Every security program is built for the organization that existed on the day it was built. The guard post was placed for the building you had then. The policies were written for the headcount you had then. The person managing it all was given the job when it was small enough to manage on the side. The business kept growing and the program mostly did not, and now you are running an organization of a certain size on security that was designed for one considerably smaller. The signs your organization has outgrown its security program are usually visible long before anything goes wrong, if you know where to look.
I have walked into a great many organizations at exactly this stage, sometimes before an incident and too often after one. The same ten signs show up again and again, across industries and across the public and private sectors. I have grouped them here by where they tend to surface, and for each group I have said what I would do about it.
Signs That Show Up in Ownership
The first sign is that no one can say who owns security without hesitating. When I ask an executive team this question and get a pause, or two different names, the program has already outgrown its structure. The second sign is closely related: the person who does own it has another full-time job. Security is sitting with a facilities manager, an office administrator, or an HR director as an additional duty, and it gets the attention that is left over after the primary role is done. That arrangement works at fifty employees. It stops working somewhere well before five hundred, and the person holding the role is usually the one who knows it first.
The third sign is that security has no voice at the leadership table. Budgets get set, sites get opened, policies get changed, and the security function finds out afterward. If your program learns about a new location when the lease is signed rather than when the site is being evaluated, it has been outgrown. The fix for all three of these begins with a single decision: name one person, give them a written mandate and a reporting line to an operating executive, and make security their primary responsibility rather than their side task. For most mid-sized organizations that person is a fractional director rather than a full-time hire, because the work is executive-level but does not yet fill a week.
Signs That Show Up in Vendors and Systems
The fourth sign is a guard contract that has been renewed for years without anyone reading it. The post orders describe a building and a set of duties that have changed, the officers have adapted informally, and nobody inside the organization can say what the contract actually requires. The fifth sign is an access control list that has never been audited. When I pull the credential list in an organization that has outgrown its program, I reliably find contractors whose projects ended, employees who transferred or left, and vendors whose agreements lapsed, all still able to open doors. Each one is a small exposure, and together they are a picture of a system nobody is watching.
The sixth sign is that your security technology was chosen by the people who sold it. The cameras, sensors, and software were recommended by an integrator’s assessment, and the organization funded the recommendations without independent review. That is how organizations end up with expensive coverage of the parking lot and no plan for a hostile termination. Start correcting this group by putting the guard contract, the post orders, and the credential list on one desk and reading them together. Then decide that no future security purchase gets funded on the strength of the seller’s own assessment.
Signs That Show Up in Incidents
The seventh sign is that every incident feels like the first one. A threat, a theft, a confrontation in the lobby, a strange visitor who would not leave: each gets handled by whoever is closest, from scratch, and the response is improvised because there is no process to follow. The eighth sign is that nobody reviews incidents together. Reports go into a file, or an email thread, or a manager’s memory, and no one looks across them for the pattern that individual reports hide. In my experience the pattern is almost always there, and it is almost always visible in hindsight.
Address this by creating a single place where incidents get recorded, however simple, and by putting a monthly review on someone’s calendar. Then write down, in one page, what a manager should do in the three or four situations most likely to arise in your organization, and train the managers on it. A program that has grown with the business already has these things. One that has been outgrown is running on the good judgment of whoever happens to be on shift.
Signs That Show Up When Someone Asks a Hard Question
The ninth sign is that nobody can answer the board, the insurer, or the auditor with confidence. When the question comes, whether it is about workplace violence preparedness, access control, or business continuity, the answer is assembled in a hurry from what people believe rather than from what anyone has verified. The tenth sign, and the one I weigh most heavily, is that nothing has been tested. The evacuation plan has not been run. The alarm has not been traced to the person who receives it. The doors have not been pulled on. The threat protocol has never been exercised as a tabletop with the people who would have to execute it. Everything is assumed to work because nothing has ever proven otherwise.
This last sign is the one I built my doctrine around in Until Tested: Security Is Only Assumed, because it is the one that turns all the others into consequences. An organization that tests its program discovers the outgrown pieces early and cheaply. One that assumes discovers them in the aftermath. The practical step is to pick one assumption this month and verify it, then another the next month, and to make that a standing discipline rather than a one-time project.
What to Do If You Recognized Your Organization
Most executives who read a list like this recognize three or four signs, and a fair number recognize most of them. That is not a reason for alarm. It is a description of what happens to nearly every organization that grows faster than its support functions, and security is usually the last of those functions to catch up because nothing forces the issue until something goes wrong. The work of catching up is orderly and well understood. It begins with ownership, moves through an honest assessment of what exists and what it is actually doing, and settles into a rhythm of review, testing, and adjustment that keeps the program matched to the business as it continues to change. The decision in front of you is whether that work starts now, on your schedule, or later, on someone else’s.
Go Deeper
For the model most organizations at this stage use to bring their program back into step with the business, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director walks through each of these signs, why they form, and the sequence I use to close them.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply