How vulnerable is your company to criminal intent?

February 2013 Security Services & Risk Management

Just when you thought it was safe to open the curtains, someone whispers: “Have you done your vulnerability assessment?”

It is an unnerving moment, like being told there is an awful epidemic going around striking fear at the very mention of its unintelligible name.

Your first thoughts are: am I vulnerable and do I need assessing? And if I do, what is the next step?

The first step is to understand what it is and why it is there.

A vulnerability assessment is an analysis of your company’s security weaknesses and the opportunities they offer your competition or the criminal element targeting your assets. Such vulnerabilities can be assessed by a security survey, that systematically takes the operation apart and finds the leaks and other structural weaknesses or signs of hostile intent, such as attempts to intrude actually or virtually to collect information about your organisation or to steal from it. Once you have identified the problem, you have a better chance of dealing with it. Is it that easy?

Sometimes, but not often and you will solve it most frequently in a painstaking and time consuming way. The goal of a vulnerability assessment is to identify and block opportunities for attacks against assets, thwart malicious intent, reduce risk and breathe easier.

But snags abound and in critical and substantive vulnerability assessments, one size never fits all because no two companies are ever exactly the same. So security surveys must be developed that take in to account each firm’s unique operating and security features.

A master plan

A periodic vulnerability assessment should be a primary element in your security master plan, which should itself include a combination of policy and procedure, personnel and physical security. A master plan keylines the security requirements, how they relate to each other, and how they are implemented to achieve the desired security effect. The master plan also defines the intended results and identifies the ultimate goal the security programme sets out to achieve. Security master plans will reflect the organisation’s environment and give substance to its short and long term strategies.

Scroll down the relevant sections of the Internet and you will find dozens of tool kits that “let you do your own vulnerability assessment or security survey”. As tools go, most are competent and offer value for the money you will spend. But for such intricate operations, the tools are only as good as the hands that use them are experienced.

Your company is unique, for a number of reasons: because of what it does, the way it does it, the people who were there, the sector or sub-sectors it specialises in, the skills cross-section of its workforce, recruitment methods and selection – the list is long and complicated. Each aspect impacts upon another, and it is in this complexity – which will be familiar and seem uncomplicated to you and your top management – that a security audit and vulnerability assessment must be conducted if it is to be of value.

Illuminate your weaknesses

I think it was David Ogilvie, the British advertising guru, who noted that “Information is sometimes used like a drunk uses a lamppost – for support rather than illumination”.

The same danger is present in vulnerability testing. Off-the-shelf kits will provide some answers, most superficial, and could skirt around critical issues. They might not encourage the kind of creative thinking that could prevent the attacks the bad guys are so good at. You need to analyse your corporate structure from every angle, because you will not find a replica, and you need to fully understand the security vulnerabilities, and then think creatively about your own space.

Some confusion arises in understanding the difference between threat and vulnerability. Each needs to be dealt with for what they are.

A threat is who might attack what assets, when, where and why and with what probability.

A vulnerability is a specific weakness in security open to exploitation by multiple perpetrators with varied motivations.

Jenny Reid
Jenny Reid

Notes the Journal of Physical Security: “One must test to tell if someone claiming to do a vulnerability test is actually doing a threat assessment is if they have identified a relatively small number of ‘threats/vulnerabilities’ and if mitigating them is a major undertaking. A vulnerability assessment will identify possibly hundreds of very specific weaknesses and many of the countermeasures will be cheap and relatively painless.”

It is not getting much easier out there. A vulnerability assessment for your company could be a vital next step.

iFacts offers free basic assessments on and may assist you to make a decision on your vulnerabilities.

For more information contact iFacts, +27 (0)82 600 8225,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Communication in any situation
Issue 8 2020, Elvey Security Technologies , Global Communications , Security Services & Risk Management
Global Communications offers an industry-first with five-year warranty on select Kenwood two-way radios.

The year resilience paid off
Issue 8 2020 , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions spoke to Michael Davies about business continuity and resilience in a year when everything was put to the test.

Integration is key for smart city security
Issue 9 2020, Technews Publishing , Security Services & Risk Management
While smart cities are about enhancing the lives of people through smart technology, security is an essential aspect of success.

Three mistakes when dealing with remote employees
Issue 9 2020 , Security Services & Risk Management
Sergey Ozhegov, CEO of SearchInform, says that employees are not the only weak points in the work-from-home chain.

Looking back with a new perspective on the future
Issue 9 2020, Axis Communications SA , Editor's Choice, Security Services & Risk Management
Peter Lindström reflects on predictions he made about the macro trends affecting the sector in 2020 in the light of the pandemic.

I want to be a Chief Risk Officer (said no one…. ever)
Issue 9 2020, Rectron , Security Services & Risk Management
With universal online access, a focus on going ‘paperless’ and the rise of the hybrid workforce due to COVID-19, the chief risk officer is more important than ever.

Free-flow smart weapons detection system
Issue 8 2020, XPro Security Solutions , News, Security Services & Risk Management, Products
Detecting people carrying weapons and preventing them from entering your venue is now possible, without sacrificing the visitor experience.

Meeting compliance obligations
Issue 7 2020 , Security Services & Risk Management
Helping businesses in SA understand and meet their compliance obligations to local regulations.

Business continuity through a COVID-19 lens
Issue 8 2020 , Security Services & Risk Management
COVID-19 has brought business continuity under scrutiny, with the opportunity to enhance resilience into the future.

7 Arrows becomes a part of Fidelity ADT
Issue 8 2020, Fidelity ADT , News, Security Services & Risk Management
Fidelity ADT and 7 Arrows have concluded an acquisition agreement effective 1 October 2020. 7 Arrows will now form a part of Fidelity ADT.