How to Tell a Security Assessment From a Sales Visit

Almost every security assessment in this industry is free, which should tell you something. It is a sales visit with a document attached. That is not damning, but it does mean the quality varies enormously, and you usually cannot tell which kind you received until about eight months later.

Here is the awkward economics of it. An assessment costs the firm doing it a day of a senior person's time, and they are giving it away because it is the most effective way to sell a project. Which is fine. Plenty of genuinely good work gets done under that arrangement, and a free assessment from a competent firm is one of the better deals available to a building owner.

The problem is that a walkthrough conducted to justify a predetermined proposal and a walkthrough conducted to find out what is actually wrong look almost identical while they are happening. Both involve somebody polite with a clipboard. The difference shows up in what arrives afterward, and by then you have already spent the time.

So here is how to tell on the day. Ten things to watch for, each with the good version and the version that should give you pause.

01 Why they are all free

Understanding the economics changes what you look for. A firm sends a senior person to your building for most of a day, produces a document, and charges nothing. That is a real cost to them, absorbed because an assessment is the most effective sales instrument this industry has. Somebody who has walked your building with you and written down what is wrong with it is in a considerably stronger position than somebody who emailed a price list.

None of that is a criticism. It is a reasonable arrangement and a lot of excellent work starts this way. But it does mean the document you receive was produced by a party with an interest in its conclusions, and it means quality varies from genuinely rigorous to a proposal wearing a document's clothes.

The cost of the bad kind is not money, since you paid nothing. It is a year and a wrong decision. You spend a capital cycle solving the problem the assessment described rather than the problem you had, and you find out when the thing you actually needed fails.

So the question to hold in your head throughout is simple. Does this document serve me, or does it serve them? A good assessment serves both, which is the point. One that serves only them is recognizable, and the rest of this article is how.

02 What happens before they arrive

The assessment starts before anybody walks the building, and this is the earliest place you can tell what you are dealing with.

A serious firm asks for things in advance. Drawings, if you have them, ideally including whatever life safety drawings exist. What is currently installed and roughly when. Any inspection reports or deficiency lists from the last couple of years. What prompted the call. Whether anything has actually happened. Who else in your organization has a stake in the answer.

They will also ask when the building does its most interesting thing, and try to come then. A plant at changeover, a dock during a shift, a school at dismissal, a hospital floor during rounds. A building at ten in the morning on a Wednesday with everything calm tells you almost nothing.

Send them the material even if they do not ask, because their reaction to receiving it is informative in itself. Somebody who reads a drawing set before arriving will ask different questions when they get there.

03 The walkthrough itself

The single most reliable indicator is duration. A real assessment of a building of any size takes hours. If somebody is finished in forty minutes, they were confirming a proposal they had already drafted in the car.

Watch where they want to go. The interesting places are rarely where equipment would be installed. They should want to see the fire alarm panel and read its display and its event history. The head end, wherever it lives, which is frequently a closet nobody has opened in two years. Mechanical and electrical rooms. Above a ceiling tile or two. The roof, if there is anything on it.

They should also want to see the parts of the building that embarrass you. The door somebody props. The area nobody visits. The corridor where the cameras were never finished. A firm that only tours the good half of the building is being polite at your expense.

And they should talk to people who are not you. The person at the counter, the technician who knows which panel misbehaves, whoever unlocks the building at six. Those three know things the facilities director does not, and any assessor who has done this a while will go looking for them.

04 The questions that reveal expertise

You can learn more from what somebody asks than from what they tell you, because telling is rehearsed and asking is not.

Good questions are about operations rather than products. Who is in the building at six in the morning. What happens when somebody loses a badge. Who would you call at two on a Sunday, and would they answer. What did you do the last time something went wrong. Which of your current controls do people work around, and why. How does a contractor get in.

The best assessors do a specific thing with the answer to "what prompted the call": they keep asking why. A break-in becomes a question about how entry was made, which becomes a question about who else uses that door, which becomes a discovery that the door has been propped every night for a year because the credentialed route is inconvenient. That is three questions deep and it is where the actual finding lives.

Questions that should make you cautious are the ones that sort you rather than understand you. What is your budget, asked first. When does your current contract expire, asked early and with interest. And any question whose only purpose is to establish which product tier you belong in.

05 What should be in the document

You should receive a document, not a proposal. The distinction matters and it is visible on the first page.

A document describes your building. It says what is installed, what condition it is genuinely in, what the gaps are, and what your options are for each. It separates findings from recommendations, so you can disagree with a recommendation without discarding the finding underneath it. It contains photographs, because a photograph of your propped door is worth more than a paragraph about door discipline.

A proposal describes a solution. It leads with what you should buy, mentions your building as context, and its findings all happen to correspond to items on a price list.

The other thing to look for is whether anything in the document is inconvenient for the firm that wrote it. A finding that costs them a sale is the strongest evidence you will get that somebody was actually looking. In a well done assessment there is nearly always at least one, because buildings do not arrange their problems to suit a vendor's catalogue.

06 Priority order, and the honesty test

Everything should be ranked, because an unranked list of twenty findings is not advice. It is inventory. You are paying somebody for judgment, and judgment means saying which three things matter and which twelve do not.

A useful assessment sorts findings into something like: address now, plan for the next budget cycle, and monitor but do not spend on yet. That third category is the one that separates the serious from the rest, because it requires the author to leave money on the table in writing.

Which brings me to the single best test in this article. Does the assessment say that anything is fine?

Buildings are not uniformly bad. An assessment that finds every system deficient, every device past its life, and every control inadequate is describing a sales target rather than a building. Real buildings have a mix: something that was done well and still works, something that is adequate for another five years, and two or three things that are genuinely a problem. A document that reflects that mix was written by somebody looking. A document that condemns everything was written by somebody selling.

07 What it says about what you already own

Most buildings already have systems, and how an assessment treats them is revealing.

It should identify what is installed, who made it, roughly how old it is, and whether it is still supportable. That last point matters commercially. Equipment that is past manufacturer support, or that only one local firm can service, or that runs on a proprietary platform, constrains your options in ways that are worth knowing about before you spend anything further on it.

It should also be straight with you about lock-in, including the awkward version where the firm doing the assessment would be the beneficiary of it. If a recommendation moves you onto a platform only they support locally, that should be stated rather than discovered.

And where a recommendation is to replace something, there should be a reason attached that is about the equipment rather than about preference. "The panel would need replacing" is not a finding. "The panel is past manufacturer support, parts are no longer available, and the last two service events required salvaged components" is a finding. Ask which one you have been given.

08 The findings with no product attached

This is my favorite indicator and the easiest one to check. Count how many findings have nothing to sell behind them.

Real buildings are full of problems that no vendor profits from fixing. A door propped every evening for a reason nobody has addressed. A call list with two people on it who left in 2021. Nobody in the building knowing how to export footage. Inspection records held by a contractor rather than by you. A panel showing a trouble condition that everybody has stopped seeing. Keys held by people nobody has a record of.

Every one of those is a genuine finding, several are more consequential than the equipment questions, and not one of them generates an invoice. Which is precisely why an assessment conducted through a catalogue will not contain them. The lens determines what is visible, and a product lens does not resolve procedural problems at all.

So count them. If a document about a building that has been in use for fifteen years contains no findings about process, records, or people, that is not because the building has none. It is because nobody was looking for them.

09 Costs, phasing, and next year

An assessment is not a quotation and should not pretend to be one, but a document with no numbers in it at all is not much use for planning either.

What you want is order of magnitude. Enough to know whether an item is a few thousand dollars or a few hundred thousand, so that you can sort it against everything else competing for the same budget. Precision comes later, from a specification and a bid, and anybody offering firm pricing off a walkthrough is either guessing or building in the margin for having guessed.

You also want phasing that fits how your organization actually spends. Most buildings cannot do everything in one year and should not try. A useful assessment proposes a sequence, explains why that order and not another, and identifies what genuinely has to be first because other things depend on it.

And it should separate what is capital from what is operating, because in most organizations those are different conversations, different approvals, and sometimes different fiscal years. An assessment that produces one large number has made your job harder rather than easier.

10 What to do with it afterward

Keep it, because it is the most complete description of your building's systems that anybody has produced, and in three years when somebody asks why a decision was made, it will be the only record of the reasoning.

Use it as the basis for competitive bidding. A good assessment contains enough detail to write a specification from, and a specification is what lets you compare quotes that are actually comparable rather than three documents describing three different projects. If you are a public body this is not optional anyway, and if you are not, it is still how you find out what things cost.

Which produces the last and best test in this article, and it is one question you can ask out loud at the end of the walkthrough.

"If I use this assessment to get three competitive quotes, including from your competitors, is that all right with you?"

The answer tells you nearly everything. A firm confident in its work says yes without hesitating, because they expect to win on the quality of what they proposed and they would rather you bought the right thing from somebody than the wrong thing from them. A firm that hesitates, or explains why their approach cannot really be compared, or suggests the assessment is proprietary, has just told you what the document was for.

I ask my own people to answer that question with a straight yes. It is a reasonable thing for you to expect from anybody.

Twenty signals, and you can check most of them during the visit rather than afterward. The assessment is free either way. What it costs you is a day and the possibility of spending next year's budget on the wrong thing, and those are worth protecting.