For Projects · Service

Security Risk &
Threat Analysis

Security risk assessments and threat-vulnerability analysis (TVRA) that produce priority scenarios, defensible risk positions, and design implications your team can act on — grounded in our proprietary databases and structured analytical methods.

What you get

What a decision-ready threat assessment delivers

The difference between a risk register that sits on a shelf and one that drives design decisions comes down to how it's built.

01 Priority scenarios, not generic threat lists Credible attack scenarios developed from our proprietary terrorism database and structured analytical techniques. Each scenario is assessed for likelihood and consequence using HB167-aligned methods.
02 Quantified risk positions that prevent disproportionate expenditure We use probabilistic methods and quantified risk analysis to test whether proposed security treatments are proportionate to the actual threat. When assumed threats don't withstand structured analysis, we build the evidence to challenge them, protecting clients from expenditure the risk evidence doesn't justify. Every assessment makes assumptions explicit. Where we have evidence, we cite it. Where we're applying professional judgement, we say so.
03 Design implications written for design teams Risk outputs translated into spatial, operational, and engineering implications: setbacks, sightlines, access control zones, structural requirements. Every risk finding has a traceable path to a design decision.
04 A threat basis that reflects the current environment Assessment grounded in current threat intelligence, structured open-source analysis, and comprehensive demographic and crime data. We integrate crime statistics, ABS demographic profiles, and SEIFA indices alongside national threat advisories, building a threat context specific to your site, not a generic national picture.

Method

How we work

We begin with what you need to protect and why. Our analysts assess the threat environment, characterise vulnerabilities, and produce risk positions that inform design briefs, operational planning, and assurance. Every assessment is structured so assumptions are explicit, evidence is traceable, and professional judgement is clearly labelled. The output is a working instrument — not a static report filed away.

For: Project directors, risk owners, government security executives, and design teams who need a threat-informed basis for security investment and design decisions.

Commissioning

Commissioning a security risk assessment or TVRA

A concept-stage design brief and a review of an operating asset start from different information. Define the decision, assets and operating conditions before agreeing the assessment scope.

Bring to the first conversation

Bring the project brief or asset description, current plans, existing risk assessments and security arrangements, and the relevant design or governance deadline. Identify the risk owner and any assessment criteria the organisation already uses.

Agree the scope

Agree whether the work requires a threat assessment, a full threat, vulnerability and risk assessment, or an update to an existing assessment. Define the sites, scenarios, consultation, report and risk-register outputs, and review stages.

Name the responsibilities

Name who can approve the assessment criteria, accept residual risk, and own each treatment. Agree how requirements will pass into design or operations, and when changed conditions should trigger a review.

Discuss your scope

Retained arrangements

Standing threat intelligence

Threat environments move faster than assessment cycles. For organisations whose risk position can shift with a news cycle — electoral bodies, transport operators, high-profile precincts — we maintain standing threat intelligence arrangements: continuous monitoring of the threat environment, periodic assessments tied to your decision calendar, and threat cards that give operational teams a current, plain-language picture of each threat actor and vector.

These arrangements run under retainer, scaled to your environment. A current multi-year engagement supports a state government body through a period of elevated public exposure, pairing periodic threat assessments with event-driven updates.

We also review protective security frameworks against the PSPF — useful when machinery-of-government changes, new threat directions, or audit findings put your security posture in front of an executive board.

Explore Threat Intelligence & Assurance

In practice

See this in practice

Barangaroo HVM & Threat Assessment Coffs Harbour Bypass Security Crows Nest Over-Station Development Chester Hill Station — quantified proportionality Guide: Security Risk Assessment

Talk to a principal

Thirty minutes with a principal to work out whether the project needs us.

Talk to a principal Take the vehicle threat scorecard