North Star Group

11/01/2026

School safety and security does not begin when first responders arrive on campus.

It begins long before the emergency.

This article makes an important point: effective school safety depends on the relationships, communication systems, plans, and coordination schools establish with their surrounding community before something happens.

The author highlights three fundamentals:
- Speed.
- Clarity.
- Coordination.

In a school emergency, seconds matter.

Teachers and staff may be trying to communicate what is happening.

911 dispatchers are gathering critical information.

Administrators are attempting to understand the situation.

Law enforcement, fire, and EMS are already making decisions based on whatever information they have available.

Any unnecessary delay or information gap can affect the response.

That is why school safety planning should extend beyond the walls of the campus.

Schools should be working directly with:
- Law enforcement.
- Fire departments.
- EMS.
- 911 and emergency communications centers.
- School resource officers.
- Emergency management.
- Mental health and behavioral threat assessment partners.
- Parents and community stakeholders.

School safety plans should also include accurate campus maps, clearly identified access points, emergency routes, communication procedures, and information that responders can use immediately.

But those plans cannot simply sit in a binder.

They need to be shared, reviewed, exercised, and updated.

Joint training and exercises allow school personnel and first responders to identify gaps before an actual incident exposes them.

They also create familiarity.

Responders learn the campus.

School personnel learn how public safety agencies operate.

Dispatchers understand what information is available.

And everyone gains a clearer understanding of roles, responsibilities, and expectations.

Situational awareness is also a shared responsibility.

A teacher may see one piece of information.

A student may report another.

A school resource officer may have additional context.

A dispatcher or responding officer may have yet another piece.

Effective school safety depends on getting the right information to the right people at the right time.

Technology can support that process.

Emergency notification systems, digital mapping, access control, cameras, radios, panic alarms, and other tools can improve response.

But technology cannot replace relationships, planning, training, and coordination.

The strongest school safety programs are not built around a single product or a single department.

They are built around a community working together to protect students and staff.

We cannot predict every emergency.

But we can prepare together before one occurs.

https://www.eschoolnews.com/educational-leadership/2026/10/30/school-safety-depends-on-strong-community-partnerships/

Follow us on X
Subscribe on Substack

A former first responder’s insights shed light on improving school safety and response times when seconds matter.

10/31/2026

Halloween is supposed to be fun.

But FEMA used the occasion this year to remind Americans of something that applies far beyond October 31: Have an emergency plan.

That means knowing how you will communicate with family members, where you will meet if you become separated, how you will receive alerts and warnings, what supplies you may need, and what you will do if normal routines are suddenly disrupted.

Preparedness is not about expecting something bad to happen.

It is about being ready if it does.

That applies to families, businesses, schools, houses of worship, special events, and communities.

Situational awareness is also especially important on Halloween.

More people are outside after dark.

Children are moving between homes and neighborhoods.

Traffic patterns change.

Costumes can reduce visibility.

Crowds may form around events and entertainment districts.

And emergency responders may be dealing with a higher volume of calls.

A few simple precautions can make a difference:

Know where family members are going.

Have a communication and reunification plan.

Keep phones charged.

Pay attention to local alerts.

Use well-lit routes.

Be alert around traffic.

Know where emergency exits are at parties, events, or public venues.

And if something does not look or feel right, take it seriously and move to a safer location.

The same principle applies to organizations.

Emergency plans should account for communications, evacuation, sheltering, reunification, medical response, severe weather, power outages, security incidents, and other disruptions.

A plan is most useful when people actually know what it says and have practiced what to do.

North Star Group wishes everyone a happy, fun, and safe Halloween.

Enjoy the evening—but stay aware, have a plan, and look out for one another.

https://thenationaldesk.com/news/americas-news-now/fema-encourages-americans-to-have-an-emergency-plan-in-halloween-post-dan-bongino-united-kingdom-russia

Follow us on X
Subscribe on Substack

The Federal Emergency Management Agency (FEMA) told Americans on Friday to make an emergency plan in a Halloween post.

10/30/2026

🚨 DRONE SECURITY: WHAT CAN ORGANIZATIONS LEGALLY DO?

An unidentified drone appears over your facility.

Is it a security threat? Is it operating illegally? Can your security team do anything to stop it?

As drone technology becomes more accessible, organizations face an increasingly complex security challenge: **detecting a drone is not the same as identifying a threat—and identifying a threat does not automatically authorize neutralizing it.**

In this week's North Star Security Brief, we examine:

🔹 The evolving security concerns associated with drones
🔹 The difference between drone detection and threat identification
🔹 The capabilities and limitations of counter-UAS technology
🔹 Federal legal restrictions on disrupting or disabling aircraft
🔹 Practical steps organizations can take to prepare and respond

From critical infrastructure and commercial facilities to public venues and industrial operations, understanding the capabilities, risks, and legal boundaries of counter-drone security is increasingly important.

Effective security isn't simply about stopping a potential threat. It's about making informed, lawful, and proportionate decisions.

📖 Read the full article: https://open.substack.com/pub/northstarsecuritybrief/p/counter-drone-security-what-can-organizations?r=7ruj9z&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

🔔 Subscribe to North Star Security Brief for practical insights on security management, protective intelligence, emerging threats, and organizational preparedness.

10/30/2026

Luxury hotel security has a difficult mission:

Protect people, property, information, and operations without making the guest experience feel restrictive or intrusive.

That balance is becoming increasingly important as hotels adopt more technology, including mobile credentials, cloud-managed video, AI-assisted surveillance, and increasingly integrated access-control systems.

But technology alone does not make a hotel secure.

Effective hotel security still depends on layered protection, trained personnel, sound procedures, and thoughtful design.

The lobby, parking garage, elevators, guest floors, loading docks, back-of-house spaces, administrative offices, kitchens, server rooms, and other operational areas all present different risks.

Access control should reflect those differences.

Guests should be able to move easily through the areas they are authorized to use, while employee access should be limited by role, location, and operational need.

Surveillance should provide useful visibility without creating unnecessary security theater.

AI can help security teams search large volumes of video and identify relevant events more efficiently, but technology should support trained human decision-making—not replace it.

Parking areas also deserve particular attention.

Lighting, pedestrian routes, stairwells, elevators, vehicle access, camera placement, and natural surveillance all influence both actual security and a guest’s perception of safety.

That is where CPTED principles can play an important role.

Privacy is another critical consideration.

Hotels have legitimate reasons to monitor entrances, corridors, parking areas, reception spaces, and other common areas.

But guestrooms, changing rooms, spa areas, and other locations where guests reasonably expect privacy require very different safeguards.

The same principle applies to digital information.

More security technology means more responsibility to control access, protect accounts, establish retention policies, and ensure systems are being used for legitimate purposes.

And perhaps most importantly, hotels need effective incident-response procedures.

Cameras may document what happened, but they do not manage medical emergencies, fires, unauthorized access, disruptive guests, missing children, severe weather, active threats, or other emergencies.

That requires trained personnel, clear responsibilities, communications, emergency planning, and coordination.

Luxury hospitality is built around making the experience feel effortless.

Security should support that experience rather than compete with it.

The strongest hotel security programs are often the ones guests hardly notice—but can rely on when something goes wrong.

https://www.traveldailynews.com/column/featured-articles/luxury-hotel-security-guest-experience/

Follow us on X
Subscribe on Substack

Discover how luxury hotel security combines AI surveillance, smart access, guest privacy and discreet protection.

10/29/2026

One of the most important lessons in active-shooter and targeted-violence prevention is that recognizing a warning sign is only the beginning.

The harder question is:

What happens after someone reports it?

This Homeland Security Today article examines the 2023 Lewiston, Maine, mass shooting and what the subsequent investigation revealed about the gap between recognizing concerning behavior and taking meaningful action.

The article cites research showing that concerning behaviors are frequently noticed before attacks.

But warning signs alone do not predict violence, and most people who exhibit concerning behavior will never commit an act of targeted violence.

That is exactly why organizations need a structured process.

A report should lead to assessment—not assumptions.

Effective threat assessment requires the right people, the right information, clear ownership, defined authorities, documentation, and follow-through.

A warning can fail when:

Information remains trapped in organizational silos.

No one is clearly responsible for managing the concern.

Critical information is never gathered or shared.

A case is closed without adequate review.

Or action is initiated but never followed through.

Those are not simply communication failures.

They are security and risk-management failures.

Behavioral Threat Assessment and Management, protective intelligence, OSINT, physical security, emergency management, HR, legal, mental health resources, law enforcement, and organizational leadership can all contribute pieces of the overall picture.

The challenge is connecting those pieces before a situation escalates.

Organizations should be asking:

Do employees know what concerning behavior should be reported?

Do they know where to report it?

Who owns the concern once it arrives?

Who assesses it?

What information can they access?

Who decides whether intervention is necessary?

Who verifies that the action actually occurred?

And who reviews the decision before a case is closed?

Active-shooter preparedness remains important.

But prevention begins long before emergency response.

Recognition is where prevention starts.

Assessment, information sharing, intervention, and follow-through are what move it forward.

https://www.hstoday.us/subject-matter-areas/terrorism-prevention/closing-the-gap-between-recognizing-threat-warnings-and-taking-action/

Follow us on X
Subscribe on Substack

On the morning of September 15, 2023, an Army Reservist sent a text message to his unit leaders about a friend and fellow soldier. He wrote that he believed the man was “going to snap and do a mass shooting.”

10/29/2026

Two major new resources on workplace violence prevention were released within days of each other by the U.S. Secret Service and ASIS International.

The U.S. Secret Service National Threat Assessment Center released new guidance on preventing targeted workplace violence through Behavioral Threat Assessment and Management.

ASIS International also released a revised version of its Workplace Violence and Active Assailant—Prevention, Intervention, and Response Standard.

Together, they reinforce an important point:

Workplace violence prevention cannot be reduced to active shooter response training.

It begins much earlier.

The Secret Service framework emphasizes eight areas, including leadership commitment, establishing BTAM policies and procedures, multidisciplinary threat assessment teams, reporting concerning behavior, gathering and assessing information, developing risk-management strategies, promoting a safe organizational climate, and training employees.

The ASIS standard complements that framework by providing organizations with a more detailed structure for developing and managing workplace violence prevention and intervention programs.

One of the strongest themes across both resources is the need for multidisciplinary Behavioral Threat Assessment and Management.

Security cannot do this alone.

HR cannot do this alone.

Legal cannot do this alone.

Effective threat assessment often requires security, human resources, legal counsel, management, mental health professionals, emergency management, business continuity, law enforcement, communications, and other stakeholders to share information and evaluate behavior in context.

Reporting is equally important.

Employees need multiple ways to report behavior that concerns them—even when that behavior has not yet crossed the threshold of an explicit threat.

That information can become part of a broader protective intelligence picture.

OSINT can also support this process by identifying relevant publicly available information, online behavior, grievances, fixation, targeting activity, or other indicators that may help investigators better understand the totality of circumstances.

The goal is not to predict violence with certainty.

It is to identify concerning behavior, assess risk through a structured and repeatable process, intervene when appropriate, and manage risk before a situation escalates.

Physical security remains an important layer of protection, but access control, cameras, guards, lockdown procedures, and emergency response measures address only part of the problem.

The strongest workplace violence programs combine prevention, behavioral threat assessment, protective intelligence, reporting, intervention, physical security, emergency planning, training, and recovery.

The release of these two resources sends a clear message:

Workplace violence prevention should be treated as an organizational risk-management responsibility—not simply a security-department function.

https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/october/secret-service-asis-standard-workplace-violence/

Follow us on X
Subscribe on Substack

The U.S. Secret Service released a detailed report on preventing workplace violence, and ASIS published a newly revised standard on workplace violence prevention. Both resources provide security professionals with ideas, guidance, and practices they can use to prevent violence in their organizations...

10/28/2026

The line between cyber threats and physical security threats is disappearing.

A cyberattack can disrupt access control, communications, transportation, utilities, healthcare, schools, manufacturing, or critical infrastructure.

A physical intrusion can provide direct access to digital systems and sensitive information.

Social engineering can begin online and end with someone physically entering a facility.

And attacks against operational technology can turn a network compromise into a real-world safety emergency.

That is the point made in this Homeland Security Today article: when threats cross cyber-physical boundaries, crisis response has to cross those boundaries too.

Organizations cannot continue treating cybersecurity, physical security, emergency management, intelligence, legal, communications, HR, and executive leadership as completely separate functions during a crisis.

Modern threats exploit the gaps between those functions.

The article highlights three important areas organizations should be thinking about:

Integrated governance.

Cross-functional tabletop exercises.

Disciplined after-action reviews.

Those are not just cybersecurity issues.

They are enterprise security and resilience issues.

Tabletop exercises should not only test a ransomware scenario with the IT department or an active threat scenario with security.

Real incidents can involve cyber disruption, physical security failures, social engineering, misinformation, executive decision-making, legal exposure, communications challenges, and operational disruption at the same time.

The exercise should reflect that reality.

The same applies to intelligence.

OSINT, threat intelligence, protective intelligence, cyber intelligence, and physical security reporting all contribute pieces of the same operating picture.

If those pieces remain isolated in different departments, important warning indicators can be missed.

Security convergence does not mean eliminating specialized expertise.

It means recognizing that the threat environment is interconnected and ensuring those specialties can communicate, coordinate, and respond together.

The walls between cyber and physical security are disappearing.

Our planning, intelligence sharing, exercises, and crisis-response structures should reflect that reality.

https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-when-threats-cross-cyber-physical-boundaries-crisis-response-must-too/

Follow us on X
Subscribe on Substack

My career has largely been shaped by two disciplines: counterterrorism and cyber operations. For years, those worlds appeared distinct, but today, the line separating physical threats from cyber risk has largely disappeared.

10/28/2026

🚗 Parking lot security involves more than cameras and lighting.

Parking lots and garages are often evaluated based on the presence of surveillance equipment and illumination. But what about pedestrian pathways, obstructed sightlines, stairwells, access points, and environmental design?

These conditions can influence how effectively a parking facility supports the safety and security of its users.

In our latest North Star Security Brief, we examine parking lot security through the principles of Crime Prevention Through Environmental Design (CPTED).

From natural surveillance to access control and maintenance, a comprehensive assessment should consider how the entire environment functions.

We also discuss how structured assessment tools such as CPTED Advisor™ can support consistent evaluations and professional reporting.

📖 Read the full article: https://open.substack.com/pub/northstarsecuritybrief/p/parking-lot-security-what-cpted-reveals?r=7ruj9z&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Explore CPTED Advisor™: https://www.northstar-group.org/cpted-advisor

10/27/2026

One of the most important findings in the U.S. Secret Service National Threat Assessment Center’s latest workplace violence research is also one of the most actionable:

In 82% of the 50 workplace attacks studied, someone had already become concerned about the attacker before the violence occurred.

That should get the attention of every organization.

Workplace violence prevention is not primarily about trying to predict who will become violent. There is no reliable demographic profile of an attacker.

It is about recognizing concerning behavior, understanding context, encouraging reporting, and having a process capable of assessing and managing that information before circumstances escalate.

The Secret Service found that 95% of the attackers studied were motivated by a grievance. In many cases, concerning communications or behavior were visible to coworkers, family members, friends, managers, or others before the attack.

Those observations are pieces of intelligence.

A threatening statement.

A fixation on a grievance.

Stalking or harassment.

Increasing aggression.

Concerning online activity.

Domestic violence that may follow an employee into the workplace.

Significant behavioral changes combined with other warning indicators.

Individually, those pieces may not establish that someone poses a threat.

Together, they may create a very different picture.

That is why effective workplace violence prevention requires more than physical security measures.

Organizations need a multidisciplinary Behavioral Threat Assessment and Management program capable of bringing together information from security, human resources, management, legal, mental health professionals, law enforcement, and other appropriate stakeholders.

Protective intelligence and OSINT can also help identify relevant publicly available information, threatening communications, fixation, targeting behavior, or other indicators that may otherwise remain disconnected.

Physical security still matters. Access control, visitor management, emergency communications, duress systems, lockdown procedures, and response planning can help mitigate consequences if prevention fails.

But the opportunity to prevent an attack often occurs much earlier.

The challenge is creating an organizational culture where employees recognize concerning behavior, know how to report it, trust that their concerns will be taken seriously, and where trained personnel know what to do with that information once it is received.

The warning sign that matters most may not be the one everyone recognizes.

It may be the one several people noticed independently but no one ever connected.

https://www.inc.com/bruce-crumley/the-secret-service-studied-50-workplace-attacks-in-82-percent-someone-saw-a-warning-sign/91425214

Follow us on X Subscribe on Substack

Workplace attacks often follow overlooked warnings. A new Secret Service guide identifies the behaviors companies should recognize and report.

10/27/2026

🔐 Your accounts can be secure while your personal information remains exposed online.

Strong passwords, multifactor authentication, and security updates help protect your accounts. But they don't necessarily prevent data brokers and people-search websites from displaying your address, phone number, or other personal details.

That's because data security and data privacy aren't the same thing.

In our latest North Star Security Brief, we explore the differences, why they matter for personal safety, and practical steps individuals can take to reduce unnecessary information exposure.

We're also preparing for the upcoming launch of North Star Group's Privacy Advisor™, a personal data-removal service designed to help individuals manage removal requests involving data brokers and people-search websites.

📖 Read the full article: https://open.substack.com/pub/northstarsecuritybrief/p/data-security-vs-data-privacy-why?r=7ruj9z&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true