That split is a single-source industry estimate, not an audited figure, so treat the exact number as directional. But even a far more conservative version of that split should change where your prevention dollars go. Diversion is not one thing — it is a handful of specific, repeatable mechanisms, each with its own fix.
How it actually happens
- Sweethearting. An employee applies an unauthorized discount to a friend or family member, then either pockets the difference in cash or simply gives product away. It looks like ordinary customer service until someone compares the register total to what should have come in.
- “Damaged” product that was never damaged. Inventory gets logged as spoiled, defective, or lost in handling and quietly leaves through the back door instead of going in the trash. Metrc shows a clean write-off. Nothing about the paperwork looks wrong unless someone is watching the pattern, not just the entries.
- Cash skimming in small amounts. Rarely one dramatic gap, usually a few dollars under-reported across many transactions, spread across shifts, small enough that no single register count looks alarming.
- Shared or reused login credentials. When more than one person operates under the same track-and-trace login, there is no way to tie a specific transaction to a specific person, which is exactly the condition diversion needs to go unnoticed.
- Looping and unauthorized resale. A customer buys the legal maximum, leaves, and returns the same day to buy the maximum again, almost always a sign the product is headed somewhere it was never supposed to go, sometimes with an employee’s quiet cooperation.
- Blind spots in the retail floor itself. Shelving, displays, or camera placement that leaves even a few square feet uncovered gives both customers and staff a spot where product can move without being seen.
How to actually prevent it
None of these mechanisms are exotic, and none of them require exotic fixes. They mostly come down to closing the specific gap each one depends on:
- Give every employee their own login. No exceptions. Shared credentials erase accountability by design. Individual logins on your POS and track-and-trace system mean every transaction traces to exactly one person.
- Reconcile POS and Metrc records on a schedule, not just before an audit. A discrepancy you catch internally is a process fix. The same discrepancy found by a regulator during inspection is a violation. Weekly, not annual, is the difference between the two.
- Treat “damaged or spoiled” write-offs as a reviewable category. A pattern of high write-offs tied to one shift, one employee, or one product line is the earliest and most reliable signal of diversion, far earlier than a cash shortfall shows up.
- Eliminate blind spots on the floor and over the register. Cameras should cover every square foot of retail space, with a clear view directly over each point-of-sale terminal so footage can actually confirm what a transaction record shows.
- Vary cash pickup and deposit schedules. A predictable cash-handling routine can give someone an opportunity to time a theft. Irregular timing removes that advantage.
- Put your non-diversion policy in writing, and post it. A written policy in the break room is not just a formality. It removes ambiguity about what counts as diversion and what the consequences are, while signaling that someone is paying attention.
- Give staff a way to report concerns without fear of retaliation. The employees most likely to notice a coworker’s pattern are other employees. A reporting channel that feels safe to use is often cheaper and faster than any camera system.
The takeaway
A break-in is dramatic, visible, and rare. Diversion is quiet, ordinary-looking, and constant — which is exactly why it can account for so much of what a cannabis business loses. The fix is not more cameras pointed at the front door. It is tighter accountability on everything that happens after that door opens.
This is also where security and compliance stop being two separate conversations. The same access logs, camera coverage, and login discipline that can catch employee diversion are the records a DCC inspector may ask for during an audit. Build the prevention system once, and it can do both jobs: protect your bottom line and keep your records ready for inspection.
Protect What Happens After the Door Opens
A strong security program looks beyond break-ins. Massive Security helps cannabis businesses strengthen access controls, surveillance, and security procedures to protect inventory, employees, and daily operations.