A threat assessment versus vulnerability assessment discussion often becomes confused because both are filed under ‘risk’. That shortcut causes weak decisions. A threat assessment asks what may cause harm and why it may be relevant. A vulnerability assessment asks where people, places, systems or routines could fail to resist, detect or respond to that harm. They are connected, but they are not interchangeable.

For a security manager, the distinction determines where time and money go. For a senior leader, it determines whether an investment reduces a credible exposure or simply looks reassuring on paper. Good protective security starts by being clear about the question being asked.

Threat assessment versus vulnerability assessment: the difference

A threat assessment examines the source of potential harm, its intent where relevant, capability, history, operating environment and likely effect. In a counter terrorism context, this may include the broad threat picture for a sector, location or event, alongside factors that make a particular organisation more or less relevant. In other settings, the threat may come from hostile behaviour, insider actions, protest activity, criminality, severe weather or a disruptive incident.

The point is not to predict the future with false confidence. It is to make a defensible judgement about what deserves attention. Threat is dynamic. It changes with location, profile, timing, public interest, operating hours and the wider environment.

A vulnerability assessment looks in the other direction. It examines the organisation itself: its site layout, access arrangements, physical measures, technical systems, operating procedures, staffing, supervision, communications, dependencies and response capability. It asks where a weakness could be exploited, where control may be absent, and where a control exists but is unlikely to work when pressure rises.

A door can be locked and still represent a vulnerability if staff routinely prop it open for convenience. CCTV can be installed and still offer little protection if nobody monitors alerts, images are poor, or staff do not know what to do when something is seen. A plan can meet a governance requirement and still fail if the people expected to use it have never practised the decisions within it.

That is why vulnerability is not simply a technical checklist. It is an assessment of real conditions and real behaviour.

Risk sits between them

Risk is commonly understood as the combination of threat, vulnerability and consequence. The wording varies between standards, but the operational point remains the same: a credible threat does not automatically create a high risk, and a visible weakness is not automatically the most urgent issue.

Consider a venue with an uncontrolled staff entrance. The vulnerability may be clear. Its priority depends on who could exploit it, what they could access, how often the weakness exists, what barriers sit beyond it and what the consequences would be. Equally, an organisation may operate in a heightened threat environment but have layered, well-managed controls that reduce its exposure.

This is where generic assessment work often disappoints. It identifies dozens of observations, assigns them colours, then leaves the organisation with no clear view of what must change first. More findings do not equal better security. Good assessment turns evidence into proportionate decisions.

What each assessment should produce

A useful threat assessment should give decision makers a current, intelligible view of the threats that matter to their operation. It should explain the basis for those judgements, distinguish plausible concerns from remote possibilities, and identify the conditions that might change the assessment.

It should not become a catalogue of alarming scenarios. Excessive focus on every conceivable threat creates noise and can push teams towards expensive measures that solve the wrong problem. The best threat assessment is specific enough to guide planning but honest about uncertainty.

A useful vulnerability assessment should identify weaknesses in layers of protection, not merely faults in individual components. Those layers include people, procedures, physical security, technology, command arrangements and recovery. It should test whether controls are present, understood, maintained and usable in normal operations.

The output needs to be practical. Findings should state the weakness, the consequence if it remains, the priority, the accountable owner and the improvement required. ‘Improve awareness’ is not an action. ‘Train reception staff to challenge exceptions to visitor procedures, assess performance through observation, and review results monthly’ is closer to one.

The human weakness most assessments miss

Many vulnerability assessments are strongest when measuring assets and weakest when considering behaviour. That is understandable. A fence can be inspected in an afternoon. Judging whether staff will notice, challenge, report and escalate concerns requires observation, discussion and an understanding of operational culture.

Yet behaviour is often the point at which controls succeed or fail. Staff may bypass a procedure to keep service moving. Managers may accept recurring faults because they have become normal. A control room operator may receive information but lack confidence to make a timely decision. During an incident, a team may have a plan but no shared understanding of authority, communications or priorities.

These are not minor training issues. They are vulnerabilities with direct operational consequences.

Organisations should therefore test capability as well as infrastructure. Can the relevant people explain the procedure? Can they apply it to an unfamiliar situation? Do they know when to seek support? Can leaders make proportionate decisions with incomplete information? A short capability diagnostic, table-top exercise or well-designed evaluation can reveal more than a policy review.

When to start with threat and when to start with vulnerability

In an ideal programme, both assessments inform each other. In practice, the starting point depends on the problem.

Start with threat when the operating context has changed. This may be a new site, a major event, a change in organisational profile, a shift in public access, new intelligence or a changing threat level. The organisation needs to understand what it is now preparing for before selecting controls.

Start with vulnerability when the exposure is already visible or an operational failure has exposed it. Repeated unauthorised access, poor visitor management, unreliable alarms, unclear incident reporting or weak contractor control are examples. Waiting for a perfect threat picture before correcting an obvious weakness is poor judgement.

For organisations preparing under Martyn’s Law, the practical requirement is not to treat either exercise as a one-off compliance task. The value lies in understanding the premises, the activities, the people and the arrangements that would support an effective response. Documentation matters, but only when it reflects a capability that exists beyond the document.

A practical assessment cycle

Assessment should be a cycle, not an annual ritual. Begin by defining the decision required. Are you deciding on security investment, event arrangements, a new operating model, a response plan or a training need? This prevents broad assessments that provide interesting information but no operational direction.

Gather evidence from the site, relevant data, staff interviews, incident records, procedures and observation of normal activity. Normal activity matters because this is where workarounds appear. A site that performs perfectly during a scheduled audit may operate very differently during a busy shift change or a service disruption.

Then bring threat, vulnerability and consequence together. Prioritise actions according to the risk reduction they deliver, their feasibility and the consequences of delay. Some changes need investment. Others need clearer ownership, better supervision or practice. Do not assume the expensive answer is the effective one.

Finally, test the change. If access procedures have been revised, observe whether they are followed. If staff have been trained, test judgement rather than attendance. If new technology has been installed, confirm it supports decisions and response rather than creating another unattended alert.

Avoid false reassurance

Security assessments can create a dangerous sense of completion. A report is delivered, actions are logged and leadership assumes the issue is managed. But a control is only valuable when it works repeatedly in the conditions for which it was intended.

Mildot Group’s experience is that organisations rarely fail because they have no policies at all. They fail when assumptions go untested, ownership is vague and people have not developed the judgement to act under pressure. That gap is where assessment must lead: from findings to capability.

The most useful question after any assessment is not ‘Have we completed it?’ It is ‘What would happen if this weakness was tested tomorrow?’ The answer usually shows whether the organisation has reduced risk or merely recorded it.