How we work
Every case is different. The method does not change.
There are no template reports. Every organisation has its own activity, location, profile and threat level, and security has to answer that specific reality. What stays the same is the method: rigorous, documented and verifiable.
What we do
- Assessment. We measure the organisation's threat, vulnerability and response capability in its real context.
- Audit. We check what is already in place: sites, procedures, people and providers, and whether they work.
- Plan. We set out the measures, the procedures and the decision chain, in order of priority.
- Implementation. We follow the measures on the ground until they are working.
- Oversight. We measure, review and adjust continuously, because the threat changes and security has to change with it.
The risk model: Threat × Vulnerability × Response Capability
We split every assessment into strict components, assessed separately and then combined. No measure is proposed until all three have been measured.
General Threat Environment
Risk rating of the country and of the specific region where the organisation operates, on a scale of 1 to 5:
| Level | Rating |
|---|---|
| 1 | Negligible |
| 2 | Low |
| 3 | Moderate |
| 4 | High |
| 5 | Extreme |
Asset Vulnerability
Does the organisation's profile raise or lower the likelihood of being targeted? We assess the visibility, activity, people, property, location and exposure of each asset.
Mitigation by readiness levels
Mathematical determination of whether the residual risk is acceptable once controls are applied. If it is not, controls are raised a level until it is.
High-risk environments
In high-risk environments, the assessment focuses on specific attack scenarios and on the real effectiveness of countermeasures, measured against formal physical security engineering standards.
Standards we apply
The work rests on the international standards every organisation recognises:
- ISO 31000, risk management. The process of identifying, analysing, evaluating, treating and monitoring risk, common to any organisation and any sector.
- ISO 22301, business continuity. Business impact analysis: which activities cannot stop, for how long, and what it takes to keep them running.
- ISO 18788 and ANSI/ASIS PSC.1, security operations. The framework for managing and controlling security operations, in-house or contracted.
- ISO 27001, information security. Protection of the organisation's information and of the data from each engagement.
Highly complex environments
When the environment is highly complex, such as an operation in an unstable country or travel through high-risk territory, we also use planning methods of military origin, adapted to the reality of a civilian organisation.
IPB (Intelligence Preparation of the Battlefield)
IPB is used to understand the ground and the environment before any movement or decision. It has four mandatory steps:
- Define the operational environment. Set out the area of operations and its geographical, political and social boundaries.
- Describe the environmental effects. Analyse the ground using OAKOC: observation and fields of fire, avenues of approach, key terrain, obstacles, and cover and concealment. This is what shows, for example, which stretch of a route leaves a journey most exposed.
- Evaluate the threat. Characterise who could cause harm, from criminal groups to armed groups or hostile activists: means, methods, capabilities and limitations.
- Determine threat courses of action. Predict what will happen: the Most Likely Course of Action and the Most Dangerous Course of Action, for example a coordinated attack during a journey.
Risk management (ATP 5-19, Risk Management)
ATP 5-19 doctrine treats every hazard the same way, whether it comes from hostile action, terrain, weather, technical failure or team fatigue. Risk management follows a continuous five-step cycle:
- Identify the hazards. List everything that could cause casualties, damage or make the operation fail: crime, attacks, road accidents, disease, natural disasters.
- Assess the hazards. Cross probability with severity in a matrix to obtain the initial risk level.
- Develop controls and make risk decisions. Set technical and procedural measures that bring the risk down to the lowest acceptable level, the residual risk, and decide at the right level whether that risk is accepted.
- Implement controls. Put the measures in place and make sure everyone involved knows them.
- Supervise and evaluate. Check that the controls work and restart the cycle whenever the situation changes.
Decision level and accountability
In formal risk management, the higher the risk, the more senior the person who accepts it. We apply the same principle within the client's organisation:
| Residual risk | Who authorises |
|---|---|
| Low or Moderate | Project or site manager |
| High | Senior management |
| Extreme | Board |
Nothing moves until the decision has been formally taken at the right level.
Operations security (OPSEC) and procedures
To protect people and information on the move, plans include information and procedural controls:
- Communications discipline. Rules for the use of radios, mobile phones and social media at critical moments, so that nobody can follow or locate the teams.
- Standard operating procedures (SOPs). The reaction to an incident is not discussed in the moment: it is defined, rehearsed and drilled into procedures.
- Red teaming. People dedicated to thinking like whoever wants to cause harm, to find the weaknesses in the plan and test it before execution.
Confidentiality and proprietary technology
We do not disclose clients, projects, locations or results. The reports, plans and data from each engagement are handled in tools developed by our own team.