A door is propped open because it makes deliveries easier. A receptionist stops challenging unfamiliar faces because they have seen too many contractors. A supervisor signs off a check they did not witness. None of these acts may look serious on their own. Together, they show how standards erode before an incident exposes the gap.

The five signs of security complacency are rarely found in a policy or an audit trail. They appear in routine behaviour, informal workarounds and the small decisions people make when they believe nothing will happen. That belief is dangerous. Security arrangements are tested by changing conditions, poor information, human error and determined threat. A system that works only when everyone is fully alert is not a capable system.

Complacency is not the same as laziness or misconduct. Competent people become complacent when familiar tasks feel predictable, pressures compete for attention, or controls seem to slow down the operation. The task for leaders is not to lecture people about caring more. It is to identify why the normal way of working has drifted from the intended standard, then make the right behaviour practical and understood.

Five signs of security complacency

1. Security checks become a tick box exercise

The clearest warning sign is a check that produces a record but no meaningful judgement. Patrols are completed at the same times and by the same route. Visitor logs are filled in without confirming identity or purpose. Equipment checks confirm that an item is present, rather than whether it is usable and appropriate for the risk.

People often defend this behaviour by pointing to completed paperwork. That is precisely the problem. Documentation can show that a process happened, but it cannot prove that someone noticed what mattered, questioned an anomaly or acted on it.

Ask a simple question: if a new person reviewed these records, could they see evidence of observation, decision making and follow up? If every entry looks identical, the process may be administratively compliant but operationally weak. Varying supervision, quality sampling and asking staff what they were looking for can quickly expose whether a check has purpose.

2. Familiar people and routines stop being challenged

Familiarity is useful in a well run operation. Staff learn normal patterns, regular suppliers and the rhythm of a site. The risk begins when familiarity becomes a substitute for verification.

A person wearing a high visibility jacket, carrying a toolbox or arriving at a familiar time can be accepted without the expected checks. This is particularly common in busy venues, retail environments, construction sites and corporate premises, where operational pressure rewards speed and discourages awkward conversations. The person may be entirely legitimate. That does not make the shortcut sound.

Good challenge does not mean treating everyone with suspicion. It means applying a consistent, proportionate process. Staff need language that is polite, clear and easy to use: confirming an appointment, checking identification where required, or directing a visitor to the correct point of contact. If employees are reluctant to challenge because they fear confrontation or believe management will prioritise convenience, the weakness sits above the front line.

3. Known defects become normal

Every site has imperfections. A camera has an intermittent fault. A door does not always close cleanly. A radio battery does not hold charge. A procedure is difficult to follow during peak periods. These issues become serious when people adapt around them for so long that they no longer report them.

This is normalisation of deviance. The control is not working as designed, but because no immediate consequence has occurred, the reduced standard becomes accepted. In time, people stop seeing the defect at all.

The practical test is to ask staff what they work around. Their answers are often more valuable than a formal inspection. A manager should be concerned when employees say, “It has always been like that,” or “We know which doors not to use.” Those phrases indicate an unmanaged vulnerability, not local experience.

Defect reporting must lead to visible action or a clear decision on risk. If people report faults and hear nothing back, they learn that reporting is pointless. Where a permanent fix is not immediately possible, leaders should put proportionate temporary measures in place, explain them and review them. Silence allows the workaround to become the system.

4. Training is treated as completion, not capability

A completed course, an attendance register or a current certificate can provide assurance, but none of them tells you how someone will respond when information is incomplete and the situation is moving quickly. Security complacency grows when organisations mistake learning activity for operational competence.

This matters sharply for protective security and counter terrorism preparedness. Staff may recall key messages shortly after training, yet struggle to recognise suspicious behaviour, communicate a concern clearly or make a proportionate decision under pressure. The gap is not always knowledge. It can be confidence, role clarity, practice or poor escalation routes.

Capability needs testing in a way that reflects the role. That might mean asking a supervisor to explain how they would manage an uncertain report, assessing whether a team can communicate during disruption, or using scenario based evaluation to identify gaps in judgement. The purpose is improvement, not catching people out.

For organisations preparing for Martyn’s Law, this distinction is especially important. A plan and training record have value, but the real question is whether people can put relevant arrangements into action. Readiness is demonstrated through informed decisions and coordinated behaviour, not by the existence of a folder.

5. Warning signs are explained away too quickly

Most concerns do not arrive with certainty attached. They arrive as incomplete observations: an unusual question, repeated interest in a restricted area, a person whose explanation does not quite fit, or activity that differs from the normal pattern. Complacent teams dismiss these signals because each one can be explained innocently.

Often it can. The issue is not that every concern should be escalated as a major threat. It is that people stop using professional curiosity. They decide too early that an observation is nothing, fail to record it, or assume somebody else will deal with it.

A capable team separates observation from conclusion. It records what was seen or heard, considers it alongside context and follows the agreed reporting route. This avoids both extremes: overreaction based on assumption and inaction based on convenience. Leaders should review low level reports as well as serious incidents. A thin reporting culture may indicate low risk, but it can also indicate that people do not believe reporting is useful.

Why complacency survives good intentions

Complacency often survives because it makes the operation feel efficient. A shortcut saves a few minutes. An unreported fault avoids another job. A light touch with visitors reduces queues. The immediate reward is visible; the future consequence is not.

Senior leaders can unintentionally reinforce this when they measure only throughput, cost or customer experience. Those measures matter, but they should not quietly displace security judgement. When staff believe that challenging, checking or reporting will be criticised for causing delay, they will adapt their behaviour accordingly.

The answer is not endless reminders. Repeated messaging without practical change quickly becomes background noise. Teams need clear standards, realistic processes, supervisory attention and feedback that shows their actions matter. They also need permission to pause and make a judgement when the situation does not feel right.

Restoring attention without creating theatre

Start with the work as it is actually done, not the process as it was written. Spend time where access is controlled, visitors arrive, deliveries are received and incidents are handed over. Ask people which rules are hard to follow, which controls create friction and where they believe risk really sits. Listen carefully to the informal answers.

Then focus on a small number of critical behaviours. These will differ by environment, but might include proper visitor verification, reporting defective controls, accurate incident recording and timely escalation. Define what good looks like in observable terms. “Remain vigilant” is too vague to supervise. “Confirm identity and purpose before granting access” is not.

Use short, credible tests of capability. A conversation with staff, a review of how a recent concern was managed, or a scenario that requires a decision can reveal more than a large assurance exercise. Where gaps are found, provide targeted development and revisit the issue. Mildot Group’s approach is built around this principle: turning security theory into action that people can apply under pressure.

Complacency is not removed by asking people to be more alert. It is reduced when an organisation makes sound judgement visible, expected and supported. The most useful question is not whether your security arrangements exist. It is whether your people would notice, decide and act when the routine stops being routine.