A commercial property owner spends hundreds of thousands of dollars improving security.
Access control is upgraded. Lighting is improved. Cameras are replaced or repositioned. Blind spots are eliminated. Remote monitoring is added. Perimeter gaps are closed. Policies and response procedures are rewritten.
The property is clearly better protected. Then the insurance renewal arrives. The premium increases.
If the security risk was reduced, why didn’t the insurance cost decrease? The answer says quite a bit about both the insurance and security industries.
I began my civilian career as an insurance underwriter specializing in aviation risks, including hard-to-insure operations, sites, and facilities. This experience gave me an excellent foundation in the economics of physical risk management.
Underwriting forces you to look beyond whether something is simply “safe” or “unsafe.”
An underwriter must ask different questions: What could happen? How likely is it? How severe could the loss be? What controls exist? How reliable are those controls? How much exposure can the insurer retain? And what price and terms make the risk acceptable?
Lower Insurance Premiums are Not a Reward for Security Spending
Insurers Price Loss, Not Security. Improved security may reduce the likelihood or consequences of an incident without producing a corresponding reduction in premium.
Consider a parking facility. An owner may improve lighting and sightlines, eliminate concealment areas, redesign camera coverage, strengthen access control, and add remotely monitored video analytics.
These measures can significantly reduce physical risk.
But underwriting systems may not have neat categories for “improved vertical illumination,” “reduced concealment opportunities,” “identification-level camera coverage,” or “verified remote response.”
Instead, insurers often recognize simpler variables: central-station alarm—yes or no; sprinkler system—yes or no; guard service—yes or no.
Traditional safeguards receive clearer recognition because insurers understand them, have years of loss data associated with them, and can define them contractually.
A carrier may even require certain protections as a condition of coverage without providing any noticeable premium reduction, even when the insured exceeds the minimum.
Then There Is Reinsurance
Another factor is largely invisible to most insureds. The insurance company whose name appears on the policy may not retain all the risk.
Primary insurers transfer portions of their exposure to reinsurers to protect capital, stabilize results, expand underwriting capacity, and reduce exposure to large losses.
There are two basic forms of reinsurance: treaty and facultative reinsurance.
Under treaty reinsurance, the reinsurer agrees to assume specified portions of a defined portfolio. Risks that fall within the treaty are generally ceded automatically.
Facultative reinsurance is different. Individual risks are submitted to reinsurers separately and evaluated one at a time.
This becomes especially important with large, unusual, or difficult risks—the same environment I encountered underwriting aviation exposures.
A primary carrier may like an account and recognize that its security program has improved. But if the risk exceeds the carrier’s retention, falls outside treaty terms, consumes too much capacity, or requires facultative support, the carrier may have less pricing flexibility than the insured realizes.
Facultative markets may demand additional premium. Treaty costs may increase. Capacity may shrink. Reinsurers may change limits, exclusions, attachment points, or underwriting requirements.
These pressures ultimately drive the cost of the primary policy.
So a facility CAN become safer while its premium still rises, because insurance pricing depends on far more than the condition of one property.
The Security Industry Has a Problem Too
The security industry does a remarkably poor job of communicating risk reduction.
A consultant conducts an assessment and recommends: “Install additional cameras in the parking area.”
The client installs them.
At renewal, someone tells the broker: “We upgraded our CCTV system.”
That tells an underwriter almost nothing.
Compare that with this:
Existing condition: Significant nighttime surveillance gaps existed; pedestrian approaches were poorly illuminated; concealment areas were present; and no active monitoring capability existed.
Risk mitigation: Cameras were repositioned to meet defined performance criteria, lighting deficiencies were corrected, concealment opportunities were reduced, controlled access was expanded, and remote video verification was implemented.
Residual exposure: Unauthorized access remains possible, but detection, verification, response, and post-incident documentation have improved significantly.
That is language an underwriter can use.
Documentation Has to Go Far Beyond the Assessment Report
An assessment report is a snapshot; post orders are operational instructions. Neither alone proves risk was reduced or improvements remain effective.
A mature security program documents what was identified, approved, and implemented; testing and maintenance; ownership; and ongoing effectiveness. Records may include maintenance logs, photos, acceptance tests, commissioning results, lighting measurements, camera criteria, alarm data, training, exception and corrective-action logs, reassessments, and management reviews of residual risk.
Underwriters, risk engineers, attorneys, or juries shouldn’t have to reconstruct the story from an old PDF and guard post orders. They should see a clear chain:
Risk identified → mitigation approved → mitigation implemented → effectiveness verified → performance monitored → deficiencies corrected.
The Future
So when will better physical security produce more meaningful insurance benefits? Probably when the security industry becomes significantly more sophisticated. By a lot.
Security still too often revolves around guards, cameras, access control, products, generic assessment reports, and of course guns, rather than measurable risk reduction.
The industry needs to move toward defined performance standards, documented testing, continuous validation, meaningful metrics, residual-risk analysis, and evidence that controls work.
It also needs to communicate better with people outside the security department.
That means speaking the language of underwriting, finance, legal, operations, real estate, engineering, and executive management.
The goal should not be to tell an insurer: “We spent $300,000 on security.”
Rather, the goal should be to demonstrate:
Here was the exposure. Here is what we changed. Here is how we verified it. Here is the evidence that the control works. Here is the remaining risk.
That is a much more compelling underwriting story.
Security improvements can’t control reinsurance markets, catastrophe losses, or shrinking capacity. But they can shape how insurers assess an organization’s risks, capacity, and terms. Organizations that demonstrate reduced risk—not just security spending—are best positioned in underwriting decisions.
Physical security needs to evolve from an equipment-centered industry into a mature risk-management discipline.
That is exactly the direction we are taking at S6RG.
Our work goes beyond assessments and equipment recommendations. We help clients identify exposure, set priorities, document implementation, verify performance, measure residual risk, and create a defensible record demonstrating how security investments mitigated risk.
When it comes to insurance, the future of physical security is not about buying more security. It is about proving that the organization is a safer risk.