Under the cover of darkness, a man “harboring hatred” toward Pennsylvania Gov. Josh Shapiro made a stunning breach of the sprawling grounds of the executive mansion in Harrisburg, police said.

Over several minutes early Sunday, the intruder evaded security, smashing through ground-floor windows with a hammer and torching two rooms with incendiary devices, before he disappeared back out over perimeter fencing. Had the man found the governor, police later said he told them, he would have attacked him.

The intruder’s ability to break into the Governor’s Residence and then flee — only for a suspect to be apprehended after he turned himself in hours later — exposes potential security gaps and calls into question how a breakdown in protocols seemingly occurred, former state law enforcement officials said. Police identified the suspect as Cody Balmer, 38.

“I was surprised, alarmed, and, quite frankly, I couldn’t believe that happened,” Glenn Walp, the state police commissioner in the 1990s under Gov. Bob Casey, said Monday after he learned about the incident, which included reports of a fire igniting around 2 a.m.

Hours earlier, Shapiro had posted on social media that he was having Passover dinner with his family in the residence’s state dining room. That was the room damaged in what investigators say was an act of arson. No one was hurt.

“This could have turned into something far worse,” Walp said, had the man tried to do something when people were awake. “It could have been a tremendous tragedy.”

State police troopers are tasked with providing the governor with around-the-clock security, whether he’s traveling, at events or at his official residence.

Mark Garrett, a retired California Highway Patrol chief, said security protocols should be in place whether it’s the afternoon, when more people are around, or in the middle of the night, when everyone’s asleep. That an unauthorized person could have been on the property for several minutes, that he was able to cause serious destruction and that he could have gotten close to Shapiro indicates a glaring lapse, he added.

“Something was not followed here,” Garrett said. “There was some breakdown in procedure. Or the procedure was not robust enough to begin with.”

Balmer surrendered to state police Sunday afternoon after, authorities said, an ex-girlfriend also called police. He was charged with attempted criminal homicide, aggravated arson, burglary, terrorism and other counts, the Dauphin County District Attorney’s Office said Monday.

Balmer told police that had he located Shapiro, “he would have beaten him with his hammer,” according to a probable cause affidavit, which added that “Balmer admitted to harboring hatred” toward Shapiro. Officials didn’t provide additional detail.

Investigators say they are reviewing security measures at the property to prevent such an attack from happening again.”We look at all aspects, personnel, technical, surveillance equipment, security equipment, all of that will be reviewed, and we will do our best to ensure that the governor and his family are safe in this residence,” State Police Lt. Col. George Bivens told reporters Sunday.

The 29​,000-square-foot Georgian-style brick mansion has been home to eight governors and their families over the years. It sits close to the Susquehanna River, just off a street accessible to cars.

“It is wide open to the public,” Walp said. “If you’re driving down the street, you stop the car, you open the door and you jump over the fence. It’s not way back in.”

Authorities say Balmer was dressed in black and carrying a bag when, they say, he climbed the nearly 7-foot-high iron fence that surrounds the property. (Such a security breach has been more commonly associated with the White House over the years.)

Cameras are installed throughout the grounds of the Governor’s Residence.

At the time, security “knew that there had been a breach on the property, and we were searching to determine what had occurred,” Bivens said.

The intruder, however, “actively evaded troopers who were here to secure the residence,” he added, “even while they were searching for him on the property.”

During that time, Balmer used a hammer to break the windows of a piano room on the home’s south side, police allege, and then tossed a Molotov cocktail that set off a “substantial fire.”

He went to an adjacent window and broke the glass before he entered inside, where he deployed another device in the dining room, causing a second fire, the probable cause affidavit says. He fled the home through an exit in the room and climbed back over the perimeter fence, investigators added.

“That was all playing out over a period of several minutes,” Bivens said, and it was a “very quick event that occurred.”

Shapiro recounted Sunday that he and his family awoke to the noise of a state trooper banging on their door to guide them to safety.

On Monday, Harrisburg Fire Chief Brian Enterline said a closed door in the area of the residence where the fires were set helped contain the flames and prevent the blaze from rapidly spreading down a hallway.

Had that door been open, it “would have definitely put the governor at even greater risk,” Enterline told reporters.

Given the size of the grounds, especially at night, it’s possible that security wouldn’t have immediately located the intruder, law enforcement experts say.

But whether it could have gotten to the intruder sooner, before he was even able to break into the home, must be assessed, they added.

“From a professional security perspective, the fact that the individual was able to scale the fence and do what he did, that’s not security,” Walp said. “Security should be free of danger and threat, and it shows a hole that needs to be corrected, and I’m sure the state police will correct it.”

He added that officials must determine whether more security personnel are needed and where they should be placed at the residence.

“Obviously, for this situation, security needs to be tightened up,” he said.

Jeffrey Miller, who was the state police commissioner under Gov. Ed Rendell in the 2000s, said determining whether more security is necessary for top public officials and for how long can be complicated since it involves the use of taxpayer money.

Security details for past Pennsylvania governors and lieutenant governors have cost millions of dollars a year, although Shapiro’s predecessor, Tom Wolf, reportedly paid for his own. Such costs also come amid a heightened political climate, when online threats have turned into dangerous swatting incidents and assassination attempts against leaders and their families.

“The divisive nature of political rhetoric in our country has contributed to an increase in both threats, as well as political violence,” Miller said. “People say a lot of things, post a lot of things, make a lot of threats. And you have to cut through that and try to determine which ones are the ones that you really have to be concerned about.”