Why We’re Always One Step Behind: The Illusion of Preparedness
Contributed by Jim Brigham, LCG VP of Risk Management, Former Operations Chief, State of Vermont, Office of Safety and Security
Organizations across the United States have invested heavily in security cameras, access-control systems, emergency plans, lockdown procedures, and law-enforcement coordination. These measures are necessary, but they can also create an illusion of preparedness. They help organizations document incidents, regulate routine access, and respond more effectively once violence begins. What they do not necessarily provide is the ability to recognize and interrupt an emerging threat before an attack occurs.
Security cameras are a clear example. Cameras can deter some misconduct, provide situational awareness when actively monitored, and produce valuable evidence after an incident. However, cameras alone do not interpret behavior, connect warning signs, or initiate intervention. The July 2025 shooting at 345 Park Avenue in Midtown Manhattan illustrates this limitation. The building reportedly had a uniformed NYPD officer, private security personnel, surveillance cameras, access controls, and an elevator recall system. Nevertheless, a lone gunman entered the building carrying a rifle, killed four people, and reached an upper floor. The cameras documented his actions and helped investigators reconstruct the attack, but they did not recognize or stop the developing threat before he entered. Spectrum News NY1
Access control presents a similar limitation. Badges, locked doors, visitor-management systems, gates, and security checkpoints are designed primarily to regulate movement. They determine whether a person has permission to enter a location; they do not determine whether an authorized employee, expected visitor, contractor, or member of the public may present a developing risk. Access control generates data, but data is not intelligence until it is evaluated alongside behavior, grievances, communications, online activity, workplace concerns, and other relevant information.
The January 2025 vehicle attack on Bourbon Street in New Orleans demonstrates what happens when organizations possess multiple security measures but fail to integrate and maintain them effectively. The area had extensive camera coverage, police presence, traffic restrictions, and protective barriers installed in response to the known threat of vehicle attacks. At the time of the attack, however, some permanent bollards were being replaced or were inoperable, and the attacker maneuvered around a police vehicle serving as a temporary barrier. Fourteen people were killed, and dozens were injured. The city had made substantial security investments, but the protective system did not function as intended at the critical moment. Associated Press, FBI
Emergency plans are also frequently mistaken for prevention strategies. Lockdown procedures, panic alarms, evacuation plans, and rapid-response protocols can save lives, but they generally become operational only when a crisis is already underway. The September 2024 shooting at Apalachee High School in Georgia illustrates both their value and their limitation. Teachers had wearable panic-button badges that rapidly alerted law enforcement and initiated emergency notifications. Officers responded within minutes, helping to limit the duration of the attack. However, four people were killed, and nine were injured. The response technology appears to have worked as designed—but it activated only after the violence began. Scripps News
The attempted assassination of then-former President Donald Trump in Butler, Pennsylvania, provides another important example. Before shots were fired, law-enforcement personnel had reportedly observed the attacker behaving suspiciously. Information existed across different personnel and agencies, but communication, command responsibilities, and decision-making were fragmented. The attacker reached an unsecured rooftop and opened fire before the available information resulted in decisive intervention. Subsequent congressional findings identified communication failures, missed warning signs, inadequate planning, and systemic weaknesses. This was not simply a failure to observe the threat; it was a failure to convert scattered observations into actionable intelligence. Senate Homeland Security Committee, Associated Press
These incidents also demonstrate the evolving challenge of lone-actor violence. Lone actors may develop grievances, radicalize online, research targets, obtain tactical information, and move toward violence without belonging to an identifiable group or communicating with a broader network. Their pathway from grievance to action may be compressed, fragmented, and difficult to detect through traditional security or law-enforcement methods. The challenge is not simply responding faster. It is identifying behavioral changes, leakage, escalation, fixation, target selection, and other warning indicators early enough to intervene.
Organizations often remain trapped in a reactive model: an incident occurs, video is reviewed, emergency plans are activated, law enforcement responds, and additional hardware is purchased afterward. Each measure may improve security, but none addresses the central question of whether the organization can recognize an emerging threat before response becomes necessary.
Cameras help us see. Access-control systems help regulate movement. Emergency plans help us respond. Prevention requires something more—the ability to recognize weak signals, connect fragmented information, assess concerning behavior, assign responsibility, and act before an individual crosses the threshold into violence. Security can no longer be measured solely by how effectively an organization responds after an attack begins. The question is no longer whether organizations can respond. The question is whether they can recognize emerging threats before response becomes necessary.
