According to one embodiment, a method, computer system, and computer program product for intrusion movement prediction is provided. The embodiment may include receiving environmental sensor data corresponding to a monitored space as captured by a plurality of sensors affixed to an airflow component. The embodiment may also include generating a three-dimensional model of the monitored space using the received environmental data. The method may further include, in response to determining a disturbance is present in the three-dimensional model, performing a security action.