Somewhere in your inbox there is probably an offer of a free security assessment from a company that sells guards, cameras, or access control. The offer is sincere, the people who show up will be professional, and the report will contain real observations. It will also, with near certainty, conclude that you need more of what that company sells. This is the most common way mid-sized organizations get security advice, and it is the reason so many of them own equipment they did not need while leaving gaps that no product would have closed.
I want to be fair to the vendors here. Most of them are not dishonest. The problem is structural. When the person evaluating your security is paid by the sale that follows, the evaluation bends toward the sale whether anyone intends it to or not. The rule I hold to in my own practice, and the one I recommend to every executive who asks, is that the vendor who assesses you should not be the vendor who sells to you. This article explains why and what to do instead.
How the Free Assessment Actually Works
A vendor assessment is a sales process with a survey attached. The person conducting it is usually a salesperson or a technician whose performance is measured on what gets sold afterward. They walk the site with an eye trained on where their product fits. A camera vendor sees blind spots. A guard company sees uncovered hours. An access control integrator sees doors without readers. Each of those observations may be accurate, and each of them leads to a proposal from the same firm.
What the vendor assessment will not do is evaluate the things it cannot sell you. It will not tell you that your existing guard contract is overstaffed for the risk. It will not tell you that your incident plan has never been rehearsed, that your access list is full of departed contractors, or that your real exposure is a workplace violence risk that no camera addresses. It will not tell you that the cheapest fix is a policy change and a training session. Those findings produce no revenue, so they rarely appear.
Why the Vendor Who Assesses You Should Not Be the Vendor Who Sells to You
Executives already understand this principle in every other part of the business. You would not let your auditor also keep your books. You would not let the contractor bidding on the renovation write the scope of work. You would not let a software vendor decide which of their modules you need without someone on your side of the table who understands the requirement. Security is no different, and if anything the conflict is sharper, because most executives cannot independently judge the recommendations and the vendor knows it.
The cost of getting this wrong runs in both directions. Organizations overbuy, ending up with camera systems nobody watches, guard hours that cover the wrong times, and technology that was never integrated with anything. They also underprotect, because the gaps that matter most are often the ones no product fixes, and nobody with an independent view ever pointed them out. In my experience the second cost is the larger one, and it is the one that shows up in an incident.
What Independence Looks Like
An independent assessor is paid by you, for the assessment, and earns nothing from what you buy afterward. That is the whole definition. They should be willing to tell you that your current vendors are doing fine, that you are overpaying for a service, or that the most important fix costs nothing. They should be able to write a scope of work for a guard contract or a camera project and then help you evaluate bids from several vendors without steering you toward one. If a firm offering assessments also sells products or services that the assessment might recommend, ask directly how they handle that conflict, and listen carefully to the answer.
Independence also means the assessor tests rather than assumes. A vendor walk-through inventories what is present. An independent assessment pulls on doors, watches the guard post at shift change, calls the alarm company to confirm who receives the signal, audits the access list, and runs the incident plan as a tabletop. Those tests are the substance of the P.R.O.O.F. framework I describe in Until Tested: Security Is Only Assumed, and they are precisely the parts of an assessment that a vendor has no reason to perform.
How to Buy Security With Someone on Your Side
The practical sequence is simple. First, get the assessment from someone with no stake in the outcome, and make sure it produces a ranked list of findings written for leadership. Second, use that list to decide what you actually need, and write the requirement down before you talk to any vendor. Third, put the requirement out to more than one vendor and evaluate the proposals against the requirement rather than against each other’s feature lists. Fourth, once you have chosen, have the independent party review the contract and the post orders or installation scope, because the gap between what a vendor proposes and what a vendor delivers is where most of the money leaks.
If you have already accepted a free vendor assessment, do not throw it away. Read it as a proposal rather than an evaluation, note the observations that seem correct, and then have someone independent look at the same sites and tell you what the vendor did not mention. The comparison is usually instructive.
Who Sits on Your Side of the Table
The reason vendor assessments are so common is that most mid-sized organizations have nobody whose job is to evaluate security independently. The facilities manager is busy and not a security professional. The CFO can read a contract but cannot judge whether the post orders make sense. So the vendor fills the vacuum, and the organization’s security strategy ends up being written by whoever made the last sales call. The fix is to put someone with security experience and no sales interest in that seat, and for many organizations that is a part-time executive security director who manages every vendor on the organization’s behalf. That person’s compensation does not change based on what gets bought, which is exactly the point.
Go Deeper
For a full explanation of the part-time executive model and how it handles vendor management, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director devotes considerable attention to buying security services well and keeping the people who advise you separate from the people who sell to you.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply