The Invisible Tax of Visible Wins

To all the security leaders out there—in the past month, how many times have you had to make a decision that:

• Would affect the safety of customers or employees?
• Had to be made with incomplete information?
• Had to be made under time pressure?

In all cases, I’d bet your answer is higher than that of your non-security peers.

Security leaders tend to be well-acquainted with the world of high-stakes decision-making under uncertainty and pressure. It’s just part of the job. As a result, they also tend to understand the value of a decision-making framework to make quality decisions quickly. 

In that spirit, I’d like to offer a framework for a decision that security leaders often face, but may not fully account for: deterrence vs. prosecution.

Defining Deterrence and Prosecution

Let’s start with some rough definitions:

• Deterrence capabilities refer to an organization’s ability to prevent would-be criminals from accomplishing a crime or to persuade them that it would be too difficult, too risky, or that the payoff would be too small to justify the effort.
• Prosecution capabilities refer to an organization’s ability to adequately identify a criminal, collect sufficient evidence to build a case, and provide that case to law enforcement in a way that they are able to prioritize and successfully apprehend and prosecute the criminal.

I’ll rely on the above definitions throughout the article knowing that, in practice, the lines between the two typically blur (many deterrence investments also support some aspects of the prosecution funnel, and many prosecution investments support deterrence). I separate them to provide a model that helps with strategy formulation and investment decisions.

Which is a Better Investment?

The TLDR (too long; didn’t read) is that there isn’t a universal right answer, but an optimal system likely has a mix of the two. Which investment will yield a better return depends largely on:

• Industry  In certain industries, prosecution efforts have add-on benefits beyond just taking one criminal out of circulation for a certain amount of time (e.g. when retailers document crimes, their data can often help build cases for other locations and even other retailers). In others, this effect is limited (e.g. a federal defense contractor may decide not to prosecute a vandal because of the attention it could draw and the consequences to their brand).
• Severity of incidents  Higher severity incidents lend themselves to prosecution better than lower severity incidents do. A low severity incident is unlikely to gain the necessary support from law enforcement to take action. On the flip side, deterrence capabilities can often deter high severity incidents just as well as low severity incidents.
• Current capabilities  Capabilities often face diminishing returns. For example, the first $1 you spend on a capability might yield a 20x return, but the $1 millionth might only yield a 1.1x return. Accounting for your organization’s current capabilities will help you evaluate the marginal return of each set.

But I won’t leave you hanging with an, “It depends on…” answer. Here are three insights that you might find useful:

1. Prosecution Is Loud, While Deterrence Is Quiet

Many security leaders skew their resources toward prosecution‑
related tactics. Why is this? We believe it comes down to human psychology.

When a criminal is arrested, you have tangible evidence of success. And the sheer volume of work required for this (reviewing footage, filling reports, coordinating with law enforcement) can reinforce the feeling of productivity. However, a successfully deterred crime is generally silent. It doesn’t give the satisfaction of a successful arrest or conviction. And because it is usually a result of upfront rather than ongoing work, it may give the illusion that nothing is happening, even when it is working exactly as designed.

This visibility bias often leads organizations to over-invest in tools to improve documentation, investigation, and prosecution. For decades this has been the traditional approach to physical security countermeasures. These tactics offer visible gratification, even in scenarios where deterrence would yield a higher marginal return on investment.

2. Prosecution is a Variable Cost, While Deterrence is Fixed

Prosecution requires manual work throughout the process (reviewing and organizing evidence, investigating suspects, and working with law enforcement) and tends to be a 1:1 or 1:few motion. This means the cost of prosecution tends to be variable—the more criminals you investigate and prioritize, the more it costs.

Deterrence on the other hand tends to require more up-front work (designing and implementing deterrents), but when done well, it is always working (1:many). This makes deterrence more of a fixed cost—regardless of how many criminals are deterred, the costs are stable.

3. Deterrence vs. Prosecution is an Optimization Problem

All things being equal, it’s better to deter the crime than to catch the criminal after the crime. However, it isn't about choosing one over the other.

Robust prosecution reinforces deterrence, and effective deterrence allows investigators and prosecutors to focus on high-priority cases. Conversely, with no prosecution, deterrence loses its effectiveness, and with no deterrence, there are too many incidents to effectively prosecute. Capital allocators need to find the right mix.

By estimating the incremental return of your next dollar spent, capital allocators can reduce the noise and bias influencing the tradeoffs and make higher quality decisions.

How Do I Measure Them?

This is where many teams get stuck, but a few simple, low-cost measures can yield a meaningful reduction in uncertainty. 

Measuring Prosecution

To measure prosecution, it can be helpful to think of a funnel:

• At the top of the funnel are all those who follow through with a crime
• The next tier down are those who are accurately identified by investigators
• The next tier down are those whose case is accepted by law enforcement
• The next tier down are those who are arrested by law enforcement 
• Then those who are convicted

If you want, you can round out the funnel with those who don’t return to crime.

Think of every step in that funnel as a conversion rate. The value of any improvement to one of those conversion rates can be estimated with simple math. Keyword: estimated. If you are seeking greater levels of precision, as with most things, it requires more than simple math. Fortunately, the simple math is often sufficient to make much more informed tradeoff decisions between investments. 

Measuring Deterrence

Because deterrence is less visible than prosecution, many organizations don’t measure it. But it can be measured—it just has to be measured differently. You often quantify deterrence by looking for changes in patterns over time and differences across comparable environments. For example:

• Before/after staff surveys about feeling of safety and crimes observed
• Before/after pictures of sites (if vandalism, property damage, or vagrancy are issues)
• Before/after customer surveys or interviews about feelings of safety
• Change in guard spend after making deterrence investment
• Capture success stories when available from those on site
• Changes in guard dispatches or manual interventions
• Trespass, vandalism, shrink, or after-hours activity trends
• Incident frequency/severity before and after deployment
• Number of activations, alerts, or escalations (depending on what is available from your deterrent system)

Lastly, for organizations with many sites, it is often possible to design the rollout of deterrent capabilities in a way that allows for some form of A/B testing, using similar sites as a control group for treated sites. 

Selling the Strategy to Leadership

While security leaders often have their own discretionary budget, which they can allocate as they see best, sometimes they don’t. And even if they do, it’s important they share and gain buy-in from their leaders and colleagues for their security strategy—the time usually comes, if it hasn’t yet, when they need support from others.

A great first step is to translate security outcomes into business language. Cash flow is often the universal shared outcome. Whenever possible, estimate the cash flow impact of various security outcomes. Precision may not be possible, but even wide estimate ranges can be helpful. 

Second, identify opportunities for your security investments to benefit your non-security colleagues. We have been surprised to find how often security teams are sitting on what other teams would consider a gold mine (e.g. data on customer traffic, visibility into remote locations, real-time footage of locations), and the other teams are completely unaware. This is a missed opportunity, which can often be quickly and easily resolved (e.g. by picking up the phone). 

Lastly, be strategic in how you pilot new capabilities. Involve non-security colleagues and leadership so they can personally experience the changes you are making in the business, and so they can identify opportunities where the investments will benefit them as well. Further, piloting new capabilities, especially if they generate video footage, can go viral within an organization—video clips are easily sharable storytelling tools. 

A New Standard for Physical Security

Ultimately, the goal of a world-class security strategy is to contribute to the success of the business. By identifying the optimal balance between investments in prosecution and deterrence, security teams can operate in a way that builds trust from the rest of the organization.