The Security Officer Who Says “Something Doesn't Look Right”

Some of the most valuable information I received during my time in policing didn't start with an alarm, a radio call or somebody witnessing a crime.

It started with:

“Something doesn't look right.”

Sometimes the person reporting it couldn't immediately explain why.

A vehicle had been there before.

Someone seemed unusually interested in a particular entrance.

A person had walked past several times.

Someone was asking questions that didn't quite make sense.

Individually, none of those things necessarily meant very much.

But sometimes they did.

After moving from policing into private security, I've become increasingly convinced that one of the most underused capabilities of a good security officer is simply this:

They know what normal looks like.

And because they're there every day, they can sometimes recognise when something isn't normal.

That doesn't make security officers intelligence officers.

It doesn't make them detectives.

And it certainly doesn't mean we should encourage officers to treat everybody who behaves slightly differently as suspicious.

It means we should teach security officers to observe, engage where appropriate, record and report.

Because occasionally, a small piece of information only becomes important when somebody connects it with another one.

What is behavioural awareness in security?

Behavioural awareness is the ability to recognise activity that appears unusual or inconsistent with what would normally be expected in a particular environment.

For a security officer, that starts with understanding the baseline.

What normally happens here?

Who normally comes through this entrance?

When are deliveries made?

Where do visitors normally go?

What do contractors normally do?

Which vehicles regularly use the site?

Where do members of the public normally congregate?

What questions do legitimate visitors normally ask?

The officer who has worked the same site for months potentially develops something extremely valuable:

context.

A person standing outside an office building isn't inherently suspicious.

Someone taking photographs isn't inherently suspicious.

A delivery driver asking where an entrance is isn't inherently suspicious.

But behaviour can become more interesting when considered against the environment, circumstances and other observations.

Current ProtectUK guidance similarly encourages staff to understand their working environment and normal activities so that they are better able to identify the difference between normal and unusual or suspicious activity.

Suspicious behaviour isn't about what somebody looks like

This point is extremely important.

You cannot identify hostile intent from somebody's ethnicity, religion, age, clothing or general appearance.

Security officers shouldn't be encouraged to build profiles of what they think a criminal or terrorist “looks like”.

The focus should be on behaviour and circumstances.

What is the person actually doing?

Why has it attracted attention?

Does their explanation make sense?

Is there a legitimate reason for their behaviour?

Is it one isolated observation or part of a pattern?

That's a much more professional approach than simply labelling somebody “suspicious”.

What might make a security officer think “something doesn't look right”?

There isn't a definitive checklist that identifies hostile intent.

Context matters.

But there are behaviours and circumstances that may justify greater attention.

For example:

Someone repeatedly visiting or passing the same location without an obvious reason.

Unusual interest in entrances, exits, CCTV cameras, security officers or access-control arrangements.

Someone apparently monitoring staff routines or security activity.

Questions about security arrangements that seem unnecessary for the person's legitimate purpose.

Attempts to access non-public or restricted areas.

Repeatedly trying doors or access points.

Activity that appears to be testing how staff respond.

A vehicle repeatedly appearing in an unusual location.

An unattended item positioned somewhere unexpected.

Photography focused specifically on security infrastructure, entrances, exits or other potentially sensitive features.

None of these automatically means somebody is planning a crime or terrorist attack.

Photography is a particularly good example.

Taking photographs in a public place isn't inherently suspicious.

ProtectUK explicitly notes that there is no general law preventing someone photographing people or things in a public place, and security personnel do not have general powers to demand to inspect or delete those photographs.

The question is the wider context.

Someone taking a photograph of an impressive building is normal.

Someone repeatedly photographing access-control points, CCTV positions, security routines and staff entrances may reasonably attract more attention.

It's the behaviour, context and combination of indicators that matter.

What is hostile reconnaissance?

Hostile reconnaissance is essentially information gathering by somebody with malicious intent as part of planning hostile activity.

That could potentially relate to terrorism, but the principle is wider.

Criminals also gather information.

They may want to understand:

When does the building close?

When are there fewer staff?

Where are the cameras?

Which entrances are controlled?

How are deliveries accepted?

What happens if somebody doesn't have a pass?

How quickly does security respond?

Where are valuable assets located?

ProtectUK describes hostile reconnaissance as an information-gathering phase in which those with malicious intent seek information about security, vulnerabilities and their likelihood of success.

This is where a switched-on security officer can be incredibly valuable.

Because hostile reconnaissance creates an interesting problem for the person conducting it:

At some point, they may need to expose themselves to obtain information.

And that's an opportunity to notice them.

Security officers shouldn't be intelligence officers

I think we need to be careful here.

There is a danger that behavioural-awareness training turns into:

“Look for terrorists.”

That's not what I'm advocating.

A frontline security officer shouldn't be expected to determine somebody's intentions or conduct their own investigation.

Their job is much simpler.

Notice.

Engage where appropriate and safe.

Record.

Report.

This is also reflected in the See, Check and Notify (SCaN) approach

Then allow the appropriate person to assess the information.

A security officer might see one small part of something much bigger.

They shouldn't necessarily be expected to know its significance.

The apparently innocent question

This is something I think experienced security officers become quite good at recognising.

Most legitimate questions have a logical reason behind them.

“Where is reception?”

“Where do I make a delivery?”

“Which entrance do visitors use?”

Perfectly normal.

But occasionally a question feels slightly different.

“What time does security finish?”

“Is anyone here overnight?”

“Are all these cameras working?”

“Does that gate stay locked?”

“Where does that door lead?”

Again, asking one of those questions doesn't make somebody hostile.

There may be a completely innocent explanation.

The officer's role isn't to accuse them.

But it may be worth remembering the conversation, particularly if combined with other unusual activity.

Good security awareness is often about avoiding two extremes:

Ignoring everything.

And:

Treating everything as a threat.

Professional judgement sits somewhere between the two.

Engagement can be a security measure

One of the simplest interventions can also be one of the most effective.

“Good morning. Can I help you?”

A professional security officer approaching somebody isn't necessarily accusing them of anything.

They're engaging.

For a legitimate visitor, that's good customer service.

For somebody who's lost, you've helped them.

For somebody who has a genuine reason for being there, the conversation probably resolves the situation immediately.

But for somebody conducting hostile reconnaissance or preparing criminal activity, they've just learned something else:

They've been noticed.

ProtectUK specifically identifies a competent, vigilant guard force that proactively engages with people as an effective measure for disrupting hostile reconnaissance. It notes that polite engagement can make people conducting hostile activity feel exposed and introduce doubt about whether their plans will succeed.

That's a powerful security measure that doesn't require another camera, barrier or piece of technology.

It requires a switched-on person.

But security officers need to know their limits

Engagement doesn't mean confrontation.

And personal safety comes first.

If somebody's behaviour gives an officer cause for concern, the decision to approach them should take account of the circumstances and potential risk.

ProtectUK guidance similarly says any approach should be considered from a personal-safety perspective because an individual may become argumentative or violent.

Sometimes the correct response isn't to approach.

It may be to observe from a safe position, inform the control room or supervisor, use CCTV to maintain observation and escalate appropriately.

This is where training and clear procedures matter.

The report is often more important than the observation

This is probably the part I think organisations get wrong most often.

Imagine an officer sees somebody photographing the staff entrance on Monday.

Another officer sees the same person asking about deliveries on Wednesday.

A receptionist sees them again on Friday.

Three people think:

“That was a bit odd.”

Nobody records it.

Nobody reports it.

Nobody joins the information together.

As far as the organisation is concerned, nothing happened.

That's the weakness.

ProtectUK guidance makes the same point: suspicious activity can be observed by staff, reported by members of the public or identified through CCTV, but its value depends on having a process for escalating, recording and acting on that information.

Observation without reporting has very limited value.

What information should a security officer record?

If something genuinely attracts an officer's attention, the report needs to contain useful facts.

Not:

“Suspicious male outside.”

That's almost useless.

I'd want:

What happened?

What exactly did the person do?

What made it unusual?

Where did it happen?

What time?

How long were they there?

What did they look like?

What were they wearing?

Was a vehicle involved?

Registration, make, model and colour if safely observed.

Which direction did they leave?

What questions did they ask?

Did anybody speak to them?

What explanation did they give?

Is CCTV available?

Have they been seen before?

And importantly:

What did the officer actually observe, rather than what do they think it meant?

There's a significant difference between:

“Male conducting reconnaissance.”

and:

“Male remained opposite staff entrance for approximately 20 minutes and photographed the entrance, CCTV camera and vehicle gate. When approached and asked if he required assistance, he said no and left towards X.”

The second report gives somebody information they can actually assess.

What should happen after suspicious activity is reported?

This is where management becomes important.

The officer shouldn't send a report into a system where nobody ever looks at it.

Someone needs ownership.

Depending on the circumstances, that might mean:

Reviewing CCTV.

Checking previous incident reports.

Briefing the next shift.

Informing neighbouring security teams.

Increasing attention to a particular area.

Preserving relevant CCTV.

Escalating internally.

Or contacting the police where appropriate.

If there is an immediate threat or urgent police assistance is required, call 999. ProtectUK also provides routes for reporting terrorism-related suspicious activity where the situation isn't an immediate emergency.

The important thing is that information goes somewhere.

Don't punish people for being wrong

This is another lesson I take from policing.

If you want people to report things, they need confidence that they're not going to be ridiculed every time something turns out to be innocent.

Most unusual behaviour probably has an innocent explanation.

That's fine.

I'd rather an officer professionally reports something that turns out to be nothing than thinks:

“I'll probably look stupid, so I won't bother.”

ProtectUK recommends giving staff feedback on suspicious-activity reports because it reinforces confidence that their observations matter and encourages a positive security culture.

That feedback loop is important.

Technology helps. People still matter.

CCTV, access control, analytics and other security technologies have transformed what we can do.

But they don't remove the value of human observation.

A camera records what's happening.

A good security officer may understand why what's happening is unusual for that location.

And the two can work together.

An officer notices something.

The control room finds the individual on CCTV.

Previous footage is reviewed.

A pattern is identified.

Information is recorded.

Another shift is briefed.

If appropriate, police are informed.

ProtectUK specifically recognises CCTV as valuable for identifying and investigating suspicious activity and hostile reconnaissance, including tracking an individual after activity has been identified.

Technology provides capability.

People provide context.

Security officers are the eyes and ears of a site

I don't use that phrase to suggest security officers should be amateur detectives.

Quite the opposite.

The best officers I've worked with understand the limits of their role.

But they're present.

They see the same environment every day.

They recognise regular contractors.

They know normal delivery patterns.

They notice when a door that's normally closed is open.

They notice a vehicle that's been parked somewhere unusual for three consecutive nights.

They remember somebody who came in last week asking an odd question.

That knowledge has value.

But only if we train officers to recognise it, give them an easy way to report it and have somebody capable of assessing what they tell us.

The question I'd ask your security officers

Next time you're on site, don't only ask your security officer:

“Everything alright?”

Because you'll probably get:

“Yep, all good.”

Ask them:

“Have you noticed anything unusual recently?”

You might get a completely different conversation.

Then ask:

“If you did see something that didn't look right, what would you do with that information?”

If they don't know, that's something I'd address.

Because a good security officer doesn't need to know that somebody is planning a crime or hostile act.

They don't need to solve the puzzle.

They just need to recognise that one of the pieces doesn't look right — and make sure somebody knows about it.

Frequently Asked Questions

What is suspicious behaviour in security?

Suspicious behaviour is activity that appears unusual or potentially indicative of criminal or hostile activity when considered in context. It should be assessed on behaviour and circumstances rather than a person's appearance or protected characteristics. ProtectUK encourages staff to understand what is normal within their environment so they are better able to recognise unusual activity.

What is hostile reconnaissance?

Hostile reconnaissance is information gathering undertaken by individuals or groups with malicious intent as part of planning hostile activity. It can include attempts to understand security arrangements, access points, routines, vulnerabilities and the likelihood of detection.

Is taking photographs suspicious?

Not necessarily. Photography in a public place is generally lawful and common. Context matters. Repeated or focused interest in security arrangements, entrances, exits or CCTV may warrant greater attention when combined with other circumstances, but photography alone should not automatically be treated as hostile activity.

Should a security officer challenge suspicious behaviour?

Where appropriate and safe, professional engagement can help establish whether there is an innocent explanation and can also disrupt potential hostile reconnaissance. However, officers should consider personal safety, follow site procedures and escalate where direct engagement would be inappropriate.

What should security officers do if they notice suspicious activity?

They should follow their organisation's procedures, record useful factual information and escalate promptly to the appropriate supervisor, control room or management. Where urgent police assistance is required, call 999. ProtectUK also provides official channels for reporting terrorism-related suspicious activity.

Is your security team watching – or just present?

A security officer's value isn't measured simply by whether they're standing at the entrance.

Good security officers understand their environment, engage with people, notice unusual activity and know what to do with that information.

At Blue Light Security Solutions, we believe effective guarding requires more than physical presence. It requires training, awareness, management and clear reporting processes behind the officer.

If you're reviewing your security arrangements, speak to Blue Light Security Solutions about how we can support your site.

0800 999 1829
office@bluelightgroup.uk