Your organization probably has security. There is a guard contract, or an access control system, or at least a set of policies that somebody wrote at some point. What it may not have is anyone whose job is to make all of that work together, to know whether it actually works, and to answer for it when it does not. That missing person is what I call a security leadership gap, and in my experience it is the single most common condition in mid-sized organizations, more common than any specific vulnerability I have ever been hired to find.
The gap is easy to miss from the executive chair because the pieces are all present. Money is being spent, vendors are showing up, and nothing terrible has happened recently. This article explains what the gap is, why it forms, what it looks like from inside the organization, and how to confirm in a few hours whether you have one.
What a Security Leadership Gap Actually Is
A security leadership gap exists when an organization has security activities but no security program, because no one with the background, authority, and time is responsible for the whole. The activities are real. The guard company patrols. The badge system logs entries. HR has a workplace violence policy in the handbook. But nobody has decided what the organization is protecting against, in what priority, with what resources, and nobody is checking whether the activities add up to protection. The pieces exist in isolation, each managed by whoever happened to sign the contract or inherit the task.
The distinction I draw for executives is between managing security and leading it. Managing is making sure the guard shows up and the invoice gets paid. Leading is deciding whether you need a guard at all, what the guard should be doing, how you would know if the post was failing, and what you will do the day something the guard cannot handle walks through the door. Most organizations with a gap have plenty of management and no leadership, and the people doing the managing are usually the first to say so if anyone asks them.
How the Gap Forms
The gap is rarely a decision anyone made. It forms by accretion. A company of forty people needs a lock on the door and an alarm code, and the office manager handles it. The company grows to two hundred and adds a second site, and facilities inherits the alarm and adds a guard because the landlord suggested it. HR writes a policy after an uncomfortable termination. IT installs cameras because the insurance questionnaire asked about them. By the time the organization has five hundred people, security is spread across four departments, none of which considers it their primary job, and the executive team has never had a single conversation about it as a whole.
The other common path is a full-time security manager who was hired for a specific problem and never given the mandate to grow beyond it. This person is often competent and often exhausted. They are running the guard contract and the badging system, responding to whatever lands on their desk, and reporting to a facilities director who evaluates them on cost. They have no seat with leadership and no authority to change how HR or operations does anything. The organization believes it has security leadership because it has a security title. It has a manager in a gap.
What the Gap Looks Like From Inside
There are patterns I look for on the first day of any engagement, and they show up with remarkable consistency. Incidents are handled one at a time by whoever is nearest, and no one reviews them together to see what they have in common. Policies exist but nobody can say when they were last read, tested, or trained. The guard contract has been renewed for years without anyone comparing the post orders to what the officers actually do. The access control list has never been audited, and if you pulled it you would find contractors and former employees who still have working credentials.
The clearest signal is what happens when you ask a simple question. Ask the executive team who owns security and watch how long it takes to get an answer, and whether two people give different ones. Ask what the organization’s top three security risks are and whether anyone has written them down. Ask when the evacuation plan or the threat response process was last exercised. In an organization with security leadership, these questions get quick, consistent answers. In one with a gap, they produce a pause, then a guess, then a promise to look into it.
Why the Gap Costs More Than It Appears To
Executives tolerate the gap because its cost is invisible until it is not. Meanwhile the organization overpays for the security it does have, because vendors set the terms and no one with expertise pushes back. It buys technology it does not need because a salesperson performed the assessment. It carries liability it does not know about, because a policy in the handbook that nobody follows is worse in litigation than no policy at all. And it leaves managers to improvise when a threat arrives, which is where the aftermath I have spent my career looking at usually begins.
The gap also creates a quieter cost in leadership time. Every incident, every vendor renewal, every uncomfortable question from the insurer or the board lands on an executive who has to work it from scratch. A COO who spends a week each quarter on security matters they do not understand is paying for a security director already, in the most expensive currency the organization has.
How to Confirm Whether You Have One
You can diagnose this yourself in an afternoon. Write down, by name, who owns security in your organization and what authority they hold, then ask three other executives the same question separately and compare answers. Pull the guard contract and the post orders and read them side by side, then spend twenty minutes at the post watching whether the orders are being followed. Request the full list of active credentials from whoever administers the badge system and ask how many of those people still work for you. Find the last outside assessment, if there was one, and count how many recommendations were implemented.
Then pick one assumption and test it. Call the alarm monitoring company and ask who receives the signal and what they do with it. Walk to a perimeter door that is supposed to be locked and pull on it. Ask a manager what they would do if an employee they just terminated said something threatening on the way out, and see whether the answer matches the policy. This is the doctrine at the center of Until Tested: Security Is Only Assumed, and the P.R.O.O.F. framework in that book gives you a structured way to work through it. If the tests come back clean and the answers match, you may not have a gap. If they do not, you have found it, and the next question is who is going to close it.
Go Deeper
For the model most mid-sized organizations use to close the gap without a full-time hire, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director is built around the leadership gap, how it forms, and the part-time executive model that closes it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply