--- title: Where Should You Spend First After a Physical Security Risk Assessment? description: After a physical security risk assessment, the first dollar goes to the largest remaining exposure in dollars, not the last incident. Here is how to rank it. image: https://holtium.com/hubfs/26.jpg --- [![Holtium](https://holtium.com/hubfs/Holtium_Logo-1.svg)](https://holtium.com) [PlatformPlatform](https://holtium.com/platform) Who it's forWho it's for IndustriesIndustries [PricingPricing](https://holtium.com/pricing) [ResourcesResources](https://holtium.com/resources) [Get a demo](https://holtium.com/get-a-demo) Who it's for [Enterprise For teams with a security leader and an established program to defend.](https://holtium.com/enterprise) [Mid-market For teams that carry security without a dedicated security function.](https://holtium.com/mid-market) [Startups For fast-growing companies building a security program for the first time.](https://holtium.com/startups) Industries [All industries](https://holtium.com/industries) [Financial services](https://holtium.com/industries/financial-services) [Healthcare](https://holtium.com/industries/healthcare) [Life sciences](https://holtium.com/industries/life-sciences) [Logistics](https://holtium.com/industries/logistics) [Manufacturing](https://holtium.com/industries/manufacturing) [Real estate](https://holtium.com/industries/real-estate) [Retail](https://holtium.com/industries/retail) [Technology](https://holtium.com/industries/technology) [Platform](https://holtium.com/platform) Who it's for [Enterprise](https://holtium.com/enterprise) [Mid-market](https://holtium.com/mid-market) [Startups](https://holtium.com/startups) Industries [All industries](https://holtium.com/industries) [Financial services](https://holtium.com/industries/financial-services) [Healthcare](https://holtium.com/industries/healthcare) [Life sciences](https://holtium.com/industries/life-sciences) [Logistics](https://holtium.com/industries/logistics) [Manufacturing](https://holtium.com/industries/manufacturing) [Real estate](https://holtium.com/industries/real-estate) [Retail](https://holtium.com/industries/retail) [Technology](https://holtium.com/industries/technology) [Pricing](https://holtium.com/pricing) [Resources](https://holtium.com/resources) [Get a demo](https://holtium.com/get-a-demo) ## The last incident tells you where you were unlucky, not where you are exposed. # Where Should You Spend First After a Physical Security Risk Assessment? November 3, 2026 Share [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://holtium.com/blog/physical-security-risk-assessment-spend-first) [envelope icon](mailto:?body=https://holtium.com/blog/physical-security-risk-assessment-spend-first) Spend first where your physical security risk assessment shows the largest remaining exposure, [measured in dollars](https://holtium.com/blog/enterprise-risk-management-physical-security), after crediting the controls already in place. It is usually one risk at one or two sites, and often not the risk that produced the last incident or the site that asks most often. The last incident tells you where you were unlucky, not where you are exposed. A ranked exposure tells you where the next dollar reduces the most risk, and it gives you the sentence you will need when finance asks why this and not that.   ## Why Does the First Dollar Usually Go to the Wrong Place? [Budget follows the loudest problem](https://holtium.com/blog/the-spending-trap-how-companies-spend-on-security-and-still-fall-short), not the one that reduces the most risk. Three habits make it so. The budget is built from last year's lines, so the guard contract and the camera maintenance renew before anyone asks what they protect. The most recent incident gets the next approval, because a break-in at the loading dock is easy to explain and a request to fix it is hard to refuse. A site leader who escalates every week gets attention that a quiet site with a larger exposure never asks for. None of these habits is careless. They persist because, without a common unit, the options cannot be compared. A guard post, an access upgrade and a training program are different things with different costs and different effects, and a rating from one to five does not say which of them buys the most protection per dollar. So the decision falls back on what is visible and recent. We have seen assessments written over two years ago cited in the current year's budget review, because nothing newer gave a clearer answer.   ## What Does a Ranked Exposure Show That an Incident Log Cannot? It shows the quiet losses. The Association of Certified Fraud Examiners studied 2,402 cases of occupational fraud for its [Occupational Fraud 2026 report](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/infographics/key-findings.pdf): asset misappropriation appeared in 90% of them, with a median loss of $100,000, and a typical case ran 12 months before anyone noticed. Nothing about a scheme like that triggers an alarm or shows up in an incident count. It appears when someone adds up what left the building, site by site. People risk follows the same pattern. The Ponemon Institute's [2026 Cost of Insider Risks Global Report](https://www.dtex.ai/newsroom/press-releases/insider-risk-costs-rise-as-ai-creates-new-blind-spots/), sponsored by DTEX, put the average annual cost of insider risk at $19.5 million across 354 organizations, and more than half of it, $10.3 million, came from negligence rather than intent. Exposure of that kind is spread across many small events, so no single one looks like a priority, and the total only shows up when someone adds it up. An incident log records what happened. A ranked exposure estimates what each risk costs you in a normal year, incident or not, and that is the number a budget should follow. ## A ranked exposure estimates what each risk costs you in a normal year, incident or not, and that is the number a budget should follow.   ## How Do You Choose Between Two Controls That Both Reduce Risk? Name the decision first: which risk, at which site, gets the next dollar. Then look at three things. What is at stake, which is rarely only money: the safety of people, continuity of operations, the insurance that depends on documented controls, the executives whose names are on the building. The options, meaning the controls or courses of action available, including doing nothing for now. And the context: how many sites, how fast the company is changing, which sites were added since the last review. ## Name the decision first: which risk, at which site, gets the next dollar.   Two tests settle most of these comparisons. First, credit follows the chain, not the purchase order. A control earns credit only where detection, delay and response close in time at that site. Buying more cameras does not reduce risk if nobody responds, so a camera upgrade at a site with no response arrangement may rank below a cheaper fix that completes the chain. Second, the first dollar is sometimes a dollar not spent. A control funded every year because it is familiar may be reducing little risk, and moving that money to the site where exposure concentrates can lower the total without raising the budget. Better decisions cut both over-exposure and over-spend.   ## What If the Assessment Only Gave You Ratings? Then it has done the first half of the job. It shows which risks the team considers most serious, and where to spend takes one more step. To rank two options you need to know how much risk each one removes for what it costs. A rating of "high" or "4 out of 5" is a label, not an amount, so it cannot be compared with a price. A physical security risk assessment done at this depth becomes the baseline that every later budget, control and board report is measured against. The difference is a dollar figure for each risk at each site, with the source logged behind it, credit given to the controls already running, and a range that narrows as the company's own data comes in. From that baseline, the question of where to spend first has an answer that can be read, challenged and revised. ## A rating of "high" or "4 out of 5" is a label, not an amount, so it cannot be compared with a price.   ## Where Does Holtium Fit? Holtium is an annual program. A security expert works with your team to build and maintain how security decisions get made, with the Holtium platform as part of the program, so each decision can be explained and defended afterward. Deciding where to spend next is one part of that: the budget follows the exposure that remains after your current controls are counted, and the case for each line is written down, including the lines that say do not spend. Once the first dollar has a destination, the next question is who should run this: a hire, outside help, or some of each. A physical security risk assessment that ranks exposure in dollars gives either of them the same starting point.   [Back to All Holtium Insights](https://holtium.com/blog) [Physical Security](https://holtium.com/blog/tag/physical-security), [Corporate Security](https://holtium.com/blog/tag/corporate-security), [Security Risk Assessment Services](https://holtium.com/blog/tag/security-risk-assessment-services), [Corporate Risk Assessment](https://holtium.com/blog/tag/corporate-risk-assessment) [![Holtium](https://holtium.com/hubfs/Holtium_Logo_White-3.png)](https://holtium.com/) The risk operating system for corporate security. Platform [Platform](https://holtium.com/platform) [Pricing](https://holtium.com/pricing) [Resources](https://holtium.com/resources) Who it's for [Enterprise](https://holtium.com/enterprise) [Mid-market](https://holtium.com/mid-market) [Startups](https://holtium.com/startups) Industries [All industries](https://holtium.com/all-industries) [Financial services](https://holtium.com/financial-services) [Healthcare](https://holtium.com/healthcare) [Life sciences](https://holtium.com/life-sciences) [Logistics](https://holtium.com/logistics) [Manufacturing](https://holtium.com/manufacturing) [Real estate](https://holtium.com/real-estate) [Retail](https://holtium.com/retail) [Technology](https://holtium.com/technology) Company [About](https://holtium.com/about) [Careers](https://holtium.com/careers) [Contact us](https://holtium.com/contact-us) [Trust Center](https://trust.holtium.com/) © 2026 Holtium [Privacy Policy](https://holtium.com/privacy-policy) [Terms of Service](https://holtium.com/terms-of-service) Contact us ## Talk to our team Curious how Holtium can help your company strengthen security while spending less? Tell us a bit about you and our team will reach out. First name Please enter your first name. Last name Please enter your last name. Business email Please enter a valid business email address. Industry Select - Manufacturing - Logistics and warehousing - Retail and consumer - Energy and utilities - Healthcare - Financial services - Real estate and facilities - Public sector - Technology - Other Please select your industry. Company Please enter your company. Job title Please enter your job title. Phone (optional) How would you like to be contacted? Email Phone Please choose at least one way to be contacted. How can we help you? (optional) 0 / 1024 Send By submitting, you agree to be contacted by Holtium. See our [privacy policy](https://holtium.com/privacy-policy). Something went wrong sending your message. Please try again, or email us directly at [contact@holtium.com](mailto:contact@holtium.com). ## Message received Thanks for reaching out. Our team will get back to you within one business day. Done ```json { "@context" : "https://schema.org", "@type" : "Organization", "description" : "Holtium brings your risks, controls, locations, and spending into one place, helps your team decide what to do next, and measures it in dollars.", "logo" : "https://holtium.com/hubfs/Holtium_Logo-1.svg", "name" : "Holtium", "sameAs" : [ "https://www.linkedin.com/company/holtium/" ], "url" : "https://holtium.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "WebSite", "name" : "Holtium", "url" : "https://holtium.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Holtium", "url" : "https://holtium.com/blog/author/holtium" }, "dateModified" : "2026-11-03T15:47:32.097Z", "datePublished" : "2026-11-03T15:28:53.000Z", "headline" : "Where Should You Spend First After a Physical Security Risk Assessment?", "image" : [ "https://holtium.com/hubfs/26.jpg" ], "mainEntityOfPage" : { "@id" : "https://holtium.com/blog/physical-security-risk-assessment-spend-first", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://holtium.com/hubfs/Holtium_Logo-1.svg" } } } ```