Quick answer: Security is not safety, it demands its own theory, not borrowed safety statistics or a shopping list of hardware. The Asset-Protector-Threat model and a four-stage method for rigorous enterprise security analysis.
Originally published on LinkedIn: 15 March 2026.
Security and safety are not the same discipline, and treating them as interchangeable is expensive. Safety deals with hazards and risks born of accident and chance, and can be managed with the physical sciences and predictable statistical models. Security deals with intentional events driven by an antagonist with a rationale, a living, adaptive risk that learns from your conduct and adjusts to your defences. Analysis built on probability rather than intelligence and strategy is preparing for a hazard, not a threat.
The grey area of indeterminacy
Perfect security, total freedom from danger, does not exist in nature. Neither does perfect non-security. Real organisations operate permanently in a grey area where security and non-security coexist. The operational goal is not to eliminate this zone but to convert as much of it as possible into a state of practical security, and to maintain that state under continuous pressure.
A formal model: Asset, Protector, Threat, Situation
Operational security can be expressed as a function of the interaction between an Asset, a Protector and a Threat, within a given Situation. Remove any one of the three components and the security context itself disappears. These roles are functional, not fixed. A single entity can occupy more than one role depending on who is observing and at what level. A brilliant military commander is a vital asset to their own army and a protector of the state's interests, yet from the state's perspective that same commander becomes a threat the moment their capability outgrows political control. Identifying who is playing which role, and when, is essential to reading a security context correctly.
Why more security can produce less security
Bolting on technology and procedure does not automatically raise the state of security, and often generates the opposite effect. Poorly justified measures can attract unwanted attention, infringe on civil rights, or signal that something inside the organisation is being concealed. Without a clear functional purpose, these measures become a "rich pageantry of life": visible, expensive, and operationally inert. Millions get spent on deterrents whose actual contribution to the desired outcome is never tested. The reasoning behind an action determines its security value, not the volume of equipment installed.
Security as an infinite game
Security is a forced, costly response to someone else's initiative, which makes it an infinite game: every closed gap invites a reactive antagonist to search for the next one. Unusually for a field this adversarial, security practitioners are fundamentally risk-averse. Unlike finance or the military, where calculated risk-taking is rewarded, security exists to preserve an existing state. Displacing an antagonist toward a softer target is often the most realistic measure of success.
No assessment is fully objective
Every analyst brings a heritage of training, unconscious belief and self-interest into their assessment. Because security data is dynamic and partially unknowable, rigid physical-science certainty is not available. The realistic goal is a "justified true belief": a conclusion robust enough to survive scrutiny from a funding board or a court, while remaining flexible enough to adapt as antagonists learn in turn.
A four-stage analytical method
Effective security work replaces checklist prescriptions with a structured cycle. Context Analysis establishes the Asset, Protector, Threat and Situation. System Analysis interrelates these findings to identify vulnerability, opportunity, capability and intention. Future Analysis builds scenarios and evolutionary dynamics to surface emerging risks. Mitigation Strategy Definition then sets operational requirements across people, intelligence, structures, systems, procedures and controls. Final decisions on what standard of performance is "enough" are usually political, settled through negotiation between stakeholders.
The point of the exercise
Security is a daily, rational response to the human instinct for survival and stability, not a fixed destination reached by accumulating barriers. The question worth asking of any programme is whether resources are aimed at the actual antagonists in play, or whether the organisation is participating in an expensive pageantry of protection while real vulnerabilities evolve unaddressed.
If your organisation is still buying cameras and guards before it has answered what kind of problem it is actually in, that is a theoretical gap, not a budget one. Tony Ridley works with boards and executive teams to build the context, system and future analysis that should sit underneath any security investment, so spend is directed at genuine antagonists rather than visible reassurance. Contact us to discuss your requirements.