Most organizations have invested heavily in physical security. Access control systems, CCTV, physical barriers, security officers and established procedures help protect people, facilities, and operations every day.
But physical security answers only part of the risk equation. Which threats are emerging? Could activity in your industry, at another location or around one of your executives change your risk exposure? And how do you know where the next disruption may originate?
This is where Risk Intelligence comes in.
We spoke with Jess, Risk Intelligence Analyst, about the difference between information and intelligence, the limits of physical security on its own and how organizations can move from reacting to incidents towards anticipating risks.
Jess, if you had to explain Risk Intelligence to a customer in simple terms, what would you say?
Jess: Risk Intelligence helps an organization make better security decisions. We start by understanding the organization itself: its business, locations, people, operations and unique threat environment. We then analyze the information around that context and turn it into intelligence the organization can use.
The distinction between what a customer wants to know and what they need to know is important. A customer may initially focus on a specific issue, but our analysis might identify another development that is more relevant to its risk exposure. Our role is therefore not simply to answer a predefined question. It is to help the customer see the bigger picture and understand which threats deserve attention.
The result is decision-making advantage. Instead of starting the day without a clear understanding of what may be developing around the organization, decision-makers gain a more informed view of the threats they could face.
But customers already have access to news, social media, and online information. Why do they need an analyst?
Jess: Because access to information is not the same as understanding risk. Anyone can access news reports, Google, or social media. The difficult part is determining whether a piece of information is reliable, relevant to a specific organization, and significant enough to influence a security decision.
An analyst has to consider many factors simultaneously. That can include the organization’s background, its locations, its industry, previous incidents, relevant threat actors, and the broader social, political, or geopolitical landscape. We then assess how those elements relate to one another and what they could mean for the customer.
Information is the raw material. Analysis gives that information context, relevance, and meaning. Without that step, an organization may have a lot of data but still not know whether it is facing a credible threat, how that threat could evolve, or whether a response is required. That transformation from information into intelligence is the value an analyst provides.
So is the problem today not a lack of information, but too much information without enough context?
Jess: Exactly. Organizations can be surrounded by information and still miss what is most relevant to them. More information does not automatically lead to better decisions.
Our role is to identify the developments that matter within the customer's individual context. We look for patterns, assess possible threat vectors and consider how risks may be evolving. The analysis also has to remain open-minded. We cannot simply search for evidence that confirms what we already believe or what the customer initially expects to find.
Sometimes a customer wants to know about X, Y and Z, but the analysis shows that A, B and C may be more important. Good Risk Intelligence therefore does not just repeat what the customer already knows. It can help reveal a risk or connection that has not yet received enough attention.
Let us take the most common customer objection: 'We already have cameras, access control and security officers. Why would we need Risk Intelligence as well?'
Jess: Physical security is essential, but it addresses a different part of the security challenge. Cameras, access control, barriers and security officers help protect an organization physically. Risk Intelligence adds situational awareness and a broader understanding of the threats that may be emerging around that organization.
For example, when we support a company in the data center sector, we do not only look at the security of one single facility. We consider developments affecting the wider sector and then connect those with the customer's individual circumstances. Its location, business activities, executives, public profile or internal environment can all influence its threat exposure.
Risk Intelligence does not replace physical security. It helps an organization make its physical security programs more informed. If decision-makers understand their relative threats, how likely they are and how they are evolving, they can assess whether their current security posture is appropriate.
Physical security protects the organization. Intelligence helps determine what the organization should be preparing for.
Does that mean traditional security is mainly reactive and Risk Intelligence is proactive?
Jess: Intelligence can certainly help an organization become more proactive. Physical security measures remain invaluable, but without a relevant threat picture, teams may have to respond to situations as they develop.
Risk Intelligence provides context before that point. It helps organizations understand their threats, what those threats may evolve, and how developments across a sector or location may affect them. That knowledge can inform security measures, the allocation of resources and the areas that require particular attention.
The advantage is not that intelligence predicts every incident. It is that an organization does not have to approach every day without an informed view of its risk environment. They can prepare for credible scenarios and make decisions before an issue reaches the point at which the only remaining option is to react.
What does an analyst look for when beginning work with a new customer?
Jess: We begin by understanding the customer's context. There are broad threat categories, including crime, terrorism and environmental risks, but those categories alone are not enough. Two organizations in the same industry can still have different locations, executives, operating models and public profiles, and therefore different risk exposures.
Experience helps an analyst recognize relevant patterns, but curiosity is just as important. You have to keep asking questions and be willing to investigate areas that may not appear significant. At the same time, you need to remain aware of your own assumptions and avoid confirmation bias.
The objective is not to create the largest possible list of risks. It is to provide analysis that addresses the customer's actual threats and supports informed decision-making.
Customers need more than an interesting report. How does Risk Intelligence translate into action?
Jess: Intelligence has to reach the right people at the right time and in a format they can use. Depending on the customer and the assignment, that may involve an initial threat assessment, regular intelligence updates or an immediate briefing when a development cannot wait until the next reporting cycle.
The purpose is not simply to tell a customer that something has happened. We need to explain why a development may be relevant, how it relates to the customer's operating environment and whether it could require attention.
That can help security leaders decide whether their current measures remain proportionate, whether resources need to be adjusted or whether a particular location or development needs closer monitoring. The analysis becomes valuable when it informs a real-world decision.
You supported security operations at Oktoberfest. How did that work in practice?
Jess: The work started before we arrived on site. We worked with the German team to establish the local context and produced a pre-event threat assessment. That created a shared understanding of the potential threats and gave the monitoring a clear focus.
During the event, we produced daily intelligence updates using information from the previous 24 hours. These updates were intended to help the relevant teams begin the day with an understanding of the threats they could be facing. When something required more immediate attention and could not wait for the next daily update, we could issue an immediate briefing.
The intelligence could relate to issues such as demonstrations, possible bottlenecks, or developments that might affect particular parts of the security operation. The reports were shared with an agreed group of recipients and used as a reference point for security on the ground. The objective was always to connect external developments with the operational decisions being made at the event.
Why was it useful for an analyst to be physically present rather than working entirely from the UK?
Jess: Most of my work is based in Milton Keynes, and analysis can of course be conducted remotely. But being on site provides an additional level of context. You gain a more direct understanding of the environment, the operation and the practical realities behind the information you are analyzing.
At Oktoberfest, for example, being there helped me understand where different entrances were located and how those physical details related to the broader operation. It also enabled closer coordination between the customer and the intelligence function.
That connection matters. Intelligence should not exist separately from the people making and implementing security decisions. The closer the exchange, the easier it becomes to understand changing requirements and provide analysis that is genuinely relevant to the situation on the ground.
Can you give an example of how an event elsewhere can become relevant to a customer?
Jess: During the Oktoberfest assignment, we became aware of an incident in which activists had targeted similar temporary structures elsewhere. Simply forwarding that information would not have been enough.
The key questions were how the activists had acted, why they had selected that type of target and whether the incident indicated potential vulnerabilities in the Oktoberfest context. By sharing that assessment with the relevant stakeholders, the information became part of a broader situational picture.
That illustrates the difference between reporting and intelligence. Reporting tells the customer what happened. Intelligence assesses whether it could matter to the customer and enables the customer to consider proactive measures before a similar issue causes disruption.
Why is Risk Intelligence becoming so important now?
Jess: The importance of intelligence is not new, but awareness of its value is increasing. Organizations recognize that they do not want their security teams to encounter every developing situation without context.
They want relevant intelligence before the start of the day because it helps them establish an effective security posture, allocate resources appropriately and make informed decisions. That becomes particularly valuable when the risk environment becomes more dynamic and threats cannot be assessed through static procedures alone.
Risk Intelligence helps organizations maintain visibility into that changing environment, providing the context needed to make proactive security decisions rather than simply reacting to events as they occur.
What should a security leader ask to determine whether their organization needs Risk Intelligence?
Jess: A useful starting point is to ask whether the organization truly understands its current threat environment or whether it is primarily relying on measures introduced in response to previous incidents.
Decision-makers should consider whether they know which external developments could affect their sites, people, and operations, whether they can distinguish urgent signals from background noise, and whether emerging threats reach the right people early enough to influence a decision.
If those questions are difficult to answer, the organization may have strong physical security but still lack the situational awareness needed to use it as effectively as possible.
Risk Intelligence helps close that gap.
From protecting assets to informing decisions
A camera can show what is happening within its field of view. Access control can determine who is permitted to enter. A security officer can assess and respond to the situation on the ground.
But these measures do not, on their own, explain how the wider threat environment is changing, which developments are relevant or where the next pressure on an organization may emerge.
That is the role of Risk Intelligence. It connects information from the wider environment with the customer's individual context and existing security operation. The result is not simply another report. It is a stronger basis for deciding what to monitor, where to focus, and when to act.
How well does your organization understand the risks emerging around it today, and would you know if that changed tomorrow?
Securitas Risk Intelligence can help organizations assess their risk environment, strengthen situational awareness, and connect intelligence with operational security decisions.
Talk to Securitas about what an intelligence-led approach could add to your existing security setup.
