Threat Intelligence(Proactive Response)

Client Environment

The site was a high-rise mixed-use building located in an urban commercial area, with controlled access points and multiple security zones, including areas open to the public. The risk, or the possibility of loss from an aerial threat, was measured against several factors, including the target’s value to an enemy. As high-rise buildings host a large amount of occupied floor area, the risk and potential losses are generally higher.

The facility required a critical coordination between building management, security, facilities, emergency response teams, tenants, retailers, and service providers.

Because the facility was a mixed-use building with tenants that had an international presence, and different occupant groups using the building at the same time, any shelter-in-place response had to account for internal movement, communication, crowd control, occupant welfare, business continuity, reputational exposure, and a controlled return to normal operations with risk reduced to a level as low as reasonably practicable.

Security Challenge

The main security challenge was the lack of a defined internal response to an elevated aerial threat.

The facility did have emergency response and crisis management arrangements; however, they did not clearly address how the facility should assess an aerial threat alert, activate protective measures, communicate instructions to occupants, coordinate response teams, or stand down safely after the threat is over. This created a response readiness gap and required a site-specific guideline to support decision-making, occupant protection, and coordinated action during an aerial threat event.

Carverisk Approach

The security assessment approach included a clear understanding of the regional conflict, benchmarking against surrounding facilities that had faced similar threats; analysis of the reported incidents, such as dates, times, locations, type, nature, impact scale, tenants’ communication over official news, then linking these to the facility’s increased threat exposure, and how it might affect the facility. The assessment also included reviewing the facility’s operating environment, monitoring occupant movement and footfall patterns, and assessing the tenant profile and international exposure within the building.

The overall threat level was monitored through official news sources, open source intelligence (OSINT), and relevant social media to assess the asset’s exposure to an elevated aerial threat.

Security intelligence updates were provided to the Crisis Management Team ahead of the threat to support any prior arrangements required, situational awareness, and help the crisis team understand the current threat environment, potential escalation indicators, and possible impact on the facility.

A staged shelter-in-place framework was developed to support early protective action before the asset was directly affected, based on official early warning alerts, threat proximity, threat severity, and escalation thresholds within the surrounding area.

The assessment reviewed occupants’ footfall, staircase capacity, potential shelter-in-place areas, and contingency evacuation routes if conditions inside the facility became unsafe and an evacuation was required.

Key stakeholders from the crisis management, business continuity, emergency response, security, facilities, and operational teams were consulted to ensure that our proposed guidelines do not conflict with their operations and apply to the facility, not just as generic input.

The outcome of the approach was a site specific shelter-in-place guideline supported by three activation stages based on threat level and proximity to the facility, temporary reduced occupancy, controlled communication protocols, response team responsibilities, occupant movement considerations, and proper re-entry arrangements.

Key Findings

The security assessment identified that the facility did not have a documented shelter-in-place procedure or guideline for an elevated aerial threat scenario. The emergency response team, including the security service providers, had also not been trained for such scenarios.

Our key findings included the following:

• No defined shelter-in-place process in the emergency response plan
• No activation triggers to determine when occupants should remain in place or move to a safer internal area (staged response)
• The need for proper coordination between the operational, tactical, and strategic teams
• Missing a mass notification system and internal announcement to notify occupants of any threat from a readiness perspective, or when to stand down
• A requirement for communication protocol requirements for tenants, retailers, service providers, and visitors, and a unified message for the workforce in case of a direct impact
• Occupants didn’t have any guidance related to actions that need to be taken from their end during an aerial threat
• Need to assess occupant footfall, welfare arrangements during prolonged shelter-in-place activation, capacity, and suitability of those internal shelter areas
• A crowd control management plan during and after any activation of a shelter-in-place
• Need for an evacuation plan that includes crowd control management, special arrangements for people of determination, and occupants with medical needs during and after shelter-in-place activation
• Existing security workforce levels were not sufficient to cover all required evacuation routes and staircases during a shelter-in-place activation
• External staircase identification was not clearly visible, which could delay guidance to Civil Defence or emergency responders in locating the correct staircase during an emergency
• Certain external operational areas were exposed to potential exposure of falling debris, glass fragmentation, or secondary impact effects during an aerial threat event
• No formal unified command, control, and coordination structure was in place to support liaison with external stakeholders and local authorities during such an elevated threat scenario

Recommendations

• Identify primary and secondary shelter-in-place areas within the facility to be used by occupants, depending on the threat level
• Implement activation triggers supported by different notifications to notify occupants which stage is currently activated
• Issue infographic awareness posters to explain what actions are required in each stage and where occupants should go
• Issue an internal guideline for Unidentified Aerial Vehicle Alert to be followed by the facility workforce
• Provide training and internal drills on team deployment during shelter-in-place activation
• Utilize the existing workforce from other departments to assist in the deployment and activation of the shelter-in-place process
• Introduce a crowd management plan to avoid any secondary risks during the shelter-in-place process
• Define clear routes to be used without exposing occupants to external aerial threats when moving to dedicated shelter-in-place zones
• Mark external staircases discreetly to guide Civil Defence during an emergency
• Psychological preparedness of the operational, tactical, and strategic teams through threat briefings, scenario awareness, and role-specific guidance on the potential impact and required actions during shelter-in-place activation
• Relocate critical operations exposed to external areas to safer internal zones within the facility during elevated threat conditions
• Establish a unified incident command and coordination structure to handle any escalation in case the threat materialized, and a liaison with external stakeholders and local authorities was required

Outcome

The accurate security risk assessment provided to the client, along with the security intelligence updates, proper planning, proactive security measures, and readiness established across all three levels (Operational, tactical, and strategic) within the client’s workforce, allowed the client to be prepared ahead of the threat and establish a unified command with all relevant stakeholders, including the local authorities. When the threat materialized, the client was ready for it and recovered within 3 hours, with no injuries or fatalities.

Lessons Learned

Always understand your operating environment and the types of threats that might affect your organization. Security risk assessment and threat intelligence are important for identifying potential exposure and assessing potential impact. Have your emergency response plans and communication protocols always ready, train to the plan, and execute as per plan, with some allowance for minor flexibility to adapt if the threat changes or the situation develops differently than expected.

Confidentiality Note

For public release, we did not disclose the actual name of the facility or any sensitive security operational details that took place behind the scenes.