Security Research Initiative report focuses on building strong security cultures

The aim of the research underpinning the finalised 70-page document – put together by Professor Martin Gill CSyP FSyI, Charlotte Howell and Janice Goldstraw-White – was to explore the challenges posed to building a strong security culture in today’s world and, importantly, assess how the security sector is responding.

Research outcomes are based on the views of security professionals operating as part of in-house teams or in contract positions, as well as other security experts. Those views were collected via an online survey and in-depth interviews.

There are a number of key findings. Security culture is believed to be very important in terms of fashioning a successful security operation. In terms of those factors deemed important to a successful security operation, culture sits side-by-side with other key aspects such as effective security leadership, clear security objectives and an effective security strategy.

Culture is at least as important as strategy. Generally speaking, there’s a view that culture brings life to strategy and defines the extent to which that strategy is executed. Indeed, three-fifths of survey respondents indicated that security ‘culture’ is as important as security ‘strategy’, while on-third indicated ‘culture’ to be more important than ‘strategy’.

Security culture and organisational culture are linked. Views were mixed as to whether it’s possible to harbour a strong security culture without a strong broader organisational culture. For the most part, interviewees feel there’s a relationship between the two and that a good organisational culture will readily enable a good security culture, while a bad organisational culture would create challenges for a good security culture.

Engaged in security

Those security professionals surveyed don’t believe organisations’ workforces are sufficiently engaged in security. Engaging the wider workforce of an organisation with security is known to be an important element in terms of developing a strong security culture. While two-thirds of respondents questioned felt that the wider workforce of an organisation tends to value physical security measures in their workplace, they were less inclined to view the workforce as being strongly engaged with security.

Less than 50% believe employees see security as being important to overall success and less still feel that employees view contributing to security as a part of their own job description.

Overall, less than 25% of survey respondents suggest that the wider workforce of an organisation commonly carries out behaviour indicative of a strong security culture.

The barriers to engagement need to be overcome. The reasons for a lack of engagement are varied. Barriers cited by participants include a lack of senior level ‘buy-in’, a lack of financial investment, a negative perception of security, the lack of – or otherwise ineffective communication on – key security issues being brought to the fore, complacency and apathy among the wider workforce of an organisation, competing priorities and workloads among the wider workforce and the quality levels of security staff (including management).

Recent trends

Some recent trends may also be undermining a security mindset, such as the increase in working from home, which makes it far harder to ensure members of staff are engaged with security requirements. Financial pressures may compromise the quality of security and the priority afforded to developing security culture, while understaffing and staff turnover – both within security teams and across organisations – make it difficult to keep staff engaged.

Communication of the value of security is key. The research findings suggest much more focus is needed on engaging the workforce. Ultimately, effective communication of the value of security is the key to overcoming barriers.

Different groups need to understand ‘what’s in it for them’. That being so, messages need to be tailored to senior leadership, security teams and to the wider workforce in order to demonstrate the benefits of security.

Professor Martin Gill CSyP FSyI (founder of PRCI and the leader of this particular research programme) noted: “Our research suggests that security professionals are unequivocal about the value of security culture in supporting security excellence. Good security culture is an essential ingredient, but it’s one that can be hard to obtain.”

Professor Gill continued: “According to our survey participants, the key is to effectively articulate the value of security in ways that are meaningful to different audiences within an organisation. This means stepping beyond the notion that security is only there to deal with a crisis and demonstrating that it’s an enabler of operations and, moreover, a contributor to the overall success of an organisation.”

In conclusion, Professor Gill observed: “If good security is about engaging the hearts and minds of stakeholders, not least staff and hierarchies, then our research results strongly suggest that the security sector is struggling. Worse still, some recent societal trends are complicating the problem still further and increasing the difficulty of the challenge.”

Research sponsors

The Security Research Initiative members who sponsored this particular piece of focused research are interr, M&S Group (Asset Protection), Mitie Group plc, OCS Group, PwC, the Security Industry Authority and Sodexo.

As a whole, the Security Research Initiative study programme is supported by leading security associations, among them ADS, ASIS International’s UK Chapter, the British Security Industry Association, International Foundation for Protection Officers (UK), the International Professional Security Association, The Security Institute and the Security Awareness Special Interest Group.

*Copies of ‘The Importance of Security Culture in Facilitating Security Excellence’ may be downloaded from the Security Research Initiative’s website