A security & counter terrorism plan can look credible in a board pack and still fail at the point of need.

The void usually appears when a member of staff spots suspicious behaviour, an incident develops quickly, or several teams need to make decisions with incomplete information.

A corporate security capability diagnostic exposes that gap before an adversary, a serious incident or regulatory scrutiny does.

For organisations with public facing sites, complex operations or elevated threat exposure, this is not an academic exercise.

It is a practical test of whether security arrangements can reduce risk in the real world.

It examines the people who must act, the plans that guide them, the systems they rely on and the leadership that directs them.

Why capability matters more than paperwork

Policies, risk registers and emergency plans all have a place.

They provide a framework for accountability and help organisations meet their duties. But documentation is only one part of security readiness.

A plan that has not been understood, practised or adapted to the operating environment offers limited protection when pressure rises.

Modern threats expose old security thinking.

Terrorist methodology changes. Hostile reconnaissance can be subtle. Insider risk may develop through behaviour, grievance or poor supervision rather than an obvious security breach.

At the same time, retail, hospitality, event and critical infrastructure environments must remain commercially effective and welcoming.

That creates a constant trade off.

Security must be proportionate enough to support the operation, but credible enough to deter, detect and manage serious harm.

A capability evaluation helps leaders make that judgement using evidence rather than assumption.

It also gives structure to preparedness work associated with Martyn’s Law.

Compliance activity should not become a paper exercise. Organisations need to know whether staff can recognise warning signs, escalate concerns, communicate clearly and make safe decisions in the first critical minutes.

What a corporate security capability diagnostic assesses

A useful assessment looks beyond whether a policy exists.

It tests whether the organisation can apply its security model consistently across sites, shifts, suppliers and management levels.

Leadership, ownership and decision making

Security deteriorates when responsibility is spread widely but owned by no one. A diagnostic considers whether senior leaders understand the threat picture, set clear risk appetite and give security managers the authority to act.

It also examines the quality of incident decision making.

This includes practical questions. Who can close a site, suspend an event or alter operations during a credible threat? How quickly can they obtain reliable information? Are escalation thresholds clear, or do staff delay because they fear disrupting the business?

Threat, vulnerability and risk understanding

A generic threat assessment does not reflect a specific organisation’s exposure.

The assessment should identify what makes the site, people, assets or activity attractive to an attacker, and where vulnerabilities are most likely to be exploited.

For one business, vehicle access and crowded places may be the priority. For another, the greater concern may be unauthorised access to sensitive areas, lone-working staff, hostile surveillance or a poorly managed contractor base.

A evaluation checks whether risk controls reflect these realities and whether they have kept pace with operational change.

People and behavioural performance

Frontline teams are often the first detection layer.

They need more than an instruction to be vigilant. They need enough confidence to identify behaviours of concern, challenge appropriately, report accurately and respond without creating further risk.

The evaluation should test how learning translates into action.

Are staff receiving role relevant counter terrorism and protective security training? Can they recall what to do? Do supervisors reinforce standards during busy periods? Are behavioural risks, fatigue, conflict and poor communication recognised as security issues rather than treated as separate people problems?

Plans, procedures and exercising

An emergency plan must work at three o’clock on a busy Saturday afternoon, not only during a scheduled review. A corporate security capability diagnostic looks at whether procedures are concise, accessible and understood by those expected to use them.

It should also examine exercising.

Tabletop sessions can test leadership decisions and cross-functional coordination. Site based drills show whether communications, access arrangements, evacuation routes and handovers work as intended. Both are valuable, but neither should become theatre.

The aim is to identify failure points, correct them and test again.

Physical security, technology and operational controls

Technical systems can support early detection and better response, but technology is not a substitute for competent people and sound operating procedures.

Cameras, access control, alarms and communications systems need clear ownership, maintenance and response protocols.

A diagnostic considers how these controls work together. For example, a camera may record an unauthorised entry, but what happens next? Is the alert seen in time? Does the receiving team know who to contact? Can they verify the information and take proportionate action? The value is in the operational chain, not the specification sheet.

Contractors, partners and supply chains

Security performance is weakened when contractors operate to different standards or are left outside planning and exercises.

This matters in large venues, multi-site estates, construction projects and complex supply chains, where third parties may control access, maintenance activity, deliveries or key operational processes.

The diagnostic should establish whether expectations are set clearly, checked routinely and enforced fairly. Contract oversight is not just a commercial activity. It is a security control.

How to run the diagnostic properly

A credible assessment begins with the operating reality.

This means reviewing existing plans and incident records, but also speaking to the people who manage sites and perform critical tasks.

Walkthroughs are essential. They reveal differences between the written process and the way a building, event space or operational site actually functions.

Evidence should come from several sources, leadership interviews, staff discussions, observed procedures, training records, system checks, exercises and sample incident reviews.

No single source gives a complete picture. Staff may report high confidence while observation shows uncertainty. A policy may be well written but unavailable to night teams or temporary workers.

The assessment should then rate capability in clear terms.

Leaders need to know what is working, what is partially effective and what requires urgent attention. Findings should be prioritised by consequence, likelihood, operational dependency and effort to improve.

A long list of minor recommendations creates activity. A focused improvement plan creates progress.

Mildot Group approaches this work with the principle that theory must translate into action.

The output should give decision makers a realistic view of capability, alongside practical measures that improve frontline performance and organisational control.

Turning findings into measurable improvement

The diagnostic has value only if it changes what people do.

Some findings may require strategic investment, such as redesigning security governance, improving physical measures or establishing a structured exercise programme.

Others can be addressed quickly through clearer reporting routes, revised briefings, better shift handovers or targeted learning.

Set improvement actions against named owners, deadlines and evidence of completion. Avoid measuring success solely by whether an action has been closed. Better measures ask whether staff can now perform the required task, whether reporting quality has improved, whether incident decisions are faster and whether exercises reveal fewer recurring weaknesses.

Reassessment is equally important.

Security capability changes when sites expand, threat levels shift, teams turn over or new technology is introduced.

High risk organisations should treat capability review as a recurring management discipline, not a one-off project triggered by an incident.

A corporate security capability diagnostic gives leaders a clear answer to a difficult question, are we prepared, or are we merely documented?

The most useful answer is not the most comfortable one.

It is the one that directs attention to the weakness that matters before it becomes the event everyone must explain.

.

Useful Links:

.