One of the biggest challenges facing any organization with a security department is: How to Explain (read: Justify) Utility of Security Operations? What Value do these operations bring to the overall bottom line? 

While senior managers, board members and general public accept the notional need for having security procedures and personnel in place since 9/11, most of those who run these operations have difficulty with providing answers beyond the mere "That's just it, we need it!" The situation is prevalent in many countries, but in Canada it is compounded by a simple fact that we have not (thankfully) experienced serious security incidents. Bad things just do not happen here.

Generally speaking, security operations are human/technology systems designed to protect installations or people from natural or man-engineered threats. The real concerns, of course, are always with people who possess malicious intent and means/skills allowing them to execute an attack. 

High-risk assets in transportation industry, such as air/ports and public transit hubs, present a particular problem for security operatives often due to larger territories to protect, multiple entry points, high passenger/cargo traffic and more. After conducting regular TRAs and identifying vulnerabilities, target hardening often ensues through the addition of infrastructure and/or technological 'barriers' and training of personnel to follow strict protocols. Apart from serious budget expenditures which continue to build-up as threats evolve and tech solutions are added (space allocation!), such typical responses often create a very rigid operational environment. Over time this vicious cycle leads to several outcomes: