What Differentiates You As a Security Consultant? (It’s Not Your Question Set)

“My question set is my secret sauce.”

We often hear this from security consultants and practitioners when they’re talking about the questions they use to perform risk analyses. Many consultants believe their security questions differentiate them from the competition. They believe they have the best assessments for their industries

This usually comes up when we’re about to input their questions into the Circadian Risk platform; consultants worry that their proprietary question set will be shared with everyone who uses our software— that the competition will get access to their “secret sauce.”

There are a few misconceptions here. First, we never share question sets without explicit permission from a client. Second, most question sets are the same. I have never seen a question set so unique that it’s better than anybody else’s. Third, your question set isn’t what sets you above the competition at all; it’s something else entirely.

What is a question set?

A question set is the list of questions or checklists a security consultant uses to perform a risk analysis at a site. These can vary a little, depending on the way the risk analysis is being conducted. There are three ways of doing this.

Gap analysis

Many industries comply with specific security standards and regulations. For example, importers and freight companies comply with Customs Trade Partnership Against Terrorism (CTPAT). When a site is being assessed using a standard like CTPAT, assessors use a standard question set, or a question set based on the standard’s requirements.

Structured assessment

Some industries aren’t governed by standards. In this case, companies or assessors often come up with their own questions, based on voluntary standards, best practices or guides. This often takes the form of a checklist.

Ad hoc assessment

Ad hoc assessments are assessor-based rather than question-based. While there might be some guiding questions during an ad hoc assessment, typically there is no question set at all. Instead an individual assessor writes their observations about your site’s security. True risk analysis can’t be done during an ad hoc assessment, because it’s so subjective.

In all these cases, most assessors are asking the same questions about a site’s risk. Circadian Risk has a slightly different approach. We’ve created scenario-based risk assessments.

Question sets for scenario-based risk assessments

A scenario-based assessment is a risk assessment that’s directed toward a specific threat, concern, compliance standard, or hazard. Rather than using a general question set to assess the vulnerability of an entire site, a scenario-based assessment evaluates the risk of one specific scenario happening at each site. Your question set to evaluate the risk of theft, for example, would be much different than the one you’d use to assess the risk posed by a tornado.

Assessing risk by scenario allows you to normalize data, so we can do comparison and trend analysis, recommend countermeasures that apply to the scenario, and track remediation in our platform.

Your question set doesn’t differentiate you; you do that yourself

In the end, it’s not the question set you use. It’s the end deliverable and the service you provide to your clients that sets you apart.

As a consultant, it’s important to ask yourself what you are going to provide to your client that differentiates you. Don’t be afraid to let your expertise show. Many consultants don’t recommend products, for example. Clients, however, need your expertise when choosing cameras or other technology. Help them by explaining which products work best.

Many consultants provide a narrative report. Differentiate yourself by offering a digital report that clearly shows data about their risk and allows your client to remediate that risk based on the best countermeasures on the market.

Your clients rely on you, not your question set. By providing excellent service, you can stand out from the competition and keep your clients safe.

Interested in learning more? Contact us to talk to an expert today.

About the Author

Daniel Young

Founder & Chief Innovation Officer

Daniel has been a security and risk advisor for more than 10 years, and is passionate about helping companies to better understand their risks to undesirable events on a daily basis. Dan previously served as the Regional Bioterrorism Coordinator for District 1 in Michigan, where he was instrumental in preparing communities for catastrophic incidents. He has also acted as the Private Security Liaison for the City of Lansing’s Critical Infrastructure Team, which identified and documented deficiencies in the city’s critical infrastructure.

He is a Co-Founder of the CSO Risk Council, a think tank of seasoned security professionals and thought leaders with extensive experience in managing the physical security and risks of large enterprises consisting of multiple sites and whose mission is to create a better process to develop and share innovative solutions and pertinent information with organizations to improve safety and security risk by providing a forum to discuss best practices and recommendations for specific risk scenarios and to network with other enterprise security professionals.