Facility security surveillance system for a facility, particularly a building, the facility comprising facility elements (5, 50a-c, 51a-d, 52a, 52b), the surveillance system comprising • a central computing unit configured for providing a digital model of the facility, in particular a building information model, the facility model providing topological and/or logical and/or functional relationships of at least part of the facility elements (50a-c, 51a-d, 52a, 52b), • a plurality of surveillance sensors (4, 40a, 40b, 41, 42a, 42b) adapted for, in particular continuous, surveillance of a plurality of the facility elements (50a-c, 51a-d, 52a, 52b) and for generation of surveillance data comprising information about the plurality of the facility elements (50a-c, 51a-d, 52a, 52b), • communication means for transmitting data from the surveillance sensors (4, 40a, 40b, 41, 42a, 42b) to the central computing unit, • state derivation means designed for analyses of the surveillance data and derivation thereof of a state of a respective facility element under surveillance(50a-c, 51a-d, 52a, 52b), wherein the central computing unit is configured to • record a state pattern (9a-9c'') by combining states of at least one facility element under surveillance (50a-c, 51a-d, 52a, 52b) together based on at least one topological and/or logical and/or functional relationship of the facility element (50a-c, 51a-d, 52a, 52b) under surveillance provided by the facility model, the state pattern (9a-9c'') having at least one time stamp, • provide a state pattern critical-noncritical classification model (7, 16, 20, 25, 30), wherein the critical-noncritical classification model (7, 16, 20, 25, 30) considers topological and/or logical and/or functional relationships provided by the facility model and comprises at least one "noncritical"-class (8b, 8b') of "noncritical" state patterns (9a, 9b), • perform a criticality-classification wherein the recorded state pattern (9a-9c'') is classified as "critical" or "noncritical" based on the at least one topological and/or logical and/or functional relationship, • determine a probability for a false positive of a classification and • trigger acquisition of additional data in case the probability for a false positive of a classification is above a defined threshold such that considering the additional data, subsequent classification results in a probability below the defined threshold. • a central computing unit configured for providing a digital model of the facility, in particular a building information model, the facility model providing topological and/or logical and/or functional relationships of at least part of the facility elements (50a-c, 51a-d, 52a, 52b), • a plurality of surveillance sensors (4, 40a, 40b, 41, 42a, 42b) adapted for, in particular continuous, surveillance of a plurality of the facility elements (50a-c, 51a-d, 52a, 52b) and for generation of surveillance data comprising information about the plurality of the facility elements (50a-c, 51a-d, 52a, 52b), • communication means for transmitting data from the surveillance sensors (4, 40a, 40b, 41, 42a, 42b) to the central computing unit, • state derivation means designed for analyses of the surveillance data and derivation thereof of a state of a respective facility element under surveillance(50a-c, 51a-d, 52a, 52b), • record a state pattern (9a-9c'') by combining states of at least one facility element under surveillance (50a-c, 51a-d, 52a, 52b) together based on at least one topological and/or logical and/or functional relationship of the facility element (50a-c, 51a-d, 52a, 52b) under surveillance provided by the facility model, the state pattern (9a-9c'') having at least one time stamp, • provide a state pattern critical-noncritical classification model (7, 16, 20, 25, 30), wherein the critical-noncritical classification model (7, 16, 20, 25, 30) considers topological and/or logical and/or functional relationships provided by the facility model and comprises at least one "noncritical"-class (8b, 8b') of "noncritical" state patterns (9a, 9b), • perform a criticality-classification wherein the recorded state pattern (9a-9c'') is classified as "critical" or "noncritical" based on the at least one topological and/or logical and/or functional relationship, • determine a probability for a false positive of a classification and • trigger acquisition of additional data in case the probability for a false positive of a classification is above a defined threshold such that considering the additional data, subsequent classification results in a probability below the defined threshold.