If you lead a mid-sized organization, there is a fair chance that security belongs to no one in particular. Facilities handles the doors and the cameras. HR handles the difficult employee. IT handles the badges because the badge system runs on a server. The office manager holds the guard contract because someone had to sign it. Each of these people is doing their part in good faith, and none of them believes they own security, because nobody ever told them they did. What happens when nobody owns security is a pattern I have watched repeat across thirty years in law enforcement, fire service, private security, and federal government, and it looks the same every time.
The pattern is quiet for a long time, which is the reason it survives. Nothing visibly breaks. The building opens in the morning and locks at night, the guard is at the desk, the cameras record. Leadership reasonably concludes that security is fine, because the absence of an incident feels like evidence of a program. It is not. It is evidence that nobody has tested the assumptions yet, and the test usually arrives on its own schedule.
The Pattern When Nobody Owns Security
The first sign is that decisions get made by whoever is standing closest to the problem. A door is propped because deliveries are easier that way. A visitor process is dropped because the receptionist left and nobody trained the replacement. A contractor is given a badge because the project manager asked and IT saw no reason to say no. None of these are bad people making bad choices. They are reasonable people making local choices with no one holding the overall picture, and the overall picture is where the risk lives.
The second sign is that information does not travel. The night guard notices the same car in the lot three nights running and mentions it to the vendor supervisor, who does not know who at the client to tell. HR separates an employee who made an alarming comment and does not think to inform the front desk. Facilities changes a lock and does not mention it to the person who keeps the key list. Each department has a piece of a picture that would concern anyone who saw it whole, and there is no whole because there is no one whose job it is to assemble it.
The third sign is drift. Policies written years ago describe a building that has since been renovated and a headcount that has doubled. The access list contains people who left long ago. The guard post orders reference a shift that no longer exists. Drift happens in every organization, and a program with an owner catches it on a schedule. A program without one catches it in the incident report.
Why Good People Let It Happen
Executives sometimes hear this and feel accused of negligence. That is rarely what is going on. Security is a function with no natural home in the org chart of a company that makes products or delivers services, and it does not generate revenue, so it never wins the argument for a full-time executive against a sales hire or an engineer. It gets distributed by default, and distributed ownership is the same thing as no ownership. The people who inherit pieces of it are also carrying full-time responsibilities of their own, and they do the security portion in the margins, which is exactly where it should not be done.
There is also a comfort in ambiguity. If nobody owns security, nobody has to deliver bad news about it, and nobody has to ask for the budget to fix what is found. Naming an owner means the organization has decided to know the truth about its exposure, and some leadership teams, without ever saying so, would rather not.
How It Ends
The pattern ends in one of two ways. In the fortunate version, a new executive or a board member asks a simple question, such as who is responsible for security here, and the silence in the room becomes the beginning of a program. In the other version, something happens. A theft that turns out to have been going on for a year. A former contractor found inside the building with a badge that still worked. A workplace violence incident that three separate departments had each seen a warning sign of. The investigation that follows always produces the same finding, which is that the information existed and the ownership did not.
I would rather every organization reach the first ending, and the difference between the two is usually one decision made by leadership before anything goes wrong.
How to Tell If This Is Your Organization
Ask four questions of your leadership team and listen for hesitation. Who is accountable for security, by name? When was the access control list last reviewed against the current headcount and contractor roster, and by whom? If a manager had a concern about an employee’s behavior tomorrow, who would they call and what would happen next? When did anyone last physically test whether the after-hours doors are actually secure? If the answers are vague, or if different people give different answers, you have your diagnosis.
Then walk the building yourself, at an hour when you would not normally be there. Pull on doors. Watch the front desk for ten minutes. Note what you see. Leaders are often surprised by how much they learn from an hour of looking, and the exercise costs nothing.
Giving Security an Owner
The fix does not require a full-time security department. It requires one person with the authority, the training, and the time to hold the whole picture, and it requires leadership to state in writing that this person owns the function. In larger organizations that is a security director. In most mid-sized organizations it is either an internal leader who is given the role and the training to do it, or a fractional security director who provides the executive function on a part-time basis. Either way, the owner’s first tasks are the same: assess what is actually true, put the basic disciplines on a calendar, build the relationships across departments so that information travels, and report to leadership in plain terms.
Once an owner exists, the owner’s job is to stop assuming and start verifying. That is the doctrine at the center of Until Tested: Security Is Only Assumed, and it is the habit that keeps the pattern from returning. Doors get pulled on. Lists get reconciled. Plans get exercised. The organization knows what is true, and leadership can answer the question when the board asks it.
Go Deeper
For a full explanation of how a part-time security executive fills this gap and what the role involves, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director lays out the case for closing the leadership gap and the practical steps for doing it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply