How a five-second decision becomes a national security alert

Nobody goes to work in the morning thinking they are going to make a decision that causes a company-wide security alert, and ends up in the newspaper. 

A decision gets made in a few seconds. Most of the time, nothing happens. Occasionally, the consequences travel much further.

Travelodge recently provided a very public example. The hotel chain came under scrutiny after incidents in which unauthorised people were given access to guests’ rooms. In one case, a man was reportedly given a room key after falsely claiming his girlfriend was in distress, without the necessary verification taking place.

The consequences extended considerably beyond the reception desk.

Travelodge subsequently reviewed its security procedures, tightened room-access controls, audited secondary locks and began retraining more than 12,000 employees. On 20 August, chief executive Joanna Boydell resigned amid the wider fallout.

The Guardian reported on the incidents, Travelodge’s response and the subsequent resignation.

This is not really a story about one hotel company.

It is a particularly visible example of a problem every large organisation faces: security policies may be created centrally, but thousands of individual security decisions are made every day by people operating far away from the people who wrote them.

The distance between a five-second decision and a company-wide security alert can be surprisingly short.

The contractor says everyone knows them and a colleague normally lets them through.

These situations don’t sound particularly impactful, they probably happen everyday without consequence.

But operationally, a very clear policy has become a human judgement call.

That doesn’t necessarily mean employees don’t understand the procedure. It means the procedure is competing with convenience, familiarity, time pressure and the perfectly human desire to solve the immediate problem.

The UK’s National Protective Security Authority recognises this distinction in its guidance on security behaviour. Rather than relying solely on instructions or training, it recommends shaping the environment so that secure behaviours are easier to perform. Its examples include redesigning reception areas to reduce tailgating and ensuring employees have the time, resources and social support necessary to follow procedures.

NPSA’s 5Es guidance explores how organisations can embed effective security behaviours.

In other words, telling somebody what to do is only part of the problem.

You also have to make it realistic for them to do it.

The same checkpoint gets skipped again.

Eventually the shortcut no longer feels like a shortcut. It becomes how things are done.

This phenomenon is often described as normalisation of deviance: behaviour gradually moves away from an agreed standard because previous deviations haven’t resulted in obvious negative consequences.

And this creates one of security’s more uncomfortable paradoxes.

Success is a surprisingly poor way of proving that a security shortcut was safe. Sometimes it only proves that you were lucky.

The procedure might have been bypassed 50 times without consequence.

That doesn’t make the 51st attempt any safer.

A missed identity check begins as an operational exception. If somebody gains unauthorised access, it becomes a security incident.

If an established procedure wasn’t followed, questions of compliance and governance follow.

If someone is harmed, legal and reputational issues can appear.

If the story reaches the national press, senior leadership may suddenly find itself answering questions about a decision made several organisational layers below.

Nothing about the original five-second decision changed. Only its consequences did.

This is perhaps why security operations increasingly have to look beyond whether procedures technically exist.

The Security Industry Authority’s new 2026–29 strategic plan explicitly says it will focus for the first time on the quality of security provision, rather than simply compliance. It also argues that premises and events need to ensure protective security is actually working in practice.

Read the SIA Strategic Plan 2026–29.

Having a security process and having a security process that survives contact with reality are two different things.

Security officers recognise unusual behaviour. Reception teams spot inconsistencies. Facilities teams adapt when something unexpected happens. Managers make decisions in situations no written procedure could have anticipated perfectly.

Human judgement isn’t a design flaw.

The challenge is preventing legitimate judgement from slowly turning into invisible operational drift.

That means organisations need to understand not only whether major incidents occur, but what is happening in the quieter moments before them.

Are activities repeatedly being missed? Are particular procedures constantly overridden? Are incidents regularly recorded late?

That does not mean every exception represents failure. Nor does it mean every frontline decision should be second-guessed from a boardroom.

It means organisations need enough visibility to understand when isolated exceptions are becoming patterns.

Nobody standing at reception believes they are making a decision the chief executive might eventually have to answer for.

Nobody missing a patrol assumes tonight will be the night something happens.

Nobody waving through a familiar contractor thinks they are undermining the company’s access-control policy.

Most of the time, they are right.

And that may be exactly why the behaviour becomes dangerous.

Security policies matter. Technology matters. Training matters.

But somewhere between all three is still a person making a decision in five seconds.

The strongest security operations aren’t those that pretend those decisions can be eliminated.

They’re the ones capable of seeing when the exception is quietly becoming the norm.