Most manufacturers do not run one site. They run a network of them, each built in a different decade, secured piece by piece, and often inherited through acquisition. The real question a security leader has to answer is not whether a given plant is safe. It is which plant, out of thirty, is carrying the most risk right now, and whether the next dollar is going there or somewhere quieter that simply asked louder. Very few teams can answer that with evidence, and the reason is structural, not a failure of effort.
Why Comparing Plants Is the Problem, Not Assessing Them
Individual plant assessments are not the gap. Most manufacturers have plenty of them: binders from a partner provider, spreadsheets, guard post orders, insurance schedules. The gap is that each one was produced on its own terms. One plant was scored in 2021 against a five-point scale. Another opened with a modern access control stack and never got a formal review. A third came in through an acquisition with a guard contract nobody has read since the deal closed. Put them side by side and there is no common denominator. Everything reads as medium.
When the CFO asks why the next investment goes to the plant in one region rather than another, judgment is the only answer available. That is not a confidence problem. It is a comparability problem, and it is the one thing a stack of separate assessments cannot solve, no matter how thorough each one is.
What the Misallocation Actually Costs
The cost of guessing is not abstract. Business interruption ranks third in the Allianz Risk Barometer in 2026, and a security event is one of the ways a line stops. Siemens estimates that unplanned downtime costs Fortune Global 500 companies $1.4 trillion a year, roughly 11 percent of revenue, and that a single unproductive hour in automotive runs about $2.3 million.
Theft compounds it. The Association of Certified Fraud Examiners reports that asset misappropriation, the theft or misuse of company resources, is the most common form of occupational fraud, appearing in 90 percent of cases, and that occupational fraud overall carried a median loss of $104,000 per case. In a plant, that is raw materials, scrap streams, and finished goods moving through the same gates your people use, in schemes that run for years because each load looks routine. Neither of these losses is evenly distributed across your sites. That is exactly why comparing them matters: the exposure concentrates somewhere, and spreading budget evenly guarantees you overspend where it is quiet and underspend where it is not.
Spreading budget evenly guarantees you overspend where it is quiet and underspend where it is not.
Why the Problem Persists
This gap survives because the tooling underneath corporate security never caught up with the other risk functions. Cyber moved to dollar-denominated exposure a decade ago. Operational risk holds capital against quantified loss. Physical security, in most manufacturers, is still described on a rating scale that was never designed to be compared across sites. The assessment tells you a plant is high or medium, but high relative to what and medium next to which other plant is left unstated.
The result is that budget follows the loudest problem rather than the largest one. A break-in at one facility last quarter pulls spend toward that site. A plant manager with a strong relationship and a persuasive case gets the upgrade. Every decision is defensible in isolation, and the portfolio as a whole still drifts away from where the actual risk sits. You cannot allocate against a number you do not have.
You cannot allocate against a number you do not have.
What a Comparable Assessment Looks Like
The fix is not another round of deeper site reviews. It is putting every plant on one scale, so the output is a ranking rather than a stack of ratings. That means starting from a common baseline, the risk each plant would carry with nothing but doors, walls, and locks, then subtracting what its current controls actually prevent. What remains is the residual exposure at that site, expressed in the loss behind it: the production time a stopped line costs, the materials walking out the gate, the safety response an incident on the floor demands.
Built that way, the assessment answers the question that separate binders never could. Not is this plant secure, but which of our plants is carrying the most exposure, and what does moving a dollar there actually buy us. Every figure has to trace back to what drove it, because a number a CFO cannot interrogate is a number a CFO will not fund. This is the discipline Holtium calls Anticipate. Adapt. Secure., and its first move is to make exposure comparable before anyone argues about where the budget goes.
From a Drawer of Assessments to One Ranked View
Holtium is the risk operating system for corporate security: the platform your team runs its program on, with experts alongside you when you need them. It brings every plant's risks, controls, and spending into one place, quantifies the exposure that remains in dollars, and turns it into a roadmap you can assign, track, and defend. A corporate risk assessment stops being a drawer of PDFs and becomes a live ranking your security team can defend, quarter after quarter, as the footprint and the threats keep changing.
