Hostile reconnaissance: what to train your frontline to spot
Attackers almost always look first. The single highest-leverage investment in protective security is often the one that costs the least.
Almost every public-space attack in the last decade was preceded by reconnaissance — sometimes hours before, sometimes months. That window is the one period in the attack cycle where a well-trained frontline can interrupt the timeline without ever drawing a weapon.
Hostile reconnaissance has a recognisable signature: repeated unexplained visits, unusual photography of security infrastructure, probing questions about staffing and routines, vehicles parked with line-of-sight to entrances. None of these in isolation is suspicious. Together, over time, they are.
The frontline most likely to spot it is rarely security. It's the receptionist, the duty manager, the cleaner who notices the same person twice in a week. The question isn't whether they'll see it — it's whether they have the training, the language and the permission to report it without feeling foolish.
A two-hour session, repeated annually, with a clear reporting route into your security function will outperform a six-figure technology investment in almost every realistic threat scenario. Train the people who are already looking.
Related services
More insights
Keep reading.
Related thinking from the Oakwood team.
Martyn's Law: what the Terrorism (Protection of Premises) Act actually asks of you
A plain-English breakdown of the new statutory duties, the Standard and Enhanced tiers, and where most organisations are underestimating the work.
Mental Health First Aid: the quiet layer in your incident response
The first 72 hours after a serious incident are a welfare problem as much as an operational one. Most response plans don't reflect that.
Building a threat assessment that actually drives decisions
Most threat assessments end up as background documents. The useful ones change where money is spent — and where it isn't.