Your Biggest Cannabis Security Threat Isn't the Guy with the Ski Mask

Your cameras are pointed at the front door. Your alarm is set every night. You upgraded the locks after the dispensary down the street got hit. And your inventory numbers still don't add up. The count is off by a few hundred dollars this week. Last month it was more. Metrc logs show products that should be on the shelf but aren't. You've got a feeling about one of your budtenders but nothing concrete.

Most owners spend their security budget preparing for the break-in that makes the news. The masked crew at 3 AM. The smash-and-grab. That threat is real, but it's not where most of the money goes.

The 90% Problem Nobody Wants to Talk About

Multiple industry sources, including security consultants like Canna Security America and Sapphire Risk Advisory and trade publications like MJBizDaily and Cannabis Business Times, consistently estimate that the vast majority of cannabis business losses come from employees, not outsiders. The commonly cited figure is around 90%, though no single peer-reviewed study has nailed down the exact number. What's not in dispute: internal theft in cannabis outpaces external theft by a wide margin.

That's not unique to cannabis. The FBI estimates employee theft costs U.S. businesses $50 billion a year across all industries. What's unique to cannabis is how much easier it is. Cash-heavy transactions that are harder to audit than credit card sales. High-value product that's portable and has ready demand on the black market. An industry that leans hard on part-time hourly workers with high turnover. Regulatory paperwork gaps that create room for manipulation.

And unlike a smash-and-grab, internal theft doesn't announce itself. There's no broken glass. No alarm. No KTLA story. It shows up as a slow bleed in your inventory numbers, often over weeks or months before anyone catches on.

The regulatory fallout is real too. DCC treats inventory gaps seriously. Consistent shortfalls between your Metrc records and physical counts can trigger fines from $5,000 to $30,000 per violation. Repeated issues can lead to license suspension, revocation, or criminal referral.

The Methods You're Not Seeing

These aren't guesses. Each one comes from documented cases.

Sweethearting and price manipulation. A budtender at one LA dispensary lowered product prices for friends and family. Over 50 transactions in a single month. Total loss: $20,000. The POS system recorded every sale at the altered price. Without video synced to POS timestamps, it all looked like normal business.

Employee-facilitated robbery. A Canna Security America case study documented a budtender who texted armed robbers "all clear" seconds before they walked in. The cameras recorded the robbery. They didn't capture the text. The inside connection only came out during the police investigation.

Vault and safe theft. A budtender walked out of a dispensary with $75,000 in cash from an unlocked vault. The vault wasn't on camera. In another case, employees at a Florida dispensary diverted more than 10,000 grams over several months before anyone flagged the discrepancy.

Product diversion during receiving. Product arrives, gets logged into Metrc, then a portion vanishes between the loading dock and the shelf. Without cameras covering the full chain, including receiving area, hallway, storage room, and display floor, there's no way to pinpoint where the gap opens up.

Every one of these patterns has something in common: standard security cameras were there and rolling. The footage existed. Nobody was watching it in a way that connected the video to what the POS, inventory, or access logs showed.

Why Employee Theft Is Harder to Catch Than a Break-In

In traditional retail, credit card processing builds an automatic audit trail. In cannabis, cash runs the show because most banks still won't touch the industry under federal rules. Cash is harder to track and easier to skim.

Product value makes it worse. A stolen iPhone loses resale value fast. Cannabis flower and concentrates hold steady demand on the black market. An employee pulling a few grams per shift can move product with no fencing network needed.

Then there's the regulatory layer. Metrc is built to track seed-to-sale movement, but Metrc relies on accurate human input at every transfer point. If the same person handling the product is also logging the transfer, the tracking system creates a false sense of security. It's only as honest as the person entering the data.

That's why dispensary employee theft prevention isn't a training problem or a trust problem. It's a systems problem. The systems need to be built so no single person controls both the product and the record of that product.

A guard at the front door can't watch the POS screen, the back hallway, and the vault room at the same time. That's the structural gap most dispensary security budgets never account for. For a full breakdown of what guard coverage actually covers versus live monitoring, see the dispensary security guard vs. remote monitoring cost comparison.

How Monitored Cameras Catch What Managers Miss

Standard cameras record everything and store it. To find the problem, someone has to scrub through hundreds of transactions per day looking for the one where the budtender rang up a $40 eighth at $15. Nobody has time for that. So nobody does it.

Live monitoring changes what gets caught and when. An employee opens the vault outside of scheduled count times: a live operator sees it. The back door opens at 2 AM when nobody should be inside: there's an alert and a record. A badge holder accesses a zone they're not authorized for: logged and flagged for the owner before the next morning shift. Those aren't things passive recording catches. They're things a live operator catches as they happen.

The operator checks in real time. If a budtender is in the back room after close and their badge didn't authorize that zone, the operator sees it as it happens, not three weeks later during an inventory audit.

A Sherman Oaks dispensary in our monitoring network had a trespasser show up at 3:15 AM on a February Thursday. An Intervention Specialist issued audio warnings. The subject was deterred without police contact. The same monitoring that caught that approach also flags any unauthorized entry by badge holders outside their approved hours.

A Westwood dispensary in our network had several people approach at 1:08 AM on a February Saturday. Audio warning issued. All deterred. The incident report that went to the owner the next morning had timestamps, camera references, and a full sequence. That's the same documentation format that applies to internal anomalies.

For after-hours monitoring, the system that deters break-ins is the same system that catches internal patterns: an employee coming back after close to access product, a delivery driver stopping at an unscheduled time, unusual activity in the storage area at 1 AM. Access control logging ties it together. Every badge swipe has a timestamp. When something looks off in your POS records, you have camera footage and access logs with matching timestamps to cross-reference. That's the difference between a gut feeling and a documented case.

What Effective Dispensary Employee Theft Prevention Requires

Five design principles. None require equipment your dispensary doesn't already need for DCC compliance.

Dual-employee handling for all high-value activities. No single person counts cash, handles product transfers, or opens the vault alone. DCC already requires this for some operations. Extending it to every product touchpoint closes the biggest gap.

Hard-count inventory at least twice a day. Opening count and closing count are the baseline. High-volume dispensaries should count four times: open, midday, shift change, and close. Every gap gets reviewed the same day, not logged and forgotten.

Cameras on every POS station with enough resolution to see what crosses the counter. When your inventory numbers don't add up, you need footage that shows what actually happened at the sale, not just that a sale occurred. Pull the camera footage for a flagged transaction and you can see whether three eighths crossed the counter while the POS shows a charge for two.

Access control with zone restrictions. Not everyone needs access to every room. Vault access goes to managers only. Back-of-house requires badge authorization. Every zone entry creates a log that matches up with camera footage.

After-hours monitoring with real-time alerts. If someone enters the building after close, employee or not, a live operator verifies and escalates. Most cash and vault access happens outside business hours when supervision drops off.

A Chatsworth dispensary in our monitoring network had several trespassers approach after midnight on a February night. The Intervention Specialist issued audio warnings. They left. The same monitoring that logged and documented that approach created a real-time record of every after-hours entry event, expected or not.

A Panorama City cannabis operator in our network had a single subject approach at 5:00 AM on a February Monday. Audio warning issued. Subject deterred. Pre-dawn monitoring coverage, the window when internal access is hardest to supervise, is where the after-hours system earns its keep.

The difference between a dispensary that catches internal theft and one that discovers it during a quarterly audit comes down to configuration, integration, and someone actively watching.

Access control logs and camera timestamps are also exactly what DCC inspectors look for. Most operators don't realize how closely the compliance requirements and the theft-prevention setup overlap. See the DCC security inspection checklist for what auditors actually check during a walk-through.

Frequently Asked Questions

How do I know if my budtender is stealing from me?

The first signal is usually inventory discrepancies that don't match any obvious external cause. If your Metrc records and physical counts keep coming up short on the same product types, or if certain shifts consistently underperform in revenue relative to foot traffic, that's worth investigating. POS-to-camera timestamp review is the most direct way to confirm: pull the video for transactions that show below-average ticket prices or unusual product combinations and watch the footage of those sales. Sweethearting shows up clearly when you can see what actually crossed the counter.

What's the most common method of employee theft in cannabis dispensaries?

Sweethearting, where employees give unauthorized discounts or free product to friends, is the most common and the hardest to catch. Price manipulation looks like a normal sale in the records and compounds quickly. The only reliable way to catch it is to pull camera footage for transactions that look suspicious in your POS, then watch what actually crossed the counter. Product diversion during receiving is the second most common, particularly at facilities where the same person logs inventory and handles physical product. Both require the same fix: separating the person who handles the product from the person who records it, and making sure you have clear POS-facing camera coverage to review when the numbers don't add up.

Does Metrc prevent employee theft?

Metrc tracks seed-to-sale movement, but only as accurately as the person entering the data. If a staff member controls both the product and the transfer record, Metrc creates an appearance of compliance rather than actual oversight. It's an accountability system that relies on the honesty of the people using it. Metrc tells you where the gap is when someone finally runs the numbers. It doesn't prevent the gap from opening in the first place.

If I already have security cameras, aren't I covered?

Standard cameras record everything and store it. But to catch theft patterns, someone has to go back through hundreds of transactions looking for the specific moment the problem occurred. Nobody does that consistently. What changes the equation is having a live operator watching during the hours when after-hours access happens, combined with access control logs that document every zone entry. When your POS flags a discrepancy, you have timestamped footage and access records to pull rather than trying to reconstruct what happened from memory. The hardware is the same. The difference is in whether someone is watching, and whether the logs are there when you need them.

Does live remote monitoring help with employee theft, or just after-hours break-ins?

Both. The same monitoring system that watches for external intruders after hours also monitors for unauthorized after-hours access by staff. If a badge holder enters a restricted zone outside their approved hours, the operator sees it. If the back door opens at 2 AM during a scheduled closure, there's an alert and a record. That documentation is what creates accountability for employees who know the system is active, and it's the chain of evidence you need when an issue reaches the point of termination or prosecution.

Can I catch employee theft after it's already happened?

If you have camera footage and POS records, yes, often. The key is retention. DCC requires a minimum of 90 days of video. If you suspect theft happened three months ago and your system stores 90 days, you may still have the footage. Cross-referencing it against specific transactions in your POS is time-consuming but doable. For ongoing theft that's still happening, the faster path is getting active live monitoring in place going forward so after-hours access is documented in real time, rather than relying on retroactive review of footage you may or may not still have.

Related Articles

• →Cannabis Security Guide for California Operators
• →Cannabis Remote Video Monitoring for Dispensaries
• →Dispensary Robbery Prevention in LA
• →Security Guards vs. Remote Monitoring for Dispensaries
• →How to Pass a DCC Security Inspection
• →Securing Remote Cannabis Grows in Southern California
• →ValleyGuard Catches on Camera