A security culture is not what people say in a staff survey or what sits in the policy folder. It is what happens when a colleague spots something unusual, when a manager is asked to pause an operation, or when a team must make a decision before all the facts are available. To understand how to assess security culture, look first at behaviour, judgement and the quality of action under pressure.

Many organisations overestimate their position because they can show training records, risk assessments and incident procedures. Those things matter, but they are inputs. A good security culture is an operational outcome. People recognise concerns, report them early, challenge poor practice appropriately and understand their role in a wider protective security effort.

Start with the work, not the policy

The fastest way to get a false answer is to begin by reviewing documentation alone. A policy may be well written and still have little influence on the working day. The real question is whether people can apply it in the conditions they actually face: a busy venue, a pressured project deadline, a difficult customer interaction or a contractor arriving outside normal arrangements.

Spend time where work happens. Observe entry points, handovers, reception areas, control rooms, loading areas and public-facing operations as relevant to the organisation. Watch how people deal with small deviations. Are checks completed with care, or treated as an inconvenience? Do staff know when they have discretion, and when they must escalate?

This is not about catching people out. It is about identifying the gap between the intended system and the lived system. That gap is where vulnerabilities often develop.

A useful assessment also considers whether security is designed into operations or bolted on afterwards. If operational teams see every security control as someone else’s problem, the culture is weak regardless of the quality of the security department.

Test what people understand and can do

Awareness is not capability. Someone may be able to repeat reporting procedures yet hesitate when faced with an ambiguous concern. Equally, a person with little formal security language may show sound judgement because they understand their environment and know who to involve.

Use realistic, role-specific questions. Ask a reception colleague what would make them concerned about a visitor whose details do not match expectations. Ask a supervisor how they would deal with a repeated failure to follow access procedures by a respected member of staff. Ask senior leaders what information they expect during the first stages of a serious incident, and what decisions they are prepared to make.

The quality of the answer matters more than a perfect script. Look for situational awareness, proportionate decision making, confidence to escalate and an understanding of personal limits. A security culture becomes dangerous when people are encouraged to act decisively but have no clear boundaries for when to seek support.

Short capability evaluations can provide useful evidence at scale, particularly across dispersed teams. They should not be used as a box-ticking exercise or as a way to rank people publicly. Their value is in showing patterns: where confidence exceeds competence, where knowledge is inconsistent, and where a particular role or location needs focused development.

Look for the signals people normally hide

Most organisations do not have a reporting problem on paper. They have a reporting confidence problem. Staff may fear being judged, wasting someone’s time or creating friction with a colleague. Managers may avoid recording low-level concerns because they do not want their area to appear poorly managed.

That is why incident data must be read carefully. A low number of reports can indicate a genuinely calm environment. It can also indicate normalised poor practice or a workforce that has stopped believing reports lead to action.

Speak to people privately and ask practical questions. What concerns get raised? What tends not to get raised? What happens after a report? Can staff name an example where a concern led to a visible improvement? If the answer is vague, delayed or cynical, pay attention.

The response to a report shapes culture more than the reporting process itself. When leaders acknowledge concerns, give proportionate feedback and explain decisions, people learn that reporting has a purpose. When concerns disappear into a system with no explanation, staff learn the opposite.

Assess leadership at every level

Security culture is often described as a leadership issue, which is true but incomplete. Senior leadership sets priorities, resources and tolerance for risk. Line managers determine whether those priorities survive contact with daily operations.

A senior team that speaks well about security but routinely overrides controls to protect convenience sends a clear message. So does a supervisor who discourages staff from escalating concerns during a busy period. People follow the behaviour that is rewarded, not the statement displayed on the intranet.

Assess whether leaders understand the operational consequences of their decisions. Do they ask useful questions after an incident or near miss? Do they make time for exercises and learning? Can they explain the organisation’s most credible threats and vulnerabilities in plain English, without relying on generic risk language?

There is a trade-off here. Excessive intervention can make staff passive, waiting for permission rather than using judgement. Too little leadership leaves teams to interpret risk alone. Good leaders set clear intent, define escalation thresholds and support informed decisions close to the point of work.

Use exercises to expose assumptions

A table-top exercise is valuable only if it tests decisions that matter. Generic scenarios produce generic discussion. Use plausible situations that reflect the organisation’s environment, operating hours, public profile, sites, dependencies and existing concerns.

The aim is not to create drama. It is to identify how information moves, where authority sits, what staff assume and whether decisions are realistic. A team may discover that it has an incident plan but no shared view of who can pause operations, speak to stakeholders or authorise additional support.

Observe the behaviour in the room. Does one person dominate? Are difficult questions avoided? Does the team confuse activity with control? A culture that can admit uncertainty and ask for help will usually recover more effectively than one that performs confidence while key facts are missing.

Follow every exercise with a small number of owned actions. Large improvement registers rarely survive. A clear change to a handover process, a revised escalation guide or targeted coaching for managers is more useful than ten broad recommendations with no owner.

Build an evidence picture, not a score for its own sake

A single culture score can help track progress, but it can also conceal the reason behind it. Use a structured assessment across several areas: leadership behaviour, reporting confidence, role competence, operational discipline, learning from incidents and decision making under pressure.

Bring together observations, staff conversations, training and evaluation results, incident themes, exercise outcomes and management decisions. No one source is enough. Surveys can reveal sentiment but not always behaviour. Observations show behaviour but may miss what people are reluctant to say. Incident records show what was reported, not what was ignored.

Patterns are more useful than isolated failures. If several sites show strong procedural knowledge but weak reporting confidence, the answer is unlikely to be another awareness presentation. It may require managers to change how they respond to concerns. If staff report confidently but quality is poor, they may need better examples, clearer thresholds and practical feedback.

Turn assessment into capability

The purpose of assessment is not to label an organisation as good or bad. It is to identify the few changes that will reduce real-world risk. That may mean improving supervisor judgement, refreshing a weak visitor-management process, clarifying incident command or giving public-facing staff more practice in recognising and reporting concerns.

For organisations preparing for Martyn’s Law, this distinction matters. Compliance activity may show that obligations have been considered. Capability shows whether people can act when the situation is unclear, time is limited and consequences are real.

Reassess after meaningful changes, not simply because the calendar says so. Culture shifts when leaders behave differently, teams are given usable tools and reporting leads to visible learning. The most revealing question remains a simple one: when security creates inconvenience or pressure, does the organisation still do the right thing?