Why deterrence, detection, delay and response matter more than individual security ratings
One of the most common questions we hear is:
“Do we need SR2 or SR3? B3 or C5?”
It’s a reasonable question.
But it’s often the wrong place to start.
Before discussing ratings, products or specifications, we should first understand the problem we’re trying to solve.
The reality is that effective security is rarely delivered by a single measure. It comes from layers working together.
- A perimeter fence.
- A detection system.
- Lighting.
- CCTV.
- Access control.
- Response procedures.
Each layer has a job to do:
- Deter.
- Detect.
- Delay.
- Respond.
The problem is that organisations sometimes focus heavily on one layer while overlooking the others.
Take a high-security perimeter fence as an example.
A fence is a passive security measure. Its role is to delay an attacker. The better the fence, the more time, effort and resources are needed to overcome it.
But here’s the question that often gets missed:
What happens when someone starts attacking the fence?
If nobody knows it’s happening, what value does that delay provide?
A fence doesn’t stop an attack. It buys time.
An attacker might need ten minutes, twenty minutes or even longer to breach the perimeter. Yet without detection they can simply work uninterrupted until the barrier is defeated.
In that situation, the fence isn’t buying response time. It’s simply extending the duration of the attack.
This is where active security measures become critical.
Perimeter Intrusion Detection (PID), monitored CCTV, analytics and alarm systems turn delay into something useful. They provide awareness. They create response time. They allow security teams to intervene before a breach occurs.
This is where the idea of layered security becomes so important.
The strongest security strategies don’t rely on a single product or a single rating. They combine passive and active measures so that each layer supports the next.
- Not every site needs the highest security rating.
- Not every threat requires the same response.
Security should always be proportionate to the risk.
That’s one of the reasons the latest LPS 1175 approach is such a positive development. Rather than encouraging a race towards the highest rating, it helps organisations think more carefully about attack methods, tools, likely threats and the level of protection that is required.
But like any framework, it only delivers value if people understand how to use it. Selecting a rating without understanding the threat is little different to selecting a fence without understanding the risk. The objective isn’t to choose the highest classification available; it’s to select a security solution that is proportionate to the threat and forms part of a wider layered security strategy.
So perhaps the question isn’t:
“Do we need SR2 or SR3? B3 or C5?”
The better questions are:
- What are we trying to protect?
- Who are we protecting it from?
- How will we know when an attack is taking place?
- How much time do we need to respond?
Because security is not about buying the strongest product.
It’s about building a system where every layer works together to deter, detect, delay and respond before a threat becomes an incident.
