Security's Biggest Blind Spot Is Between the Silos
Key Highlights
- Modern threats rarely stay within physical, cyber or human domains, creating risks that exploit the gaps between traditional security disciplines.
- Organizations often train for procedures, but resilience depends on how people actually respond under stress, uncertainty, and rapidly changing conditions.
- As AI-powered deception and blended threats become more common, security leaders must rethink preparedness, recovery and cross-functional collaboration.
For too long, security planning has rested on a reassuring fiction — that threats come from one direction. A perimeter, an entryway, a network, a display. Even now, most people and organizations I encounter think in straight lines, train in straight lines, and fully expect threats to do the same: to play by the rules and stay within familiar security boundaries. But the reality confronting organizations today, particularly those responsible for public spaces, entertainment venues, campuses, and large-scale events, is far messier.
The modern threat environment doesn’t respect traditional boundaries between physical security, cyber defense, or human behavior. It is multi-dimensional; it moves laterally. It exploits confusion and, increasingly, it uses artificial intelligence not as a futuristic weapon, but as an accelerant of human error.
The security perimeter is no longer a place; it’s a state of mind.
This article begins a five-part series exploring how physical security, crisis psychology, gaming-based preparedness, and emerging cyber/AI threats are now inseparable. If we continue treating them as separate disciplines, we will keep training people for the last crisis, not the next one. And right now — trust me — “threat” is one step ahead!
Most security programs are well-intentioned but deeply siloed, and this is a blind spot we keep ignoring.
Physical security teams focus on access control, patrols, cameras, behavioral oddities, and response protocols. Cyber teams monitor networks, credentials, and ‘glitches’ (physical anomalies). Leadership teams prepare messaging and continuity plans. Frontline staff receive “training” that often feels procedural and very, very forgettable. From the front lines to the C-Suite and above, each group believes someone else is handling the part they don’t see.
The problem is that real-world incidents don’t arrive in silos.
A cyber breach can trigger a physical evacuation, and a social engineering attack can bypass a locked door. A panic response can turn a manageable incident into a cascading failure — and often does.
When stress hits, people don’t rise to the level of their training; they fall to the level of their habits, assumptions, and emotional conditioning. The acute stress response isn’t behavioral; it’s biological! That’s not a failure of character, it’s human psychology.
The psychological factors behind crisis response
Every incident, whether a data breach, an active threat, an infrastructure failure, or a coordinated disruption, unfolds first in the human nervous system. Before procedures, before checklists, before messages on the screen or caution lights flash in command centers; fear, confusion, tunnel vision, and social signaling all activate faster than anything you “think” you’re going to do, or as dictated by procedure in some policy manual you barely read.
Under stress, people revert to what feels familiar. Authority becomes ambiguous, communication fragments, and small decisions compound rapidly.
This is why purely procedural security training fails — almost every single time! It assumes rational actors operating with perfect information under controlled conditions. That assumption collapses the moment uncertainty enters the room.
Effective security planning must acknowledge a hard truth. The most vulnerable system in any organization is the human one. But vulnerability is not weakness. When understood and trained correctly, vulnerability becomes resilience. Vulnerability becomes a strength.
Moving beyond training to behavioral conditioning
Traditional security training often answers the wrong question. It asks: “Do employees know what they’re supposed to do?”
What it should ask is: “What will employees actually do when adrenaline floods the system?” This is where game-based scenarios become indispensable.
Not gamification for engagement points or badges, but serious, immersive scenario design that puts staff in a state of uncertainty. Conflicting information, time pressure, ambiguous authority, emotional contagion, and incomplete visibility. Scenarios that allow organizations to safely rehearse failure.
Immersive scenarios surface hidden assumptions and reveal inner truths – truths that don’t announce themselves politely in moments when people discover not who they think they are, but who they become under pressure. Truths that aren’t always easy to sit with. Who waits for permission? Who takes initiative? Who freezes? Who communicates clearly — and who goes silent?
More importantly, immersive scenarios create muscle memory for recovery, not just response. Because the aftermath of an incident — reentry, trust repair, emotional processing, and operational normalization — is where even the most robust organizations often stumble hardest.
Crisis Management isn’t just about controlling the emergency event; it’s about how people come back together afterward. And this is often the more challenging road to prepare for.
When cyber threats become physical threats
One of the most dangerous misconceptions in security today is that cyber incidents are “non-physical.” That era is over.
Cybercrime increasingly manipulates physical access systems, targets operational technology, exploits insider trust, and triggers real-world disruption – disruption to our regular routine, disruption that takes us way outside our habitual, daily comfort zone. Add AI to the mix, and the threat landscape changes again.
AI enables highly convincing phishing and impersonation, automated reconnaissance of human behavior, adaptive social engineering at scale, deepfake audio and video used in real-time decision manipulation.
These threats don’t require breaking in — they simply require being believed. And belief is a psychological vector, not a technical one!
Impersonation has moved beyond hijacking a corporate leader’s email address. An employee who receives a convincing AI-generated call from “leadership” during a moment of stress doesn’t experience it as a cyber event. They experience it as a social interaction under pressure.
That’s the intersection point we can’t afford to ignore.
Why security gaps create opportunity for attackers
The most dangerous threats are rarely the ones we’ve named. They live in the gaps. The gaps between cyber and physical teams, between leadership and frontline staff, between policy and practice, between preparation and recovery. AI doesn’t just introduce new attack methods; it exposes how fragmented our defensive thinking still is.
We’ve become very good at optimizing individual systems, but we remain far less skilled at preparing people to navigate complex, blended crises.
Security leaders must begin asking different questions. Questions like, “Where do our assumptions break under stress? How does authority shift in a real incident? What signals do attackers exploit in human behavior? How do we train for recovery — not just response?”
These questions don’t belong to one department. They require collaboration across security, psychology, training, and technology.
Why this series — and why now?
This five-part series is built around a simple premise. The future of security is interdisciplinary, psychologically informed, and scenario-driven.
Over the coming weeks, we’ll explore:
- The new perimeter (this article): where physical, cyber, and human systems converge
- The psychology of crisis behavior: what people actually do under stress
- Scenario-based training: how gaming prepares staff before and after incidents
- AI and undiscovered threats: how emerging technologies exploit trust and ambiguity
- Integrated resilience: building security cultures that adapt, recover, and evolve
This isn’t about fearmongering or futurism. This is about reality — the threats as they exist, not as we wish they were.
We’ll explore the question, “What actually happens when systems, people, and assumptions collide?” And acknowledge the facts on the ground, not comforting narratives.
Organizations that thrive in the next decade won’t be the ones with the most technology. They’ll be the ones who understand how humans behave when systems fail, and who intentionally prepare for that reality.
A final thought
Security has always been about protection, about providing a safe space, both physically and psychologically, for our friends, family, our guests, visitors, and employees to exist in. But protection without understanding human behavior is incomplete.
As threats become more blended, more adaptive, and more psychologically sophisticated, our response must evolve. Not by adding more rules, but by building better judgment, shared awareness, and practiced resilience.
The perimeter is no longer something we guard. It’s something we train for across departments, across disciplines — together.
Editor’s Note: SecurityInfoWatch is republishing a five-part series by Dr. Frazer G. Thompson with permission from the author. Originally published on his Substack, the series examines how physical security, cybersecurity, crisis psychology, and artificial intelligence are reshaping organizational preparedness and resilience.
About the Author
Frazer Thompson
Vice President of Operations at PIER 39
Dr. Frazer G. Thompson is Vice President of Operations at PIER 39 in San Francisco, where he oversees operational readiness and security integration for a public-facing destination that welcomes more than 11 million visitors annually. A senior attractions operations executive and crisis consultant, he has nearly 30 years of experience in high-pressure environments, including leadership roles with Disney and Universal Studios. His work focuses on crisis management, human behavior, resilience, and decision-making under stress. Thompson has contributed to Joint Counterterrorism Assessment Team (JCAT) publications and is the author of "Edge of Calm: Leadership and Crowd Psychology During a Crisis."