Internet of things (IoT) technologies are becoming a more and more widespread part of civilian life in common urban spaces, which are rapidly turning into cyber–physical spaces. Simultaneously, the fear of terrorism and crime in such public spaces is ever‐increasing. Due to the resulting increased demand for security, video‐based IoT surveillance systems have become an important area for research. Considering the large number of devices involved in the illicit recognition task, we conducted a field study in a Dutch Easter music festival in a national interest project called VISOR to select the most appropriate device configuration in terms of performance and results. We iteratively architected solutions for the security of cyber–physical spaces using IoT devices. We tested the performance of multiple federated devices encompassing drones, closed‐circuit television, smart phone cameras, and smart glasses to detect real‐case scenarios of potentially malicious activities such as mosh pits and pick‐pocketing. Our results pave the way to select optimal IoT architecture configurations—that is, a mix of CCTV, drones, smart glasses, and camera phones in our case—to make safer cyber–physical spaces' a reality.