Blog
May 16, 2025
Kirsch Group President Andrew Kirsch recently contributed to an article in the Winnipeg Free Press on the rising costs of security for the City of Winnipeg in response to escalating threat environment.
“Anyone with the responsibility for publicly accessible spaces – municipal governments, especially – have this very challenging duty of care, which is to provide an open, welcoming, accessible space for people who use the services, and also provide the safety and security for the visitors, guests and people who work there.
Ever since COVID, really… we have seen many government facilities or public spaces having to reassess if their security posture is still appropriate for the elevation in threats they are facing”
Winnipeg is unfortunately not alone. We have seen across Ontario threats to those working in municipal services as well as religious institutions, public transportation, and other public spaces like libraries.
New or elevated threats such as encampments, protests, confrontations around contentious legislation or government decisions such as building and land use planning as well as generally increasingly hostile public has changed the game. It is important to understand the security you have in place is appropriate for the threats and risks you face and take appropriate steps to mitigate risks.
Why Regular Security Assessments Are Essential for Ongoing Risk Management
Security isn’t static—threats evolve, organizations change, and new vulnerabilities emerge. Yesterdays challenges may be different than today’s threats and vulnerabilities. Regular security assessments are a fundamental part of an effective risk management program, ensuring that any deployed protective measures and processes stay relevant and effective. Without current assessments and reviews, organizations run the risk of relying on outdated strategies that fail to address current threats.
How Often Should You Conduct a Security Assessment? Best Practices for Different Industries
There is not right answer. The frequency depends on many factors including incident history, any changes in operations, new risk exposures, new industry security standards or requirements and / or environmental or area changes. High-risk sectors like finance, healthcare, or critical infrastructure may require more frequent assessments. For others, annual reviews with full assessments conducted every 3 to 5 years might suffice—provided there are no major changes in operations, staffing, or technology. It’s best practice to also conduct assessments following any significant incident or organizational shift.
The Benefits of Staying Ahead: Proactive Risk Identification and Mitigation
It is unfortunate that security is often assessed after an incident or near miss. That can be a costly strategy in terms of loss and the cost of recovery. Regular assessments help identify potential issues before they become real problems. Security enhancements may not be able to stop all events but can lessen the impact and speed up recovery time. It’s also a powerful demonstration of due diligence to regulators, stakeholders, and customers – which may limit liability.
How Security Assessments Help Adapt to Changes in Your Organization’s Risk Profile
Changes to the operations, growth, evolving operating environment as well as technology transformation and staff turnover can create risks and opportunities. Regular assessments provide a mechanism for your organization to stay aligned with its evolving risk environment. They ensure your security policies, systems, and physical safeguards mature alongside your business so they remain appropriate to manage changing risk exposures.
Today’s threats are sophisticated and constantly shifting. From municipalities dealing with challenging public to emerging technologies creating unique cyber vulnerabilities. Security assessments also evolve — not only in frequency but in scope and methodology—to account for an maturity.
Steps to Take After a Security Assessment: Turning Insights into Action
An assessment’s value lies in how its findings are used. After each review, create a prioritized action plan based on the identified risks. Assign responsibilities, allocate resources, and set timelines. Make sure progress is monitored and documented—not just for compliance, but for continuous improvement.
Security is a process, not a checklist. Complement formal assessments with ongoing monitoring, audits, and threat intelligence updates. This layered approach helps detect risks between assessments and ensures you’re never caught off guard by changes in your internal or external environment.
It’s important to optimize security where possible and if additional investments are required – be as efficient and effective as you can with your resources. While the threats may be escalating security budgets often are restricted. It’s important to ensure that you are getting the most out of your resources.
Conclusion
In the face of an evolving and escalating threat environment many organizations are being confronted with the reality that their existing security may not be appropriate to meet their challenges. Regular security assessments are a critical part of a proactive, modern security posture. They help you stay ahead of threats, respond to changes, and maintain a resilient organization. In today’s fast-moving threat landscape, staying still is falling behind.