Having Security Measures in Place Is Not the Same as Knowing They Work.

Many organizations invest in security systems, policies, and procedures. But an important question for leadership is whether those measures are adequately addressing the risks facing their organization.

When was the last time those measures were independently assessed? Have response procedures been tested? Do decision-makers understand where vulnerabilities remain?

These are questions that deserve attention before an incident occurs.

At Aspis Solutions Group, we work with organizations to evaluate existing security measures, identify potential gaps, and develop practical strategies that strengthen preparedness and operational resilience.

Effective security requires more than policies and technology. It requires informed leadership, accountability, and a commitment to continuous improvement.

Security does not begin at the perimeter.

UK counterterrorism authorities continue to investigate suspicious activity near RAF Fairford, a strategically important military installation used by U.S. forces. While the investigation remains ongoing, the incident highlights a broader security principle—the first indication of a developing threat may come from outside the facility being targeted.

Employees arriving for work. Utility crews operating in the community. Nearby businesses and residents. Cameras overlooking surrounding roads. Each can become an important part of early detection.

For critical infrastructure operators, resilience requires more than gates, cameras and cybersecurity. It requires:

• Employees who recognize unusual activity
• Clear and practiced reporting procedures
• Visibility beyond the immediate facility perimeter
• Strong relationships with law enforcement and public-safety partners
• Leadership that routinely incorporates current threat intelligence into preparedness planning

At ASPIS Solutions Group, we continually evaluate incidents like RAF Fairford not to create alarm, but to identify practical lessons that can strengthen the organizations and communities we serve.

Awareness creates time. Time creates options. And options improve resilience.

Security threats do not always come from outside an organization.

Insider risk can involve malicious intent, but it can also result from compromised credentials, poor access controls, policy violations, complacency, or an employee simply making a mistake. For critical infrastructure and other essential organizations, those vulnerabilities can have significant operational consequences.

An effective security program should account for both external threats and vulnerabilities created through trusted access. That means looking beyond gates, cameras, cybersecurity systems, and other protective measures to the people and processes that interact with them every day.

Addressing insider risk is not about creating suspicion in the workplace. It is about building a culture where employees understand their role in protecting the organization, recognize concerning activity, and know how and where to report it.

Awareness is one of the most effective layers of security an organization can build.

More information does not necessarily create better situational awareness.

Organizations today have access to an enormous amount of information about emerging threats, security incidents, cyber activity, infrastructure disruptions, and other potential risks.

The challenge is determining what actually matters.

Effective situational awareness means taking available information and putting it into context:

• Is it relevant to our organization or sector?
• Could it affect our people, facilities, or operations?
• Does it change our current risk picture?
• Is there an action we should consider taking?

Not every development requires action. But the right information, delivered with the right context, can help leaders make better-informed decisions before an issue becomes a crisis.

Good intelligence should create clarity—not noise.

Preparedness is not a one-time training event.

It is a continuing process.

Effective organizational resilience requires more than developing a plan or conducting an annual presentation. It requires a deliberate cycle of:

• Identifying vulnerabilities
• Developing practical, site-specific response plans
• Training personnel to recognize threats and take appropriate action
• Exercising those plans under realistic conditions
• Applying lessons learned to strengthen future performance

At ASPIS Solutions Group, we are currently collaborating with organizations across different sectors to advance this process—from enterprise security and vulnerability assessments and active-threat preparedness training to crisis management planning and functional exercises. The goal is not to create plans that sit on a shelf. It is to help leaders and their teams build the awareness, confidence, and organizational readiness needed to respond effectively when circumstances are uncertain and decisions matter most.
Preparedness is built over time—and strengthened through collaboration, practice, and continuous improvement.

Building Resilience Through Preparedness, Training, and Exercise

ASPIS Solutions Group is pleased to be moving into Phase III of an ongoing engagement with a faith-based community organization focused on strengthening preparedness, awareness, and organizational resilience. As part of this next phase, our team will conduct three Active Threat Preparedness & Awareness training sessions for members of the community, including a Spanish-language session to help ensure this important information reaches a broader audience.

In October, we will also facilitate a functional exercise designed to test and validate the organization’s Crisis Management & Incident Response Plan. The exercise will provide leadership and staff an opportunity to work through three realistic scenarios, evaluate decision-making and communications, and identify opportunities to further strengthen their response capabilities.

We appreciate the continued confidence placed in our team and value the opportunity to build upon the work completed during the earlier phases of this engagement.
Preparedness is not a one-time event. It is an ongoing process of planning, training, exercising, and improving.

Strengthening Security and Resilience Across Critical Infrastructure

I am pleased to share that ASPIS Solutions Group has begun working with a new critical infrastructure client as part of an ongoing effort to strengthen organizational security, preparedness, and resilience.

Gavin Gumbinner and I recently completed our initial stakeholder meetings and site visits across the organization’s main campus and satellite locations. Our initial scope of work includes conducting an Enterprise Security & Vulnerability Assessment, delivering Active Threat Awareness & Preparedness training, and helping the organization strengthen its Crisis Management & Incident Response Plans.

What we value most about this engagement is the collaborative approach. We are working alongside organizational leadership and key stakeholders to understand what matters most, identify vulnerabilities and areas for improvement, and develop practical solutions that support both day-to-day operations and effective decision-making during a crisis.

This is not intended to be a one-time assessment, but the beginning of an ongoing relationship focused on helping the organization anticipate risk, strengthen resilience, and remain prepared for an evolving threat environment.