A site control unit (12) located at a premises (F) processing video images obtained from a plurality of cameras (22) located about the premises and relaying the presence of a real intrusion to a central station (CS). The site control unit has an image acquisition module (24) receiving video images from the cameras. An image processor (30) processes the images to eliminate possible causes of false alarms of an intrusion and reliably detecting actual intrusions. The processor includes video masking (32) to filter known motion present within a scene, detection (34) detecting movement in unmasked portions of the scene, and recognition (36) classifying the cause of the movement. An indication of an intrusion is given only if the cause is one of a class of predetermined causes representing an intruder on the premises, or an unknown cause. A video recorder (38) records images of the actual intrusion and supplies recorded images to a security system operator (O) who informs authorities of in intrusion. The video recorder produces snapshots (X1-Xn) of a scene viewed by the camera detecting the intrusion detected, authenticates (42) the snapshots, and transmits (46) the snapshots for viewing by the operator.