A security plan can look sound until a member of staff dismisses a concern, a supervisor delays a decision or a team waits for permission that will not arrive. That is where behavioural risk becomes visible. It is not an abstract people issue. It is the operational risk created when human judgement, habits, communication and performance do not match the demands of the situation.

Most organisations understand that people can make mistakes. Far fewer examine the conditions that make poor decisions predictable. They rely on policies, induction training and incident reporting, then assume competence exists because information has been issued. It often does not.

Behaviour under pressure is shaped by more than knowledge. Time pressure, unclear authority, fatigue, competing priorities, workplace culture and previous experience all affect what a person notices and what they do next. If the organisation has not prepared people to make sensible decisions in those conditions, it has left a material control to chance.

What behavioural risk means in practice

Behavioural risk is the gap between the behaviour an organisation needs and the behaviour it is likely to see in real conditions. In protective security, this can include a failure to challenge unusual activity, poor escalation, assumptions based on appearance, loss of situational awareness or an inability to communicate clearly when the pace changes.

It also includes leadership behaviour. A manager who discourages reporting because it creates work is creating risk. So is a senior decision maker who treats security as a compliance task rather than an operational function. Teams quickly learn what really matters from the decisions their leaders make, not from the wording of a policy.

The term should not be used as a vague label for difficult people. Nor should it become an excuse to blame an individual after an incident. A useful behavioural risk assessment looks at the system around the person. Were expectations clear? Did they have the authority to act? Had they practised the decision required? Was reporting simple? Did the culture reward good judgement or quiet compliance?

This matters particularly in environments with public access, high footfall, dispersed teams or changing operating conditions. Retail, hospitality, construction, transport, events and corporate sites all depend on people recognising and responding to issues before they become harder to manage. Technology can support that work. It cannot replace attentive, capable people.

Why training alone rarely changes behaviour

Training has value, but attendance is not capability. A person may correctly answer a knowledge check and still hesitate when faced with an ambiguous situation at work. They may know the reporting process but avoid using it because they expect to be criticised for getting it wrong. They may understand the principle of situational awareness but lose it when serving customers, managing a queue or handling several competing tasks.

The uncomfortable truth is that many programmes measure recall when they should measure judgement. They ask whether someone can remember a definition, not whether they can recognise a concern, prioritise it and take proportionate action.

Good development places people in realistic decision scenarios without creating unnecessary drama. It tests what information they notice, what assumptions they make, who they inform and how clearly they explain the issue. Immediate feedback matters because it shows the reasoning behind a better decision, not merely whether an answer was right or wrong.

For organisations preparing for Martyn’s Law, this distinction is especially relevant. Procedures and training records may be necessary, but they do not demonstrate that staff can perform under pressure. Readiness is visible in the quality of decisions, communication and leadership when circumstances depart from the script.

Assess behavioural risk before an incident does it for you

A useful assessment starts with critical moments, not generic competency frameworks. Identify the situations where an error, delay or poor judgement could increase harm, disruption or exposure. Then examine the behaviours required at those points.

For example, a venue may need frontline staff to identify behaviour that warrants attention, report it quickly and avoid making assumptions. A construction project may need supervisors to challenge unsafe shortcuts despite programme pressure. A corporate security team may need duty managers to make timely, proportionate decisions with incomplete information.

The assessment should examine four connected areas:

• What people are expected to notice and understand.
• What decision they are trusted and authorised to make.
• How they communicate, escalate and coordinate with others.
• What environmental or cultural factors make the right action harder.

Evidence should come from more than questionnaires. Observe work where possible. Speak to staff at different levels. Review reporting quality, exercise performance, recurring near misses and decision-making during routine disruption. A polished procedure may describe a strong process while interviews reveal that nobody is confident about who owns the first decision.

This approach can expose a significant problem: the organisation may have capable individuals but no reliable collective capability. One experienced person holding the team together is not resilience. It is a single point of failure.

The behaviours that matter most

The required behaviours will depend on the setting, but several are consistently important. The first is disciplined observation. This is not suspicion of everyone and it is not an instruction to look for a particular type of person. It means noticing activity, context and changes that do not fit the normal environment.

The second is proportionate action. People need confidence to respond without overreacting. That includes asking sensible questions, following reporting arrangements, preserving useful information and escalating concerns when the threshold is met. The best response is rarely the most dramatic one. It is the one that is timely, lawful and appropriate to the evidence available.

The third is communication. Weak reporting is often not caused by indifference. Staff may be unsure what detail matters, who needs to know or whether they are overburdening a colleague. Clear reporting standards, common language and short practice sessions can improve this quickly.

Finally, teams need decision discipline. Under pressure, people commonly seek reassurance, defer to hierarchy or focus on the task directly in front of them. Those instincts are understandable, but they can cause delay. Leaders should define decision boundaries in advance and rehearse them. Staff should know when to act, when to seek support and what information to pass on.

Turning insight into better performance

Behavioural risk reduction is not achieved through a one-off awareness campaign. It requires targeted improvement, repeated practice and visible leadership. Start with the behaviours that affect the highest-consequence decisions rather than trying to change everything at once.

A short, scenario-based capability evaluation can provide a useful baseline. It identifies whether individuals understand the practical implications of a situation and where judgement begins to fail. Used properly, this is not a pass or fail exercise designed to catch people out. It is a diagnostic tool that directs development effort where it is needed.

Managers then need to close the gap in the workplace. If staff are expected to report concerns, supervisors must respond constructively and explain what happened next where appropriate. If teams are expected to make decisions, leaders must avoid undermining them for taking reasonable action in good faith. If communication is weak, exercises should test it using the actual channels and roles people use each day.

There is a balance to strike. Too much prescription can make people dependent on checklists when the situation does not match the checklist. Too little structure leaves them uncertain and exposed. The aim is informed judgement within clear boundaries.

Mildot Group’s approach to behavioural risk focuses on this practical connection between knowledge, judgement and action. The question is not whether people have received information. It is whether they can use it when their normal routine is disrupted.

The most useful question for any security or operations leader is simple: when something does not look right, what will our people actually do? If the answer depends on hope, assumptions or the presence of one experienced individual, the capability gap is already there.