Let’s address what the security industry would rather ignore.
An extraordinary amount of bullsh*t is sold in the name of safety and security.
Some of it comes wrapped in expensive technology. Some comes with impressive credentials, military titles, badges of all kinds, or decades of supposedly relevant experience. Some arrives in a beautifully formatted assessment filled with colorful matrices and recommendations that conveniently match the consultant’s products.
Much goes unchallenged today.
This is concerning because these decisions impact whether individuals are injured, killed, or exposed to significant preventable harm.
Safety and security are too important to leave to unqualified people.
The Expert Problem
Let’s start with the endless supply of experts.
Retired police officers. Former military personnel. Ex-federal agents. Corporate security veterans. People with impressive titles, extensive biographies, and enough acronyms after their names to fill a business card.
Some are exceptionally qualified. Others don’t meet this standard and lack the required expertise and experience.
Carrying a gun, wearing a uniform, commanding troops, or investigating crimes does not automatically qualify someone to evaluate physical risk in hospitals, facilities, schools, or commercial property.
Those experiences may provide an excellent foundation, but they don’t replace an understanding of risk analysis, protective design, engineering, organizational governance, operational durability, human behavior, or the legal responsibilities of property owners, operators, and employers.
Yet the industry often presents occupational history as professional expertise, implying that experience alone is sufficient.
A résumé tells you where someone has been, not what they know.
Snake Oil Goes High-Tech
The old-fashioned salesman sold locks, alarms, cameras, guards.
Today’s version sells artificial intelligence, predictive analytics, facial recognition, and autonomous surveillance technology, generating excitement.
Sales approaches have become more sophisticated, but the underlying examination has not.
After a frightening incident, someone inevitably shows up with a solution.
You need more cameras, AI systems, guards, facial recognition, license plate readers, monitoring subscriptions.
Maybe not.
Where’s the assessment? What threats are we addressing? What vulnerabilities exist? What consequences are we preventing? How will the proposed solution actually perform? How will anyone know whether it works?
Too often, people don’t answer those questions seriously or thoroughly. Clients often receive sales proposals presented as professional advice. This is product distribution, not risk management.
Security Theater Is Profitable
In my previous article, Security Theater, I discussed the industry’s tendency to substitute visible security measures for demonstrable risk reduction.
This practice continues because security theater is profitable.
Security theater sells.
A new camera system is visible. Additional guards are visible. A sophisticated command center looks impressive during tours.
A well-developed risk management framework? Less exciting. And documented procedures are not glamorous.
Carefully engineered lighting improvements, revised access-control policies, or enhanced emergency response guidelines rarely appear in promotional materials.
However, these less visible measures may reduce risk more effectively.
The problem isn’t technology. I support advanced security technologies when they’re methodically selected, engineered, implemented, and managed.
The issue arises when organizations equate purchasing technology with effective risk management. It isn’t.
When Nobody Knows What Good Looks Like
Another challenging reality exists.
Many organizations buying security services lack internal expertise to evaluate what they’re buying. That’s why they hire consultants.
Unfortunately, it also makes them vulnerable to consultants who sound credible yet lack the technical knowledge, analytical discipline, or independence necessary to provide competent advice.
An executive may reasonably assume a security professional understands the difference between vulnerability and risk.
Or that someone recommending a surveillance system understands how well it detects, observes, recognizes, and identifies.
Or that a consultant understands crash-testing standards, vehicle dynamics, installation requirements, and tested performance versus marketing claims.
These assumptions are not always justified.
When organizations cannot distinguish genuine expertise from polished salesmanship, compelling presentations may win.
The consequences of these decisions may remain unnoticed for years, until something happens and at that point, the questions become significantly more serious.
Who conducted the assessment? What methodology was used? Were the recommendations reasonable? Were recognized standards considered? Were limitations documented? Did the organization understand and accept the residual risk?
The report now warrants closer scrutiny.
The Industry Needs to Grow Up
Physical security has become increasingly complex.
Modern organizations face interconnected risks involving people, facilities, technology, infrastructure, operations, and legal obligations.
Addressing these risks requires disciplined analysis and technical expertise beyond just purchasing products.
It requires disciplined analysis, technical competence, sound engineering, and defensible decision-making.
Professional humility is essential.
A competent advisor should know when an issue demands specialized expertise. Nobody is an expert in everything, regardless of what their LinkedIn profile suggests.
However, the security industry tolerates exaggerated credentials, unsupported claims, recycled assessments, and solutions offered without understanding.
Professional certifications can be valuable, but they don’t automatically prove competence. Neither are military rank, law enforcement experience, corporate titles, or years in the business.
The real test is whether someone can show how they reached conclusions and explain recommendations.
If they cannot, there is little reason to trust their recommendations.
Stop Rewarding Misinformation
Property owners, corporate executives, school administrators, and other decision-makers have an important role in fixing.
Do not hire security consultants for impressive credentials. Do not accept recommendations without understanding the analysis. Do not confuse expensive technology with effective protection. Do not treat a vendor’s sales proposal as independent risk assessment.
Ask more rigorous questions, demand evidence, expect clear reasoning, and insist on measurable objectives.
The best security investment may be a technology upgrade. It may also be improved lighting, better procedures, a redesigned entrance, stronger management accountability, or simply correcting something that should have been addressed years ago.
Credibility Must Be Earned
At S6RG, we believe physical risk management deserves the same methodical rigor, professional independence, and accountability expected of consequential business disciplines.
Our work begins with understanding the organization, its environment, exposures, and consequences of failure—not product catalogs.
We don’t believe expensive technology solves every risk, more guards fix every problem, or impressive credentials exempt anyone from demonstrating genuine competence and expertise.
The objective is to help organizations make informed, proportionate, defensible decisions protecting people and operations.
Security is not about creating the appearance of safety. It is about understanding risk and taking meaningful action.
Understanding risk requires meaningful action always.
You can’t build that on bullshit.
S6RG is an independent security and risk advisory firm providing strategic physical risk and resilience solutions for organizations, institutions, property owners, and private clients.