A security review can look impressive and still leave an organisation exposed. A detailed report, a new policy and a list of recommendations may satisfy an internal requirement, yet none of them tells you whether the people responsible can recognise a problem early, make a sound decision and coordinate a response when conditions become difficult.

That is the point at which security consultancies either add real value or become another layer of paperwork. Good advice changes capability. It gives leaders a clearer view of risk, helps teams make better choices and produces practical improvements that can be maintained after the consultant has left.

For organisations preparing for Martyn’s Law, managing public-facing sites or overseeing complex operations, this distinction matters. The challenge is not simply proving that a document exists. It is knowing whether the measures described in it will work in the hands of real people, on a busy day, with incomplete information and competing pressures.

What security consultancies should change

A consultancy engagement should leave an organisation more capable than it found it. That means more than identifying gaps in guarding, access control, communications or incident planning. Those gaps must be understood in context, prioritised properly and converted into actions that people can carry out.

The strongest work usually starts by challenging the stated problem. A client may ask for a security strategy, for example, when the immediate issue is unclear ownership between security and operations. Another may request a threat and vulnerability assessment but actually need to test whether supervisors know what to do with an escalating concern. A report cannot solve a leadership, training or decision-making problem by itself.

This is where practical judgement matters. A credible consultant does not arrive with a pre-written template and force the site into it. They ask how the operation really functions: who makes decisions, what happens when systems fail, how shift teams communicate, where temporary staff fit in, and whether procedures are used or merely stored.

The answer will vary by environment. A transport hub, hotel, construction project and corporate office may share some security principles, but their operational pressures are different. Advice that ignores those pressures is unlikely to survive contact with reality.

Begin with the operating reality

A useful assessment is not an exercise in finding faults for their own sake. It is a disciplined examination of exposure, consequences and the organisation’s actual ability to manage them. It should consider physical measures and technical systems, but also behaviour, competence and command arrangements.

Consider a venue with clear evacuation procedures and trained security staff. On paper, that may appear satisfactory. But what happens if the incident occurs during a handover, the duty manager is dealing with a separate issue, agency staff are unfamiliar with the layout and radio traffic becomes confused? The weakness may not be the procedure. It may be the assumptions built around it.

Security planning often fails at these joins between functions. Security may understand the threat, operations may understand the site, and senior leaders may hold decision authority. If those groups have not practised working through a difficult situation together, the organisation has a coordination risk. No amount of polished language removes it.

A consultant should therefore assess the quality of decisions as well as the quality of controls. Are risks escalated clearly? Can staff distinguish an observation from an actionable concern? Do managers know when to pause normal operations, seek advice or take protective action? Are contractors and front-of-house teams included in relevant arrangements?

These questions are not abstract. They determine whether early warning is recognised or lost, and whether a response is controlled or improvised.

Risk ratings need an operational meaning

Risk matrices are useful when they support a decision. They are less useful when they create a false impression of precision. Assigning a score to a risk does not explain who owns it, what reduction measure is realistic, how quickly it can be implemented or what residual exposure remains when budgets and operational constraints are considered.

A good consultancy process makes those trade-offs visible. It separates urgent weaknesses from desirable enhancements. It explains when a technical upgrade is justified and when better procedures, supervision or targeted development would achieve more. It also identifies measures that look reassuring but have little effect on the risk in question.

That can be uncomfortable. Organisations sometimes prefer a capital purchase because it is visible and easy to approve. Yet an expensive system with poor monitoring, unclear response protocols and limited staff confidence can create a costly illusion of control.

Reports do not create readiness

There is nothing wrong with reports. Senior decision makers need a defensible record of findings, priorities and recommended investment. The problem begins when the report becomes the end product.

Readiness is demonstrated through performance. Can a team apply its plan without being prompted? Can it communicate a concern accurately? Can a manager make proportionate decisions under pressure? Can security, operations and leadership work from the same understanding of the situation?

This is why assessment, exercises and capability evaluation deserve more attention than they often receive. They reveal the difference between familiarity and competence. A person may have completed training and know the language of protective security, yet still hesitate when faced with an ambiguous situation. That hesitation is not necessarily a personal failing. It may show that training was too generic, practice was limited or responsibility was never made clear.

Digital learning has a role here, particularly for establishing a common baseline and reaching dispersed teams. It works best when it is followed by discussion, local application and feedback. Counter terrorism awareness without the chance to consider how it applies to a particular site can become passive knowledge. It may improve recognition but not action.

Equally, live exercises should not become theatre. An exercise designed to impress senior observers will teach little. The most useful sessions test a limited number of important decisions, allow people to explain their reasoning and expose uncertainty without turning every mistake into blame. The aim is to improve judgement before a real incident demands it.

Choosing between security consultancies

The right consultancy is not necessarily the largest firm or the one with the longest service list. It is the one that can understand the operating environment, communicate honestly and turn findings into manageable action.

Ask how the work will be carried out. Who will conduct the assessment? Will they spend time observing the operation and speaking to those who manage it day to day? How will recommendations be prioritised? What support is available after the report is issued? These questions quickly reveal whether the approach is practical or largely administrative.

It is also sensible to examine the consultant’s view of implementation. A recommendation that demands extensive investment, new staffing and significant disruption may be justified, but it should be accompanied by a clear explanation of why. In other cases, modest changes to roles, briefing routines, maintenance, access arrangements or incident reporting may reduce exposure more quickly.

Experience matters, but relevance matters more. A consultant with operational understanding of public-facing environments, complex sites and crisis decision making is more likely to identify the issues that standard checklists miss. They should be able to explain their reasoning in plain English, including where certainty is not possible.

Be cautious of anyone promising complete security. It does not exist. The proper objective is proportionate risk reduction, improved resilience and a workforce able to respond intelligently when prevention is not enough.

Make the work stick

The value of external advice is decided internally. Assign ownership for each accepted action, set realistic timescales and revisit the decisions when the operation changes. A new site layout, contractor, event programme, technology platform or staffing model can quietly invalidate earlier assumptions.

Leaders should also ask a harder question after the project closes: what can our people now do that they could not do before? If the answer is limited to possessing a better report, the investment has not yet delivered its full value.

The best security advice leaves behind clearer thinking, stronger judgement and people who are more prepared to act when it matters.