If you ask who is responsible for security in your organization, you will probably get a name. There is a person who handles the guard vendor, approves badge requests, resets the alarm code, and gets the call when something happens overnight. That person is managing security, and in most mid-sized organizations they are doing it well within the limits of their role. The question I would ask next is different. Who decides what the organization is protecting, how much risk it is willing to accept, and whether the program is working. In the debate over security management vs security leadership, that second set of questions is the whole difference, and it is the difference that decides outcomes.
This distinction matters to you as an executive because the two functions look identical from the outside. Both produce reports, both attend meetings, both keep the building calm. The gap between them only becomes visible when something goes wrong and leadership discovers that every task was being done and no one was accountable for the result. I have watched that discovery happen in organizations of every kind, and it is rarely the fault of the person managing security. It is the result of an organization that never created the leadership role in the first place.
What Security Management Does
Security management is the work of keeping the existing program running. It schedules the officers, orders the badges, maintains the camera system, files the incident reports, and renews the contracts. It responds to requests from other departments and resolves the problems that come up day to day. Done well, it is careful, consistent, and largely invisible, which is exactly what the organization wants from it. A good security manager is worth a great deal, and I have worked alongside many who held their organizations together with very little support.
The limit of management is that it operates inside a set of decisions someone else made, or that no one ever made at all. The manager works the guard contract but did not set its scope. The manager issues the credentials but did not decide who should hold them. The manager files the incident reports but has no authority to change the policy that keeps producing the same incidents. When the decisions were never made, the manager fills the gap with habit and precedent, and the program becomes whatever it has always been.
What Security Leadership Does
Security leadership is the work of deciding what the program is for and whether it is delivering. A leader begins with the organization’s actual risks, which requires understanding the business, the workforce, the sites, and the threats that are realistic rather than merely imaginable. From that understanding the leader sets priorities, which means choosing what gets protected first and what the organization will consciously accept. Then the leader designs the program to match, funds it in terms the finance function understands, and sits at the table where the organization’s other leaders make decisions that create exposure.
The other half of leadership is verification. A leader does not assume the program works because it is running. The leader tests it, walks the sites unannounced, runs the incident plan as an exercise, reads the access records, and reviews the vendor against the contract. When the tests reveal gaps, the leader has the authority to close them and the standing to tell the board what was found. This is the discipline I built Until Tested: Security Is Only Assumed around, and it is the single clearest marker of whether an organization has leadership or only management.
Why the Gap Is So Common
Most mid-sized organizations grow into their security programs by accident. A receptionist starts handling visitor badges, a facilities manager inherits the alarm contract, an office manager becomes the person who calls the guard company. Each of these is a management task assigned to a capable person, and over time the collection of tasks starts to look like a function. What never happens is the deliberate decision to create a leadership role, because the organization does not feel the absence until an incident reveals it.
There is also a cost logic that keeps the gap open. A full-time security executive is an expensive hire for an organization that has never had one, and the people doing the management work appear to be handling things. Leadership sees a program that runs and reasonably concludes that it works. The distinction between those two words is where the risk lives, and it is a distinction that management alone can never surface, because the manager is inside the program and cannot easily see what the program is missing.
How to Tell Which One You Have
There are a few questions that separate the two quickly. Ask who last reviewed the list of people with building access and when. Ask when the incident response plan was last exercised rather than filed. Ask what the organization’s three highest security risks are and who decided that. Ask whether the guard contract has been compared against actual delivery in the last year. Ask who briefs the executive team or the board on security and how often. If the answers are vague, or if they all point to a person who has no authority to change anything, you have management without leadership.
It also helps to notice how security enters your own decisions. When a new site is leased, a layoff is planned, or a public event is scheduled, does anyone raise the security implications before the decision is made, or does the security person learn about it afterward and adapt. Leadership is in the room before the decision. Management hears about it later and does its best.
Closing the Gap Without Overbuilding
The answer is rarely to replace the person managing security. That person usually knows more about the organization’s real vulnerabilities than anyone else and is the leader’s most important ally. The answer is to add the leadership layer above the management work, and for most mid-sized organizations that layer does not need to be full-time. A part-time executive director can set the priorities, build the program, test it, and brief the board on a retainer that fits a modest budget, while the existing manager keeps running the operation with clearer direction and more support than before.
Start by writing down, in one page, what the organization is trying to protect and from what. If no one can produce that page, that is the first deliverable of a leader. Then commission an independent assessment of the current program against those priorities, define what the security manager is accountable for and what remains undecided, and put someone with authority in charge of the undecided part. The management work will improve immediately, because for the first time it will have a direction to serve.
Go Deeper
The leadership layer described here is exactly what the fractional model is designed to provide, and I lay out how it works in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director explains why most mid-sized organizations have this gap and how a part-time executive director closes it without displacing the people already doing the work.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply