A security monitor receives an indication of a robbery from a security system. In response, an alert generator sends an alert to a plurality of employee terminals, where the alert causes each of the employee terminals to preemptively display a notification of the robbery and prompt for and record an employee's observations.