A hostile reconnaissance indicators checklist gives staff a disciplined way to recognise behaviour that may precede an attack. It is not a tool for labelling people as threats. It helps teams notice, record and report activity that is out of place, repeated or clearly focused on security arrangements.
For retail sites, venues, hospitality businesses, transport linked locations and critical operations, this matters because hostile reconnaissance can look ordinary when viewed in isolation.
A person taking a photograph, asking a question or walking through a public area may have a legitimate reason.
The concern develops when actions, timing, location and repetition form a pattern and are either above or below the baseline.
What hostile reconnaissance looks like
Hostile reconnaissance is the deliberate collection of information to support criminality, terrorism or another harmful act. An individual may be testing access, identifying weak points, studying routines or assessing how people respond.
They may be working alone or as part of a wider network.
Most reconnaissance activity is designed not to trigger alarm. It may be brief, calm and plausibly explained.
That is why a security plan based only on obvious disorder or aggressive behaviour leaves a void. Modern threats expose old security thinking. A capable organisation trains people to identify context, not just conduct.
The objective is not to make frontline teams suspicious of everyone.
It is to develop professional curiosity, the confidence to recognise what does not fit, ask proportionate questions where appropriate, and pass useful information quickly to the right person.
Hostile reconnaissance indicators checklist
Use this checklist as a prompt for observation and reporting. No single indicator proves hostile intent.
Several indicators, particularly when linked to sensitive locations, security routines or repeated visits, justify closer assessment through established management and reporting procedures.
- Repeated visits to the same site, or to several sites in the same organisation, without a clear customer, visitor or business purpose.
- Unusual interest in entrances, exits, loading areas, staff-only doors, emergency routes, vehicle barriers, plant rooms or service corridors.
- Photography, filming, sketching or note taking focused on security measures, cameras, access controls, guard positions, response vehicles or evacuation arrangements.
- Questions about staff numbers, shift changes, delivery times, opening and closing routines, security patrols, alarm systems or emergency procedures.
- Attempts to enter restricted areas by following staff through controlled doors, exploiting busy periods or claiming to have forgotten a pass.
- Testing of doors, gates, intercoms, turnstiles, perimeter fencing or unattended access points.
- Interest in unattended bags, mail handling, waste areas, storage locations, building services or areas where large numbers of people gather.
- Vehicles that make repeated slow passes, park for prolonged periods with a view of the site, or appear to monitor arrivals, departures and security activity.
- Individuals observing a location from nearby cafés, car parks, public spaces or upper floors, particularly over a sustained period.
- Signs of information gathering through casual conversation, including questions directed at reception staff, cleaners, contractors, delivery drivers or temporary workers.
- Behaviour that changes sharply when challenged politely, such as abandoning the activity, leaving quickly, concealing equipment or becoming evasive.
- A combination of unusual behaviour and prior intelligence, recent threats, high-profile events, contentious activity or an elevated threat environment.
This is a checklist, not a substitute for judgement.
A tourist may photograph a landmark. A contractor may need to understand delivery access. A parent may wait in a car near a venue.
Teams should avoid assumptions based on appearance, ethnicity, religion, age, disability or dress.
Focus on observable actions, context and any credible explanation.
Turn observation into useful reporting
A vague report such as suspicious male near the rear entrance is rarely enough to support a sensible response.
Good reporting allows a supervisor, security control room or police contact to assess what happened without relying on memory or interpretation.
Staff should record the time, precise location, behaviour observed, direction of travel and any interaction with the site. Where lawful and safe, note a clear description of the individual, vehicle registration, make, model, colour and distinguishing features.
Record exact words used in significant conversations rather than rewriting them as an opinion.
The quality of the report matters more than its length. At 16:20, a man photographed the staff entrance and camera above it for approximately three minutes, then asked a delivery driver when the loading bay was least busy gives decision makers something they can act on.
It also allows separate observations to be linked if the person returns.
Protective security teams should define a simple reporting route for every shift.
People need to know who receives the concern, what immediate actions are authorised, how information is logged and when escalation is required. If a threat appears immediate, staff should follow emergency procedures and contact the emergency services.
They should not place themselves at risk to gather more information.
The right response is proportionate
The response should match the behaviour, the site and the available evidence.
In a low concern situation, a visible staff presence or a courteous customer service interaction may be enough. A simple question such as Can I help you find something? can deter hostile activity while providing an opportunity to assess the explanation offered.
Where concerns are stronger, managers may increase observation, protect vulnerable access points, review camera footage, alert neighbouring sites or activate an agreed escalation process.
This must be done lawfully and with care for privacy, fairness and safety.
Unnecessary confrontation can drive a person away before useful details are obtained, or create risk for staff and the public.
Some environments require a higher threshold for action because they handle sensitive operations, receive high-profile visitors or sit within crowded public spaces.
Others need a lighter touch approach because their sites are open and customer-facing. It depends on the threat assessment, the site layout, operating hours and the consequences of disruption.
The checklist should support those decisions, not replace them.
Build the checklist into everyday capability
A checklist kept in a folder will not reduce risk.
People must be able to use it when the site is busy, understaffed or under pressure. That requires short, repeatable training and practical supervision.
Start by identifying the locations and routines an adversary would find most useful: entrances, staff access, public queues, vehicle routes, emergency exits, loading areas, security control points and places where crowds form.
Tailor the indicators to those areas. A conference venue will have different concerns from a retail park, energy facility or hotel, even where the core principles are the same.
Then test staff understanding with realistic scenarios. Ask what they noticed, what they would record, who they would tell and what they would do if the person returned.
Training should include reception, facilities, operations, events, catering, cleaning and contracted personnel. Reconnaissance often targets the people assumed to be least security-aware.
Review reports regularly.
Look for recurring descriptions, similar vehicles, repeated questions, common locations and changes in behaviour around events or operational changes.
This turns isolated observations into intelligence led protective security. It also shows leaders whether training is producing better reports or simply more reports.
Mildot Group’s approach is built around this distinction, compliance documents have value, but capability is what performs when conditions deteriorate.
A hostile reconnaissance indicators checklist is most effective when it sits inside a wider programme of threat assessment, protective security planning, staff competence and rehearsed incident management.
Avoid the common failure points
The first failure is treating every unusual act as proof of hostile intent.
This creates poor decisions, damages customer experience and can lead to unfair treatment.
The second is the opposite, dismissing repeated low level concerns because each one has an innocent explanation. Patterns deserve attention.
Another common weakness is relying solely on security personnel.
Frontline staff may see more of the site, more often, than any dedicated security function. Give them a clear role, simple language and permission to report concerns without fear of being criticised for getting it wrong.
Finally, do not let reporting disappear into an inbox.
Close the loop. Where appropriate, tell staff that a report was received, assessed and used.
Feedback improves judgement, reinforces vigilance and builds trust in the process.
The strongest protective cultures are not built on alarm.
They are built on attentive people who understand their environment, report facts early and know exactly what to do next.
.
Useful Links:
.
