The security industry has traditionally sold protection: stronger barriers, better surveillance and more visible deterrence. But this month’s industry news suggests a subtle change. Increasingly, good security is being judged not by whether disruption ever occurs, but by how ready an organisation is when it does.
There is an odd thing about umbrellas.
Nobody buys one because they believe it will stop the rain. They buy one because they have accepted that the rain is probably going to happen anyway.
Security has not always enjoyed the same philosophical freedom.
The industry has naturally presented itself through the language of prevention.
Security stops theft. Barriers stop intrusion. Cameras deter offenders. Access control keeps unauthorised people out.
It is an understandable promise.
Prevention is reassuring, visible and easy to explain.
Preparedness is less glamorous. It begins by admitting that the fence may be climbed, the alarm may sound and the carefully written procedure may one day be needed outside the calm surroundings of a meeting room.
Yet much of this month’s UK and European security news points towards precisely this shift.
Protection remains essential. But preparedness is becoming the more meaningful test of whether security works.
The reassuring fiction of total security prevention
The problem with prevention is not that it is ineffective. It is that it can never be absolute.
Recent analysis in Security Journal UK describes the British high street as an increasingly complex threat environment, citing British Retail Consortium figures that put the combined cost of retail crime and crime prevention at £4.2 billion.
The article also points to more than 20 million theft incidents and offenders who may conduct reconnaissance, arrive equipped to remove goods at scale and operate as part of organised networks.
This does not mean retail security operations have failed.
It means determined and adaptive threats will occasionally find a way through even a well-defended environment.
The same is true elsewhere. A venue can improve entrance controls but cannot eliminate every conceivable threat.
A corporate estate can strengthen its perimeter but cannot guarantee that every person and process will behave exactly as intended.
If the definition of good security is “nothing bad ever happens”, almost every security operation is eventually destined to fail.
Perhaps we have simply been using the wrong definition.
The security response, is the true test
A more useful test begins at the moment prevention fails.
- How quickly is the problem recognised?
- Do people know what they are expected to do?
- Can the organisation communicate clearly under pressure?
- Are responsibilities understood?
- Can operations adapt while events are still developing?
In a recent interview on security resilience, Nikolaos E Chatzovoulos argues that resilience now includes the ability to
“anticipate threats, absorb disruption, adapt to changing conditions and continue operating.”
He makes an important distinction: resilience is not simply recovering once a crisis is over. It is continuing to function while the crisis is still unfolding.
That is a much more demanding standard than owning the right equipment.
A camera can show that something happened. A barrier can delay it. An alarm can announce it.
Preparedness determines whether the organisation can make sense of what happens next.
How to track and record security incidents
Incident Management System
Ensure serious events are recorded consistently and in full. Structured, logic-based reporting guides teams to capture the right details at the time, reducing gaps, assumptions, and incomplete records.
Daily Occurence Log
Record patrol completion, observations and notable activity identified during routine security patrols.
Security preparedness is more than a plan
Organisations are unusually good at mistaking the existence of a plan for the existence of preparedness. The two are not interchangeable.
A plan is a statement of intent created under favourable conditions.
Preparedness is the ability to carry it out when information is incomplete, people are under pressure and events refuse to follow the approved flowchart.
A policy may say that an evacuation will occur.
Preparedness asks whether people understand the procedure and whether anyone has considered the visitor in the meeting room who has no idea where the exits are.
A risk assessment may identify a vulnerable entrance.
Preparedness asks what happens when it is exploited at 8.45 on a Saturday evening, rather than at 10.00 on a Tuesday morning when the senior management team is available.
A training record may show that somebody attended a course.
Preparedness asks whether they can still apply it six months later.
Mike Hurst of IFPO UK argues that obtaining the required licence should mark the beginning of an officer’s development, not its conclusion. He highlights further training in conflict management, counterterrorism, safeguarding and crime-scene preservation.
That is not merely a workforce issue. It is a preparedness issue.
The least visible security, may matter most
There is a natural bias towards visible protection. A new barrier looks like an investment. An upgraded camera produces an image. Another officer at the entrance is immediately noticeable.
Preparedness is harder to photograph. It exists in briefings, exercises, maintained equipment, clear responsibilities and conversations about situations everyone hopes will never happen.
People are often more comfortable paying to reduce the probability of an incident than paying to improve their response to one.
The first feels optimistic.
The second feels rather like admitting defeat in advance.
But accepting that prevention has limits is not defeatism. It is maturity.
Airlines do not carry life jackets because they lack confidence in aircraft. Buildings do not install fire exits because architects expect them to catch fire.
They do so because certainty is unavailable at any price.
Security should be allowed the same realism.
Achieving security readiness
None of this means the industry should abandon protection.
Effective barriers, surveillance, access control, intelligence and visible security will continue to reduce risk. Prevention will always be preferable to response.
But protection and preparedness answer different questions.
Protection asks: What can we stop?
Preparedness asks: What will we do when something gets through?
The strongest security operations will answer both.
They will invest in preventing foreseeable incidents while accepting that uncertainty cannot be engineered entirely out of human environments. They will consider not only whether procedures exist, but whether those procedures remain understood and practical.
Most importantly, they will resist measuring security solely by the absence of incidents.
An uneventful month may indicate excellent protection. It may also indicate good fortune.
The difference often becomes visible only when something goes wrong.
Security cannot credibly promise that nothing ever will.
But it can ensure that, when prevention reaches its limits, the organisation is not encountering the problem for the first time.
