The Cost of Not Knowing.
Security exposure compounds when important conditions remain unseen, unowned, or unresolved.
Document
KB-002
Version
1.0
Reviewed
Reading time
5 min read
Author
Garrit Hunt
Executive summary
Security exposure often grows quietly: a condition goes unseen, recognition is delayed, ownership is unclear, and operations continue around an unresolved issue. This brief explains the resulting decision debt and provides a closed-loop method for turning signals into verified correction, durable records, and better leadership decisions. The goal is disciplined awareness rather than more alarms, reports, or unsupported claims of certainty.
Some security problems are dramatic and immediately visible. Many are not. They begin as ordinary conditions: a camera stops recording, a door is routinely propped open, a credential remains active, an alarm test is missed, a procedure becomes outdated, or a corrective action remains open.
Any one condition may appear manageable. The deeper risk is that the organization does not recognize the condition, does not understand its significance, or cannot prove that it was resolved. Exposure grows in the space between what is happening and what leadership knows.
That is the cost of not knowing.
Hidden conditions create decision debt
The cost is not limited to money, and it should not be reduced to a fabricated estimate. It can appear as lost time, weak evidence, inconsistent response, employee confusion, operational interruption, preventable escalation, or leadership making a decision from an incomplete picture.
The longer a material condition remains unseen or unowned, the more decisions are made around it. Work continues. Assumptions harden. Other controls compensate informally. Documentation falls behind reality. When the issue finally becomes visible, the organization may have to reconstruct not only what failed, but how long the failure existed and what depended on it.
This is decision debt: unresolved uncertainty that makes every later decision harder.
The exposure chain
VSG frames the problem as a five-stage chain.
1. Unseen signal
A condition exists, but the organization does not detect it or does not capture it in a usable form. The signal may be technical, procedural, behavioral, or environmental. It may already be available in a system, but buried in noise or disconnected from an accountable workflow.
2. Delayed recognition
Someone notices the condition, but its significance is unclear. The information lacks context, history, thresholds, or comparison. A recurring failure looks like an isolated event. A warning is treated as routine because no one can see the pattern.
3. Delayed decision
The issue is known, but ownership or authority is uncertain. Teams wait for clarification, assume someone else is handling it, or discuss the problem without creating a decision record. Time passes without a defined risk acceptance, corrective action, or escalation.
4. Compounding exposure
Operations continue around the unresolved condition. The organization may rely on a control that is not functioning, produce records that no longer reflect reality, or normalize a workaround that was meant to be temporary. The original issue becomes connected to other vulnerabilities.
5. Correction loop
The chain is broken only when the condition is verified, assigned, corrected, tested, documented, and reviewed for lessons. Closure is not “we discussed it” or “a work order was opened.” Closure requires evidence that the condition changed and that the change remains effective.
Why more data is not enough
A larger dashboard does not automatically improve awareness. More alerts can create more noise. More reports can produce more unreviewed material. Visibility becomes operationally useful only when the organization defines what matters, who owns it, when it must be escalated, and what proof is required to close it.
The objective is not universal surveillance or constant alarm. It is disciplined awareness: the right condition reaching the right person with enough context to support a proportionate decision.
What strong practice looks like
Strong practice connects observation to verification, ownership, action, closure, and learning. It maintains a current inventory of critical controls and known exceptions. It records why decisions were made. It distinguishes temporary workarounds from accepted operating conditions. It reviews repeated issues across time instead of treating each event as unrelated.
This creates institutional memory. The organization becomes less dependent on one employee remembering what happened, one vendor knowing how a system was configured, or one manager recognizing that the same problem has returned.
Five actions to take now
Inventory the signals that matter. Identify the conditions that could materially affect life safety, access, evidence, continuity, or response readiness.
Define acceptance and escalation thresholds. Decide what is normal, what requires verification, and what must be elevated immediately.
Give every material issue one accountable owner. Collaboration may involve many people, but responsibility for the next decision should be unambiguous.
Require evidence of closure. Use test results, photographs, system records, completed training, revised procedures, or other appropriate proof—not verbal assurance alone.
Review repeat conditions. Recurrence may indicate that the correction addressed a symptom rather than the operating system that produced it.
Related reading
From this brief
“An unknown that has no owner is not being managed.”
Field observation
Teams often know many individual facts about their security environment while lacking a reliable picture of how those facts connect. The offline camera, open maintenance item, outdated procedure, and recurring access exception may be known separately. The risk emerges when nobody sees their cumulative pattern.
Nexus insight
VSG Nexus is intended to help preserve those connections: observations, decisions, evidence, corrective actions, and review history. With human oversight, that continuity can reduce the chance that important conditions disappear between systems, vendors, meetings, or personnel changes. Nexus supports the decision process; accountable people still determine what action is appropriate.
Full-reading infographic
Primary sources
Source ID | Source | Use in this brief |
|---|---|---|
VSG-BATCH01-KB002 | VSG-authored doctrine | Defines decision debt and the five-stage exposure chain. No financial estimate or probability is asserted. |
NIST-CSWP-29 | Governance and Identify, Detect, Respond, and Recover concepts; used as contextual guidance only. | |
NIST-SP-800-55V1 | NIST SP 800-55 Vol. 1 (2024) | Measure selection, assessment, prioritization, and improvement. |
NIST-SP-800-55V2 | NIST SP 800-55 Vol. 2 (2024) | Measurement-program roles, communication, and data-management context. |
NIST-SP-800-61R3 | NIST SP 800-61 Rev. 3 (2025) | Incident-response preparation, detection, response, recovery, and improvement. |
GAO-25-107721 | General management-responsibility, control-activity, and monitoring concepts; not presented as governing VSG clients. |
Document KB-002
Version 1.0
Tags · Security Visibility, Decision Debt, Corrective Action, Operational Intelligence, Institutional Memory, VSG Nexus
Written by
Garrit Hunt
Founder & COO, Veterans Security Group
Garrit Hunt founded Veterans Security Group, a veteran-led security, intelligence, and technology company based in Oregon. He has worked in private security since 2011 across armed and executive protection, cannabis security, surveillance, and high-risk environments, and served in the U.S. Air Force as a RED HORSE fire department rescue technician. The VSG Field Manual is the doctrine behind VSG’s managed security leadership and the Nexus platform.
Related briefs
Continue in the Field Manual
KB-001
Doctrine
Security Isn’t a Product. It’s an Operating System.
Security products become dependable only when people, procedures, technology, intelligence, review, and response operate as one managed system. This brief explains why isolated controls create hidden gaps, what the six connected disciplines require, and how leaders can build a repeatable security rhythm without adding unnecessary complexity. It also gives managers a practical starting point for assigning ownership, testing controls, and closing the loop after incidents.
5 min read
KB-004
Operations
The Security Decision Pipeline
The VSG Decision Pipeline converts a relevant observation into context, priority, authority, action, verification, and organizational learning.
4 min read
KB-008
Operations
Incident Response for Oregon Cannabis Operators
Incident response connects immediate safety, authorized command, evidence preservation, precise reporting, recovery, and verified corrective action.
5 min read
Apply this doctrine
Need this applied to your facility?
VSG delivers managed security leadership, assessments, procedures, and the Nexus platform to Oregon cannabis operators and other regulated businesses.