Nobody wakes up worrying about operational resilience. Because it kept them awake all night.

A shopping centre director does not wake up worrying about operational resilience.

They worry about a power outage on a busy Saturday afternoon.

A facilities manager does not worry about operational resilience.

They worry about a critical contractor failing to arrive.

A security manager does not worry about operational resilience.

They worry about an incident escalating faster than information can travel.

Operational resilience is simply the collective name we give to all of those fears.

And that is perhaps why it has become one of the most important topics in modern business.

Not because anybody finds it particularly exciting. But because when it fails, everybody notices.

Today, something has changed.

Security teams are increasingly expected to manage situations that extend far beyond traditional security responsibilities.

A lift fails in a commercial office.

A contractor turns up without the correct accreditation.

A crowd incident develops unexpectedly.

A severe weather event disrupts operations 0r a communications breakdown occurs during an evacuation.

None of these situations begin as conventional security incidents.

Yet security teams are often among the first people expected to coordinate information, direct response efforts and help restore normal operations.

Quietly, almost without anybody noticing, security has become responsible for things it does not directly control.

Imagine a retail destination losing power at 2pm on a Saturday.

The CCTV system goes offline and several lifts stop working.

Tenants begin asking questions. Customers start posting on social media.

Within minutes, the challenge is no longer security – it is coordination.

Who needs to know? Who is communicating with tenants? Who is managing contractors? Who is updating stakeholders?

The event may have started as a technical failure. Very quickly, it becomes an operational resilience problem.

Increasingly, organisations are recognising this distinction. The question is shifting from:

“Could we stop it?”

to: “What happened when we couldn’t?”

The Security Industry Authority recently concluded its consultation on Martyn’s Law guidance, engaging more than 1,800 organisations and receiving almost 200 detailed responses.

What’s interesting is not simply the scale of engagement, but it’s underlying philosophy.

Martyn’s Law does not assume every threat can be prevented. Instead, it asks organisations to think about readiness.

How will information flow? Who will make decisions? How will people respond? What evidence will exist afterwards?

These are resilience questions. Not security questions.

Or perhaps more accurately, they are questions that security is increasingly being expected to answer.

The legislation reflects a wider reality emerging across commercial real estate, transport, retail and public venues.

Perfect prevention is impossible. Preparedness is not.

Today, organisations increasingly care about something different.

Can it be demonstrated?

This sounds like a small distinction. It isn’t.

Once proof becomes important, behaviour changes.

The value of a patrol not only lies in conducting it, but increasingly in proving it happened.

The same is true of inspection, compliance check, emergency drill, contractor inductions and incident response procedures.

The shift from activity to evidence is one of the most significant changes occurring across the security profession.

Most people simply haven’t noticed it yet.

The security function sits at the intersection of operations, facilities management, compliance, health and safety, risk management and technology.

It detects. Interprets. Communicates. Coordinates.

In many organisations, security teams are among the first to become aware of a developing issue.

They are often the first to escalate it.

And frequently the first expected to help manage the response.

This evolution is reflected in the Security Industry Authority’s new three-year strategy, which places increasing emphasis on public protection, preparedness and regulatory effectiveness.

The role is becoming broader, arguably more influential, and certainly more complex.