Cutting Through the Noise

In my time with the FBI, we didn't just view situational awareness as a skill—it was a mindset necessary to survive and keep you one step ahead of a threat. At its most basic level, it’s about keeping your head on a swivel, using all of your five senses to absorb everything around you in the environment in a 360 degree bubble. Do you see the stranger walking directly to you? Did you notice he is mumbling to himself, has clenched fists, and is staring intently at you? Do you hear a car driving up behind you? Do you smell smoke when walking through a neighborhood?

When I was on the SWAT team and we were walking up to a house to make an arrest, we always made sure to “check our six,” meaning the last guy in the line was responsible for looking behind us for threats. Everybody was on alert looking for indicators of danger or signs that something was wrong. Did a light suddenly come on in the house? Was there any sound indicating somebody was moving? Now this may be an extreme example but situational awareness has always been a key element for everyone to stay safe. 

On a personal level, this simply means being aware of your surroundings—who is around you? What are they doing? Do their actions present a threat? In the modern world, our situational awareness is degraded because of the many distractions in our lives. When you’re focused on your phone and wearing earbuds or headphones, you are not fully paying attention to your surroundings. 

For most of history, humans relied on their five senses to detect threats. They used their eyes and ears to look for enemies or signs of ambushes. Humans began to develop technology to enhance our senses. The invention of telescopes enabled a person to see threats at a longer distance. Security technology such as security camera systems have enabled security teams to monitor multiple areas from a single control station. The proliferation of camera systems enables a team to view and record events around the clock 24/7. 

The ability for advanced security systems to see and record multiple areas has also led to enormous amounts of information being collected. Sometimes this can lead to information overload. A human operator watching numerous camera feeds may be overwhelmed by the sheer volume of incoming information, which negatively impacts their ability to maintain situational awareness. Security operators need to have enough information to look for suspicious activity, but not have so much incoming information that it all becomes noise. Security is a high-stakes business and having operators who are highly trained in maintaining situational awareness can be the difference between a successful crime deterrent and a catastrophic failure. Situational awareness is more than keeping your eyes open because it also includes the ability to recognize signs, patterns, and anomalies which indicate possible danger. If your “spidey senses” are tingling, don’t dismiss them. Humans have developed strong situational awareness which helps to keep us alive. 

Situational awareness is the continuous process of perceiving threat indicators in the environment, recognizing their significance, and assessing the risk, which helps a person make informed decisions about possible courses of action. A person making an informed decision based on situational awareness may be able to prevent a bad outcome. That is the gold standard for a security team—to prevent an incident rather than just defend and respond. Whether protecting a high-profile person or asset or monitoring a crowded public space, security professionals must move beyond passive observation to active mental engagement. With correct training and application of technology, they can detect the pre-attack indicators before a threat fully materializes, saving time, money, and potentially even lives. 

Cutting Through the Noise

I deployed to Afghanistan with the FBI to collect information about threats to the U.S. It was my first time operating in a combat environment. Even driving between bases presented risks from ambushes or hidden improvised explosive devices (IEDs). We had to have enhanced situational awareness when driving on missions. We always drove in pairs, so the driver and passenger could watch both sides of the road, as well as in front and behind us. We looked for any indicators of an ambush—disturbed earth, unusual piles of trash, bystanders acting suspiciously, and also for anomalies like the absence of people in a normally crowded area. We wanted to detect any potential attack indicators so we could prevent the attack from happening. The military calls this “staying left of boom.” When you look at a timeline of an incident, it goes from left to right.The attack is the “boom” and is the midpoint in the timeline. To the left of the “boom” are actions to detect and prevent the “boom.” To the right of the “boom” are actions taken after an incident, like response and investigation. 

How do corporate security teams stay left of “boom?” Security team members can be distracted by their phones, music, or coworkers. People monitoring security systems can overlook legitimate threats because they are overwhelmed by too many false alarms or too much information. Because the vast number of alerts amount to nothing substantive, this can lead to a sense of complacency—nothing bad is ever going to happen. It’s like the boy who cried wolf. He called out so many false alerts then when he finally called out a real warning, it was ignored. Too much attention was expended on false positives and the opportunity to prevent an attack was missed. 

A guard needs to learn how to triage incoming information—what is important, what is irrelevant. They must be trained to recognize false alarms and which alerts require further investigation.

This is where technology like artificial intelligence can help sort through the large haystack of incoming information and help to highlight the potential needles that represent the threat. A human can then respond to potential threats that can’t be eliminated. For example, if a security camera system is AI enabled, it may be able to distinguish motion between a person and animal. A human responder can focus on responding to legitimate threats and minimize chasing false leads. Technology can also help with mundane tasks like recording vehicle license plates and scanning badges. This can enable the security staff to save their attention to observe and analyze activity which may actually indicate danger.

The downside of technology is people can become too dependent on their security systems and other tech. For example, technology can fail. How often are alarms and cameras tested to ensure they are online? Are there any gaps in camera coverage? Is there a contingency plan in place if the system malfunctions? Artificial intelligence will be a game changer, but only when it is applied correctly. AI can enhance situational awareness when it is trained to sift through vast numbers of alerts and then elevate the most important ones to the operator for additional scrutiny. The human still matters because they are the ones that need to respond to suspicious alerts. The human brain is still more capable of identifying threats and rapidly making decisions, but AI can help a person make more informed decisions. 

Spotting the Pre-Attack Indicators

Situational awareness is key to staying “left of the boom.” This requires security teams to operate with a prevention mindset—looking for potential indicators of danger and analyzing information for trends, anomalies, or clues that indicate something is not right. Preventing incidents requires an understanding of the tactics, techniques, and procedures (TTPs) used by your potential adversaries/threats. 

Every organization faces unique threats. For the retail sector your primary threat may be retail theft. Your adversaries—thieves—have their own TTPs. They may wear oversize clothing, carry backpacks, enter in groups, cause distractions, loiter, or visit on certain days or times. You should conduct a security assessment to identify and prioritize potential threats. After identifying potential threats, the security team can determine how their potential adversary operates—what are the TTPs? These provide clues for early warning of impending action.

Physical attacks or operations against your organization require planning so attackers need to conduct certain activities prior to executing their attack—“boom.” The offender may conduct surveillance on the target and take photos and videos to gather information about security measures such as guard patrols, locks, security cameras, and gates. The offender may test security measures by attempting to access the sensitive locations without a badge or seeing how long it takes for guards to respond to an alert. They may try to elicit information from personnel by asking seemingly innocuous questions about the facility. Your adversary is looking for a vulnerability—gaps in your security coverage or a way to overcome your security measures. During the October 2025 art heist at the Louvre Museum, the thieves exploited security vulnerabilities by entering through a second story window not covered by security cameras. They wore disguises and had the equipment and tools to break through the windows and smash display cases. They escaped with priceless French jewels. This was not a random incident, but the result of their careful planning. Identification of pre-incident indicators provides the best opportunity to stay left of “boom.” Team members need training to recognize these pre-boom behaviors early. 

In addition to spotting pre-incident indicators, a security team should document this suspicious activity in suspicious activity reports (SARs). Documenting and collecting SARs enables an experienced security professional to then analyze these incidents to see if they can connect the dots. Was there a plausible explanation for the incident or does the activity appear to be part of a plan to commit mayhem or mischief against your organization? This analysis is important to look for patterns of suspicious activity across time and locations. For example, is the same person trying to enter multiple locations? Has the same suspicious vehicle been observed at different times? Creating a strong corporate security culture also includes providing security awareness training to employees. This creates organizational situational awareness, because employees can be another set of eyes and ears. Employees should be encouraged to say something if they see something suspicious. They may see pre-incident indicators not observed by the security team. The security team can more effectively assess threats and connect the dots only when there is adequate information. The security team can then make informed decisions to increase their security posture, make reports to law enforcement, warn company leaders, and advise employees to be more vigilant. 

Clarity Under Extreme Stress

Although the goal of every security team is to prevent bad things from happening, the reality is that sometimes bad things will happen. There will be instances where an incident quickly unfolds, shifting the focus from prevention to immediate response. The security team is now operating “right of boom”—after the incident has occurred. Maintaining situational awareness during an incident is important because it can make the difference between a robust response that neutralizes a threat or a delayed and disorganized response that prolongs the incident, possibly causing more people to get hurt.

Maintaining situational awareness during an active incident is challenging because it is very hard to think clearly due to the stress response in the body. During this fight or flight response, our brain and body actually go into autopilot. A common response during a critical incident is for a person to have tunnel vision—seeing only the threat but not the surroundings. There may be auditory exclusion—not hearing something loud like gunfire. Our brains are trying to keep us alive by just focusing on the threat. 

Our reasoning is further compromised when we are given incomplete or conflicting information. These responses all degrade our situational awareness. During an incident like an active shooter, seconds matter. First responders need accurate information to immediately confront and neutralize the threat, but they are often given conflicting or incomplete information. Security teams can help cut through this “fog of war” by giving police accurate real time information about the assailant. This information can also be provided to employees evacuating the area. The assailant’s current location is key so police can immediately respond to that location and employees can avoid that area. Also important are the number of suspects and their physical descriptions, including gender, height, weight/build, clothing, and types of weapons. It is very common for false or conflicting information to be called in by panicked witnesses. These are extremely stressful and traumatic incidents so it’s helpful for security teams to develop checklists for critical information like descriptions. The security team may be able to watch live security video feeds to determine an assailant’s location or physical description so they can give accurate information to first responders.

Security teams can overcome this natural fight or flight response through training. Those that have trained for various scenarios, including through realistic training exercises, will be better prepared to respond and have the ability to maintain situational awareness in the midst of stress. Training for incidents is probably the most effective way to stay calm and remain situationally aware. This ability to weather the storm can minimize the damage caused during an incident. When we train for incidents, we gain experience, and develop confidence so we can handle the situation. When training identifies failures, we can fix these and be better prepared for future responses.

Creating a Unified Front

Building strong partnerships is a critical aspect to developing a security team’s effectiveness because no security team has all the resources necessary to respond to critical incidents and to get results like successful prosecutions. A security team may detain a person stealing merchandise, but local police need to make the actual arrest, conduct the investigation, collect evidence, and present the case to a prosecutor.

It’s extremely important to build relationships with police prior to any incident or “boom.” Meeting with law enforcement provides the opportunity to discuss what they need to facilitate their response to your company. How do they obtain security camera footage? Where can they interview witnesses? How do they subpoena records? Streamlining this investigative process removes friction and helps the police investigation to move more quickly. The security leader should determine all stakeholders—what agencies will respond to a 911 call? For organizations with multiple locations, this means building relationships with police in each locale since local law enforcement generally are the first responders. 

However, some crimes may violate federal laws, which would then involve federal agencies like the FBI. Don’t wait to meet until an incident has happened. Be proactive to meet police before the "booms" happen. Meeting regularly with police builds trust and encourages reciprocity. Ask law enforcement, how you can help them investigate crimes that may affect you. Offer them the opportunity to tour your facility. Ask them if there are any industry groups they recommend joining. Can they provide you with any crime trend data or anecdotes about criminal activity in your area? Establish the relationships early and meet regularly to share information. Also consider building partnerships with security teams from other organizations in your area. You may be facing common threats. For example, an organized retail theft crime organization may target you as well as other neighboring businesses. Sharing information about specific suspicious individuals or crime trends can help your own security team sharpen their situational awareness skills. Your team will have a better understanding of the current TTPs used by your adversaries, which contributes to their knowledge base of indicators to look for.

The threat landscape is constantly changing, so security teams must remain vigilant. Adversaries are constantly changing tactics, looking for weaknesses to exploit. They are also using technology to help them achieve their goals. They may use AI to assist in looking for your vulnerabilities. Successful TTPs used in other regions will likely be used against you. Technology can help you but may also be used against you. Adversaries may use AI to plan operations against you or use drones for surveillance.

The Bottom Line

At the end of the day, you don't rise to the occasion—you sink to the level of your training. Developing a mindset that prioritizes situational awareness based upon an understanding of your threats is crucial to prevent incidents from happening. True security is built in the muscle memory developed during realistic drills and the gut instinct sharpened by a culture of vigilance. You want to build those law enforcement bridges and sharpen your team's eyes long before the radio goes quiet and the adrenaline hits. By the time the “boom” happens, it's too late to start wondering if you’re ready. In this business, the ability to use situational awareness, trust your training, and act can make all the difference.