It is entirely possible to install a state-of-the-art detection and access control system, staff it with a fully trained response force, and still end up with a facility that is not secure — because the people operating that system, day after day, have quietly stopped believing it matters.
This is the problem security culture exists to address. The concept — formalised for the nuclear sector in IAEA Nuclear Security Series guidance (NSS-7) but applicable to any high-consequence facility — describes the shared attitudes, beliefs, and behaviours of an organisation's personnel regarding the protection of the assets they are responsible for.
Why Technology Alone Isn't Enough
A physical protection system is designed by engineers and security specialists, but it is operated by ordinary employees: guards who decide whether an unfamiliar face gets a second look, operators who decide whether to report a door propped open "just for a minute," and managers who decide whether a security recommendation gets funded or quietly shelved.
Every one of those decisions is a culture decision, not a technology decision. A perimeter intrusion detection system generates an alarm regardless of culture — but whether that alarm gets a fast, serious response, or gets waved off as "probably another false alarm," depends entirely on the culture of the team monitoring it.
What Strong Security Culture Looks Like in Practice
- Visible leadership commitment. Security is discussed and resourced as an organisational priority, not delegated entirely to a security department and forgotten elsewhere.
- Personal accountability. Every employee — not just security staff — understands their individual role in protecting the facility's assets.
- A questioning attitude. Personnel are encouraged, and feel safe, to report anomalies and near-misses without fear of blame, so small issues surface before they become large ones.
- Continuous reinforcement. Security expectations are refreshed through training and communication on an ongoing basis, not delivered once during onboarding and never revisited.
Assessing Culture Is Different From Assessing Systems
Vulnerability assessments are good at answering "can this system detect and delay this adversary?" They are not designed to answer "will the people operating this system actually respond the way the design assumes?" That requires a separate, deliberate look at culture — through interviews, observation, and review of how past anomalies were actually handled, not just how the procedures say they should be handled.
Organisations that skip this step often discover the gap only after an incident — when it becomes clear that the technology performed exactly as designed, but the human response did not.
Cameras detect. Barriers delay. Only people respond — and culture determines whether they respond the way the system assumes they will.
GTS incorporates security culture assessment into our nuclear security advisory and vulnerability assessment engagements, because a program is only as strong as its weakest assumption — and the assumption that people will always do the right thing is rarely tested until it's too late.