top of page

Why we focus security training on capabilities rather than vulnerabilities

Multi-ethnic groups sits at table for security training using capabilities approach. Caption: Using a capabilities approach in security training. Safer Edge.

People - their decisions and behaviours - are at the heart of good security risk management. The ability of any organisation to manage its safety and security risk is only as good as its weakest link. Only by having robust policies and plans that make sense to the individuals who must understand and follow them – whether they are the CEO in London or the security guard in Kinshasa – can be considered good security risk management. For security to operate in practice, it must be about people and how they understand and contribute to their personal safety and security as well as that of the organisation.

People, on the other hand, are a complicated bunch. We are complex and our decision-making when it comes to risky behaviour is sometimes a mystery. Sometimes people heed some security recommendations and disregard others. Sometimes people have been trained on what they should do, and they do something else entirely. We believe that part of this arises from a security training emphasis on vulnerability rather than capability.

Vulnerability is at the heart of most NGOs' risk assessment process, and it's at the heart of any security risk management. The interaction of threat impact and threat vulnerability results in a risk that may be ranked from high to low.

Vulnerability is defined as 'the quality or state of being exposed to the possibility of being attacked or harmed'. We identify a threat, such as carjacking, and then analyse employees vulnerability to carjacking. We may consider how frequently vehicles are used, where they are used, and when. We may recognise that drivers are at higher risk because of the amount of time they spend driving. Perhaps employees who work in each place are more vulnerable because of the increased number of carjackings in that area. Staff who haven't been trained in avoiding or responding to a carjacking are more vulnerable.