Expert Comment · London · 15 December 2026
Most security incidents reviewed after the event were foreseeable, and a substantial proportion were preventable through measures that cost little, VIP Protection Services has said.
“Post-incident reviews almost never find an unforeseeable event. They find an unassessed one.” — spokesperson, VIP Protection Services
What assessment actually does
A structured assessment identifies threats, tests vulnerabilities against them, rates likelihood and impact, and ranks mitigation by risk reduction per pound. It converts anxiety into a prioritised plan.
Critically, it also identifies what not to spend money on — an output clients rarely get from providers who sell only staffing.
- • Threat identification from history and open sources
- • Physical and procedural vulnerability survey
- • Pattern-of-life and routine analysis
- • Digital exposure review
- • Prioritised, costed recommendations
- • Review date and reassessment trigger
Why procedure beats hardware
In residential and corporate assessments alike, the highest-scoring recommendations are usually procedural: how deliveries are handled, how contractors are verified, how absence is managed, how access credentials are revoked.
These cost little, take effect immediately and address the routes actually used in real incidents.
The governance value
For organisations, a written assessment evidences that risk was identified and proportionate action taken — the record that insurers, auditors and, in the worst case, investigators will ask for.
For private clients, it provides a rational basis for decisions that would otherwise be driven by fear or sales pressure.
When to reassess
Annually as a baseline, and immediately following an incident or near miss, a move, a material change in public profile, a contentious corporate event, or a new pattern of unwanted contact.
An assessment with no review date is a document, not a control.
Related services
Frequently asked questions
Can risk assessments actually prevent incidents?
Yes. Most reviewed incidents were foreseeable, and the routes used were typically procedural gaps that a structured assessment identifies and closes.
What does a security risk assessment include?
Threat identification, vulnerability survey, routine analysis, digital exposure review and prioritised, costed mitigation with a defined review date.
How often should risk assessments be repeated?
Annually as a baseline, and immediately after any incident, relocation, profile change or new pattern of unwanted contact.
Do assessments always recommend more security staff?
No. A large proportion recommend procedural change and fewer, better-deployed people.
Who should carry out a security risk assessment?
An experienced protective security practitioner working to a documented methodology, ideally without an obligation to buy staffing from the same provider.
Notes to editors
VIP Protection Services is an SIA-licensed close protection and private security company headquartered in London and operating nationwide. All operational officers hold valid Security Industry Authority licences and are screened to BS 7858.
020 3488 5714
enquiries.vip.protection.service@mail.com
This release may be reproduced with attribution to VIP Protection Services and a link to the original release.