In an environment where security is often discussed in absolutes, more technology, more controls, more urgency. 2025 reinforced a quieter but more important truth: effective security is not about volume or visibility. It is about judgment.
Over the past year, organizations across public, private, and critical environments have faced increasingly complex risk landscapes. Physical security threats have not disappeared; they have diversified. Operational constraints, governance expectations, regulatory scrutiny, and reputational risk now intersect in ways that demand clarity rather than reaction.
This year’s work reinforced a consistent theme: security that is fit for purpose, defensible, and aligned to organizational reality outperforms security that is simply performative.
Physical Security, Risk, and Governance in Practice
Physical security cannot be treated as a standalone discipline. In 2025, the most effective programs were those that treated security as a governance function, one that integrates risk management, policy, operational capability, and executive oversight.
Across multiple engagements, the focus was not on identifying every conceivable threat, but on understanding which risks materially mattered to the organization. This distinction is critical. Not every vulnerability requires remediation, and not every risk justifies investment. Mature security programs differentiate between theoretical exposure and operational consequence.
Risk-informed decision-making grounded in evidence rather than assumption, allowed organizations to allocate resources deliberately, defend decisions internally, and communicate clearly with leadership.
Risk Assessments as Decision Tools
Threat and risk assessments were not treated as static reports or compliance exercises. Instead, they were used as structured decision tools.
Effective assessments in 2025 demonstrated several common characteristics:
- Clearly defined accountability
- Aligned with actual operational capability
- Reflected regulatory and legal realities
- Enabled enforcement rather than exception
The value of these assessments was not in identifying risk, but in enabling informed trade-offs. Leadership does not require certainty; it requires defensible reasoning. When assessments were framed accordingly, they supported strategic conversations rather than operational debate.
Policy and Governance Frameworks That Function
Policy development and governance frameworks represented a significant portion of security work this year. Not because policies were missing, but because many existed without clarity, ownership, or operational linkage.
Effective governance frameworks in 2025 moved beyond aspirational language. They:
- Clearly defined accountability
- Aligned with actual operational capability
- Reflected regulatory and legal realities
- Enabled enforcement rather than exception
Importantly, governance was positioned as an enabler, not a constraint. When policies reflected how organizations actually functioned, compliance improved and risk posture became more consistent across sites and business units.
Executive and Board Advisory: Speaking the Right Language
Security discussions at the executive and board level require translation. Technical detail must give way to consequence, exposure, and decision thresholds.
Advisory work this year focused on helping leadership understand:
- What risks were being accepted, and why
- Where controls were sufficient, and where they were not
- How security aligned to broader enterprise risk management
The most productive conversations occurred when security was framed not as a cost center or protective function, but as a governance responsibility tied to duty of care, operational resilience, and organizational credibility.
Measured. Defensible. Fit for Purpose.
These three principles consistently defined effective security outcomes in 2025.
Measured security avoids reaction. It relies on proportionate response, calibrated controls, and evidence-based prioritization.
Defensible security withstands scrutiny. It can be explained, justified, and supported when challenged by regulators, auditors, executives, or the public.
Fit-for-purpose security acknowledges context. What is appropriate for one organization, facility, or risk environment may be excessive or insufficient for another.
Together, these principles form a foundation for security that is sustainable rather than reactive.
Looking Ahead
As organizations move into 2026, the expectation on security functions will continue to rise, not necessarily for more control, but for better judgment. Clarity of purpose, governance alignment, and defensible decision-making will remain the differentiators between mature security programs and those that struggle to justify their existence.
Progress this year was made possible through collaboration with clients, partners, and internal teams willing to engage honestly with risk rather than avoid it.
Thank you to those who allowed us to engage with them to do this work. The path forward is not about doing more security. It is about continuing to do it properly.
If your Municipality wants to learn more about this topic and read the full article version visit here. Feel free to contact me directly at [email protected] for further assistance.






Every municipality is at a different place in their journey, and that’s okay. They have differing levels of asset management maturity, differing data and information and different levels of organizational buy in and support. The best tip is to start where you are and reach out to your local communities of practice (yes they exist across the country, I am most familiar with Asset Management Ontario), the Canadian Network of Asset Managers, the Federation of Canadian Municipalities or any of the numerous asset management training partners across the country. Many have free tools to figure out where you are, your best next steps to gap fill, and tools to help you along that journey.
Enterprise Asset Management is an integral part of the Region of Peel’s strategic and long-term planning practices. Introduced in 2007, the program focuses on developing sustainable plans to maintain the infrastructure over a planning horizon that can be as long as 100 years. Guided by the principle of continuous improvement, these plans support Council’s level of service targets and long-term financial strategies. The Region’s Asset Management program is guided by industry best practice, as well as regulatory requirements. The program is continuously evolving to leverage opportunities and address challenges.

The web of roads that cover the inhabited parts of our world connect everything and everybody. They are the circulation network that move people and goods from everywhere to everywhere. From city to city, from country to country, or between houses in the same neighbourhood, we rely on roads to get us where we need to go. They are essential. When they are in good repair, they do their jobs well. When they are not in good repair, these roads cannot convey people and goods efficiently or at all.





