A security system comprising: - at least one security device (12.1) at a first user station (32.1), the at least one security device comprising: o a portable housing; o a local power supply for providing an output voltage; o a sensor element; ∘ a processor connected to the sensor element for generating an intrusion message in response to a signal from the sensor element; and ∘ an Internet of things transmitter connected to the processor, the Internet of things transmitter being a narrow-band transmitter configured to transmit the intrusion message directly to a high site of an Internet of things communications path provided by a Low-power Wide-area Internet of things network comprising the high site and which high site is connected to the Internet via an Internet of things network switch; ∘ the sensor element, the processor, the Internet of things transmitter and the local power supply being housed in the portable housing, so that the at least one security device is self-contained and portable; - a cloud-based controller (19.1) for the security system which is connected to the Internet and hosted on a server at a remote central backend and which is in data communication with the at least one security device via the Internet of things communications path for receiving from the at least one security device the intrusion message; and - a terminal which is associated with the first user station and which terminal is configurable to be in communication with the cloud-based controller and operable to configure settings of the cloud-based controller, to cause the cloud-based controller to act on the intrusion message in accordance with the settings which are pre-stored on the cloud-based controller. - at least one security device (12.1) at a first user station (32.1), the at least one security device comprising: o a portable housing; o a local power supply for providing an output voltage; o a sensor element; ∘ a processor connected to the sensor element for generating an intrusion message in response to a signal from the sensor element; and ∘ an Internet of things transmitter connected to the processor, the Internet of things transmitter being a narrow-band transmitter configured to transmit the intrusion message directly to a high site of an Internet of things communications path provided by a Low-power Wide-area Internet of things network comprising the high site and which high site is connected to the Internet via an Internet of things network switch; ∘ the sensor element, the processor, the Internet of things transmitter and the local power supply being housed in the portable housing, so that the at least one security device is self-contained and portable; o a portable housing; o a local power supply for providing an output voltage; o a sensor element; ∘ a processor connected to the sensor element for generating an intrusion message in response to a signal from the sensor element; and ∘ an Internet of things transmitter connected to the processor, the Internet of things transmitter being a narrow-band transmitter configured to transmit the intrusion message directly to a high site of an Internet of things communications path provided by a Low-power Wide-area Internet of things network comprising the high site and which high site is connected to the Internet via an Internet of things network switch; ∘ the sensor element, the processor, the Internet of things transmitter and the local power supply being housed in the portable housing, so that the at least one security device is self-contained and portable; - a cloud-based controller (19.1) for the security system which is connected to the Internet and hosted on a server at a remote central backend and which is in data communication with the at least one security device via the Internet of things communications path for receiving from the at least one security device the intrusion message; and - a terminal which is associated with the first user station and which terminal is configurable to be in communication with the cloud-based controller and operable to configure settings of the cloud-based controller, to cause the cloud-based controller to act on the intrusion message in accordance with the settings which are pre-stored on the cloud-based controller.