Peter Evans, CEO of Xtract One Technologies explores why security failures rarely stem from technology itself but from planning gaps, outdated threat models and missed opportunities in this SJA exclusive.
Security failures rarely happen because technology stops working.
They often happen because organizations have not fully thought through all necessary questions during the planning phases or installed systems optimized for yesterday’s threats and structured their approach around procurement cycles rather than operational reality.
This planning problem persists across industries but it’s becoming more visible as workplace violence concerns spread beyond their traditional domains.
Healthcare facilities and schools have grappled with security challenges for years, developing protocols and investing in protective measures.
Now, corporate workplaces are discovering they face similar threats without the benefit of years spent refining approaches.
Healthcare has dealt with workplace violence for decades and schools have implemented security measures following high-profile tragedies.
Both sectors developed institutional knowledge about balancing protection with their core missions.
Corporate workplaces operated under different assumptions. Office buildings have traditionally focused on access control for intellectual property protection and basic premises security.
Recent incidents targeting high-profile companies changed that calculation rapidly. Corporate security teams now field questions from executives, employees and insurers about workplace violence preparedness.
The challenge is that corporate environments lack the experience base healthcare and education developed over the years, creating a knowledge gap with expensive consequences.
The risk is that corporate facilities will repeat mistakes healthcare and education have already made: treating incidents reactively rather than building predictive capabilities and implementing technology without considering long-term operational integration.
Security incidents generate two distinct cost categories: immediate response expenses and long-term downstream consequences. Organizations budget for the first and consistently underestimate the second.
A workplace violence incident triggers immediate costs: medical treatment, facility damage, incident investigation and temporary staffing adjustments.
These expenses are visible, quantifiable and expected.
The downstream costs often exceed immediate expenses by substantial margins: litigation that drags on for years, staff turnover as employees seek safer environments, productivity losses as remaining staff process trauma, regulatory compliance requirements, insurance premium increases and reputation damage affecting recruitment.
Digital documentation infrastructure dramatically reduces these downstream costs by eliminating disputes about what occurred.
Objective records from video surveillance, access logs and screening systems establish facts that subjective incident reports can’t provide. Litigation that might consume years gets resolved in months when digital evidence removes the ambiguity.
A hospital administrator recently identified body cameras as their highest security priority, not because cameras prevent initial incidents, but because they eliminate the “he said, she said” disputes that generate enormous legal expenses.
The return on investment comes from costs avoided rather than incidents prevented.
Yet documentation infrastructure consistently receives lower priority than prevention technology during budget allocation. Prevention systems generate attention and approval.
Documentation systems that reduce litigation costs operate invisibly until someone calculates what the facility spent resolving incidents over the past five years.
Modern security systems generate extraordinary data volumes: thousands of daily transactions, continuous video streams, access events, screening results and environmental sensor readings.
This data could transform security from reactive response to predictive intervention but almost none of it gets analyzed meaningfully.
Facilities collect data because systems generate it automatically, not because anyone has clear plans for analysis. Storage accumulates, pattern recognition doesn’t happen and predictive capabilities remain theoretical while security operations continue relying on reactive response to incidents rather than proactive identification of emerging risks.
The barrier isn’t technical because analytical tools exist. It’s organizational. Security departments lack the analytical expertise, the cross-functional authority to access data from multiple systems and the budget allocation for sustained analysis programs.
A facility might operate sophisticated video surveillance for years without ever analyzing footage to identify temporal patterns in suspicious behavior, correlating camera activity with access events to understand normal versus anomalous patterns, or using historical data to optimize guard deployment schedules.
Corporate workplaces have an advantage here if they recognize it. Most already employ data analytics teams for business intelligence purposes. Applying that analytical capability to security data requires organizational willpower more than technical expertise.
Healthcare facilities and schools developed hard-won expertise about security implementation through years of trial, error and refinement. Corporate workplaces can compress that learning curve if they study what worked and what failed in these sectors.
Healthcare learned that security measures creating barriers to emergency care access undermine the facility’s core mission.
The lesson applies to corporate environments: security that significantly disrupts business operations won’t survive long-term regardless of theoretical effectiveness.
Schools discovered that visible security measures providing emotional reassurance don’t necessarily address actual vulnerabilities.
Corporate facilities should note this before installing security technology, primarily to demonstrate action to concerned employees or executives.
Both sectors found that staff buy-in determines whether security programs succeed or get subverted through workarounds.
Corporate workplaces implementing new security measures need employee cooperation, which requires systems that make sense operationally rather than just technically.
The most valuable lesson: security planning must address operational reality, not just threat assessment. Technology that works perfectly in demonstrations but creates unacceptable disruption in daily operations will fail regardless of its technical capabilities.
Security planning needs to start with questions most organizations never ask:
Corporate workplaces entering security technology markets now should add another question: What did healthcare and education learn that we can apply to our environment?
These questions don’t have easy answers. They require acknowledging uncertainty, planning for adaptability and investing in infrastructure that won’t generate immediate visible results.
They demand that security professionals articulate value propositions based on costs avoided rather than threats dramatically stopped.
Security effectiveness depends less on which technology gets selected and more on whether the right questions get asked before any technology gets installed.
As workplace violence concerns spread from healthcare and schools into corporate environments, organizations that learn from existing experience will make better decisions than those starting from scratch.