Many organisations have invested in monitoring and in physical security, and still find that concerning matters are handled inconsistently. The reason is usually structural rather than technical: nothing in between converts alerts into assessed intelligence.
What the gap looks like in practice
- Alerts accumulate faster than anyone can review them
- Decisions about severity are made informally, and are not recorded
- Concerns are escalated by whoever happened to see them
- Physical security receives raw output rather than an assessment
- Nobody owns the chronology
Closing it
The gap is closed by analysts and by process: defined intake, consistent triage criteria, structured records, documented assessment, and an agreed escalation route. Tooling helps with collection and organisation. It does not make the judgement.
A caution about automation
Automated scoring is useful for prioritising attention. It is not a determination that a person is dangerous, and it should never be presented as one.
This article is general commentary on intelligence practice. It does not describe any client, engagement, or individual, and it is not advice on a specific situation.