Situational Awareness at Scale: How to Build and Lead an Awareness-Driven Security Team for Large Events

By Nic Moretto, SAS-AP® | Founder & CEO, Tactful Elite Security Solutions (TESS Global)

Abstract

Large-scale event security operations fail not from lack of staffing but from lack of systems — and no system matters more than the one that governs how a team observes, interprets, and responds to threat indicators before an incident occurs. This article draws on twelve years of operational experience across 150-plus annual events at a Florida venue to present a practical, field-tested framework for building and leading an awareness-driven security team — from the first client call to the post-show after-action report.

When Your Gut Tells You Something Is Wrong — Listen

A few years ago, we were working on a graduation ceremony at our venue here in Florida. Bag checks are standard for us — every bag has to meet size criteria before it comes through the door, no exceptions. Midway through the event, one of our volunteers flagged down a staff member with a simple statement: ” There’s a purse outside, sitting in a bush next to a concrete pillar near the entrance. No owner in sight.

We didn’t touch it. We went to look at it ourselves first.

My staff supervisor that night was a former law enforcement officer. When he looked at that bag, his orientation was different from someone without that background. Same bag, same bush, same concrete pillar — but his training and experience immediately framed what he was seeing in a way a less seasoned operator might have dismissed. The location wasn’t random. It was tucked deliberately. Close enough to the entrance to matter, far enough from foot traffic that it wouldn’t be immediately disturbed.

We pulled in the venue director, walked him to the location, and all three of us agreed — we treat this as a potential threat until proven otherwise. Local PD responded. A K9 unit swept the area. The bomb squad took possession of the bag and cleared it. It was a false alarm, but the response was clean, fast, and by the book from the first step to the last.

We were praised by law enforcement for how we handled it. But what mattered more to me was that the process worked exactly the way it was supposed to. Because that night it was a graduation bag that turned out to be nothing. Next time, the circumstances might be different.

That single moment captures everything this article is about. Not theory. Not a PowerPoint. A real event, a real decision, and a team that had been prepared to make it.

In 12 years of business, including 9 consecutive years as the primary security provider at a Florida venue, we have overseen 150+ events annually — concerts, comedy acts, graduations, and keynote speakers. That kind of volume forces you to build systems, not just show up and react. Everything in this article comes from what’s worked and what hasn’t across hundreds of real events.

The Problem Most Venues Don’t Know They Have

Most venues think they’re covered. They have staff at the door, maybe a couple of guards walking the floor, and they’ve done it this way for years without a major incident. That’s exactly the problem.

This scenario has played out similarly at multiple venues we’ve assessed over the years — but one instance captures it best. We were brought in to provide security for a corporate keynote event at a local venue. High-profile principal, invitation-only audience, the kind of engagement where the client assumes a professional environment means a secure one.

Before the event, we had already identified something that concerned us — there was access control in place, but only at the surface level. Venue managers carried ID lanyards, and the production crew was using sticky day passes. No key card access, no secure perimeter around the restricted areas, and critically, no one actively verifying who belonged where. The crew entrance at the rear was essentially an open door if you knew where it was.

So we tested it — without telling anyone at the venue.

We sent one of our own people in plainclothes through that crew entrance. He walked in as if he belonged there. Nobody questioned him. Nobody stopped him. He made his way through the back corridor, past production staging, and into the restricted backstage area. He picked up a backstage credential lanyard sitting on the production table and took a picture standing right next to it. The whole thing was documented. Nobody on the venue’s team challenged him once.

When we sat down with venue management and put those photos on the table, the room went quiet. This wasn’t a hypothetical. This wasn’t a training scenario. This was their venue, their principal, their restricted space — and a stranger had walked right through it without a single barrier stopping him.

To their credit, they listened. We built out a full security assessment, identified every vulnerability, and developed a complete set of protocols and a formal SOP for the venue. The rear artist entrance got a new gate system. Every exterior door and the loading dock got keypads. We added security personnel at high-foot-traffic areas and put a proper badging and laminate system in place for all crew and production staff.

A few months later, we ran the same test again — this time planned, with the venue aware. The difference was night and day.

This time, the test subject was challenged at the crew entrance within 30 seconds.

From First Call to Final Curtain: Running a Full Event Security Operation

Situational awareness doesn’t start when the doors open. It starts the moment you take the call. Here’s how a properly structured event security operation actually runs from the ground up.

The First Conversation with the Client or Venue

Before a single officer is scheduled, you need to understand the event. What type of show is it? What’s the expected attendance? Is there a meet-and-greet? Is the artist high-profile enough to require a personal protection detail or a dedicated driver? What are the venue’s existing infrastructure capabilities — keypads, cameras, loading dock access, VIP areas?

These early conversations shape everything downstream. A corporate keynote speaker event has a completely different threat profile than a sold-out rock concert. Your staffing model, your post assignments, your communication plan — all of it flows from the initial client assessment.

Show Requirements and Staffing the Full Security Umbrella

A well-run large-scale event security operation functions like a single umbrella with layered roles underneath it. Think of it as rings of protection — each layer has a purpose, and each one makes the next layer stronger. Every person in every role understands both their assignment and how it connects to the team around them.

This mirrors the layered architecture model ASIS International establishes in its Protection of Assets framework, confirming that layered security architecture isn’t a luxury — it’s the foundational principle that makes any large-scale security operation resilient when one layer is tested. Here is what that looks like in practice across a full venue operation:

Parking Lot Management

This is your first line of intelligence and your last line of egress control — and most operations treat it as neither. Parking lot officers control vehicle flow on arrival, manage patron behavior before they reach the entrance, and handle post-show egress to prevent bottlenecks and confrontations.

What makes this post strategically important is timing.

Officers here are observing patrons before the crowd energy builds — before alcohol takes effect, before the show starts, before emotions are elevated. A patron who is going to be a problem inside is often identifiable in the parking lot. Failure here means unscreened threats arrive at your entrance with momentum already built. This post is never optional.

Entrance Access Control and Bag Search

This is the most critical single post in the entire operation — the last hard checkpoint before a patron enters a contained, high-density environment. Officers here are responsible for bag search, wand screening, magnetometer operation, wristband and laminate verification, and behavioral assessment of every person who approaches. This is where your behavioral indicators training matters most.

The 2017 Manchester Arena bombing — documented in the independent Kerslake Report — highlighted the deadly consequences when gaps in the outer security layer go unaddressed. Every patron who passes through your entrance unchecked is a decision your team made. Formal certification on magnetometers and handheld wands is not optional here — an uncertified operator at this post is not a security checkpoint, it is a deterrence prop.

Static Posts at Dressing Rooms and Back of House

These positions operate at the highest access level in the venue and require a completely different professional profile than crowd-facing roles. Officers here are responsible for controlling access to the most sensitive areas of the operation — dressing rooms, green rooms, production corridors, and artist-only spaces. They verify laminates, enforce access lists, and maintain a controlled environment in direct proximity to the principal. The professional standard here is absolute.

Composure, discretion, and zero tolerance for access violations are mandatory.

As our own penetration test demonstrated, an unguarded access corridor becomes an open invitation. When a stranger can walk from the crew entrance to the dressing room without a single challenge, the entire back-of-house operation has failed, regardless of how good the front door was. Failure at this post does not look like a loud incident. It looks like someone who was never supposed to be there, standing in a room they had no right to be in.

Front of Stage and Stage Left/Right Security

This is one of the most psychologically demanding posts in the entire operation. Officers are positioned inches from one of the loudest, most stimulating environments a human being can stand in — and their job is to ignore all of it. Your back is to the performance. Your eyes are on the crowd. What you are looking for is the shift — the moment someone’s attention changes from watching the show to watching the stage as a target. The weight transfers forward. The eyes lock. The hands come up. By the time someone is already moving, you are already behind.

Officers who have never worked this post before will instinctively turn to watch the performance. That instinct has to be trained out before they ever stand at that barrier. The consequences of failure here are severe — a breach happens, an artist gets hurt, or the performance gets stopped, and both are catastrophic failures that could have been prevented. The post-incident analysis following the 2021 Astroworld tragedy highlighted how observable crowd compression and behavioral escalation indicators can precede catastrophic outcomes when the barrier and floor management systems are not functioning as intended. This post does not allow for inattention. Not for a single song.

Loading Dock and Tour Bus Security

This is the most commonly underestimated post in large-scale event security — and the most frequently exploited. The loading dock is where production crews, equipment, catering, and artist transportation all converge in a high-traffic, time-pressured environment where access verification is often treated as secondary to operational flow.

Officers here are responsible for controlling vehicle access to the loading area, verifying credentials for all personnel entering through rear access points, securing the tour bus area before and after the show, and maintaining the integrity of the back-of-house perimeter.

The failure mode at this post is not dramatic — it is incremental.

A vendor who isn’t challenged. A production assistant who walks through without showing a laminate. A gate was left open because a truck was expected. Each one is a gap. Collectively, they dismantle the entire perimeter. As we demonstrated in our own penetration test, it only takes one unchallenged entry to reach the most sensitive area of the venue. This post needs dedicated coverage before load-in, throughout the event, and until the tour buses have cleared the property.

VIP Area Management

VIP areas create a unique operational dynamic — you are managing patrons who have paid for elevated access and often arrive with elevated expectations about what that access means.

Officers here are responsible for access list verification, wristband and laminate checks, managing the physical boundary between VIP and general admission, and handling patron requests and disputes with professionalism and firmness.

The most common failure at this post is social pressure.

A patron who paid for a VIP package believes that entitles them to more than it does. An officer who hasn’t been briefed clearly on where the boundary is — and given the authority to hold it — will yield. That yield creates a precedent, and within an hour, the VIP boundary has dissolved. Brief this post explicitly. The list is the list. The wristband is the wristband. No exceptions, no matter who is asking.

Pre-Show Meet-and-Greet Coverage

Meet-and-greet environments are controlled-access spaces that many teams treat as low-risk because the patron count is small and the mood is positive. That assessment is wrong. This is a pre-screened group of patrons in direct proximity to the principal in an intimate setting, which means the standard for access control and behavioral awareness is higher, not lower.

Officers here are responsible for managing the flow of patrons into and through the space, overseeing photography logistics, maintaining the transition between the public environment and the controlled access area, and ensuring that the interaction concludes without incident. This is also where the star-struck problem is most likely to emerge among your own team. Officers not assigned to this space do not enter it. That boundary is communicated before the event and held without exception.

Bodyguard or Close Protection Detail for High-Value Artists

When an artist or principal requires dedicated personal protection, this role operates as a distinct function within the broader security umbrella — with its own chain of command, its own communication protocols, and standards that go well beyond general venue security. Officers assigned to close protection are responsible for the physical safety of the principal at all times, advance coordination for movement within and outside the venue, threat assessment, and immediate response to any direct threat.

This is not a role filled based on availability.

Formal EP training from an accredited program, real protective detail experience, and, in many cases, prior military or law enforcement service are baseline requirements. The ASIS International guidelines on personal protection make clear that proximity to a principal without the training to respond appropriately is not protection — it is liability. There is no substitute for the right person in this role. Availability is not a qualification.

Driver or Runner for the Artist

Ground transportation is an extension of the protective operation, not a logistics function. Officers assigned to drive or run for an artist are responsible for primary and backup route planning, advance reconnaissance of hotel and venue approaches, knowledge of the nearest medical facility and estimated response time, and the ability to execute an emergency egress if the situation requires it. This role carries more responsibility than its title suggests.

The vehicle is a controlled environment, but the routes between controlled environments are not. Gavin de Becker, whose firm has provided protection for some of the highest-risk principals in the world, has written extensively in his influential work on the principle that most attacks on protected persons happen in transit — during the moments between controlled environments. Your driver is the last layer of protection when the principal is most exposed. That role demands the same training and preparation as any other EP assignment.

Building the Right Team: Vetting, Licensing, and Experience Standards

Not everyone who holds a security license belongs at every post. The role determines the requirement, and those requirements need to be clearly defined before you’re scheduling anyone.

At the baseline, every officer on your team should hold a current, valid state license. In Florida, that means a Class D (Unarmed Security Officer) license at a minimum. Armed posts require a Class G (Armed Security Officer), which comes with its own training, qualification, and annual requalification requirements. But licensing is a floor, not a ceiling.

For standard access control and crowd management positions, look for officers with documented event security experience and a demonstrated ability to work in high-volume, high-pressure environments. Communication skills and customer service demeanor are just as important as physical presence.

For dressing room static posts and back-of-house assignments, the bar rises. You want officers with professional composure, discretion, and a clear understanding that their job is protection and access control — not proximity to a celebrity. Former military and law enforcement backgrounds carry weight here because that culture of discipline and hierarchy is already ingrained.

For close protection and EP roles, the standards are entirely different. Formal EP school training from an accredited program, real protective detail experience, advance work capability, and in many cases prior military or law enforcement service are baseline requirements. The standard at the top of the umbrella is different from every other post — and it has to be.

The vetting process should also include a pre-event briefing for every single officer, regardless of experience level. Your best agent and your newest door guard both need to walk in knowing the floor plan, the communication chain, their post assignment, and the non-negotiables for the night.

One more thing on equipment — cameras, magnetometers, and access control systems are force multipliers, but only when the people operating them actually know how to use them. Formal certification on magnetometers and handheld wands should be a requirement before any officer is assigned to an entrance post. Knowing how to properly search a patron, how to read the device, and how to handle an alert without creating a scene is a skill. It has to be trained. This needs to be an industry standard — not something left to individual agencies to decide. A magnetometer operated by someone who isn’t certified is just expensive furniture.

One Umbrella, Different Levels — and Clear Non-Negotiables

When your entire event security operation runs under one agency, you have a significant advantage in communication and command structure. But it also creates a dynamic that needs to be managed carefully — not everyone on your team has the same access, and that has to be crystal clear from the pre-show briefing forward.

One of the most common issues in high-profile event security is what I call the star-struck problem. A newer officer working access control at the front entrance hears through the radio that there’s a meet-and-greet happening backstage. They know someone on the close protection detail. They think that because they’re working for the same agency, they can make their way back and get a photo with the artist.

That’s a no-go, and that boundary is absolute.

I’ve seen it happen. And every time it does, it creates a chain reaction — unauthorized personnel in controlled access areas, confusion about who belongs where, and a serious breach of the professional standard that your client hired you to maintain.

At a meet-and-greet, after the artist has finished with patrons, it is not uncommon for them to take photos with venue management and with the security detail that was in the room. That’s their call to make, and it’s perfectly appropriate in context. But the officer working the parking lot does not get to walk to the green room because they want a photo. That boundary is non-negotiable, and it needs to be communicated directly in the pre-show briefing — not implied, not assumed. Stated clearly with zero ambiguity.

Beyond internal discipline, our team must maintain a professional standard when dealing with every patron.

Customer service is equally non-negotiable in the other direction. Being firm does not mean being rude. Being professional does not mean being cold. Your officers are often the first and most consistent point of contact patrons have with the venue. How they handle every interaction — the routine ones and the difficult ones — reflects directly on your agency and on the client who hired you.

When asking a patron to leave, you are calm, clear, and respectful. You never curse. You never get pulled into an argument. If the situation escalates beyond what a verbal exchange can resolve, you radio for law enforcement and let them handle the removal. You do not become the story. The event is the story.

What Awareness Actually Looks Like: Behavioral Threat Indicators

We train our staff on behavioral threat indicators — the observable cues that tell you something is off before anything has actually happened. It’s not about profiling. It’s about pattern recognition. Security technologist Bruce Schneier has written that security is not a product but a process — and nowhere is that more true than at the entrance to a high-density event. People behave in predictable ways in crowd environments. When someone’s behavior doesn’t fit the pattern, that’s your signal to pay attention.

This approach aligns with the Department of Homeland Security’s behavioral detection frameworks — including the SPOT program developed for high-traffic environments — but nine years of standing at a door watching thousands of people walk through it goes further than any federal baseline. The five indicators below are grounded in the same physiological and psychological science, refined through direct application across more than 150 events annually across event types that produce dramatically different crowd baselines.

Gavin de Becker, whose work on pre-incident indicators is among the most referenced in protective security, has written in The Gift of Fear on the body’s involuntary signals that precede threat behavior. What follows is consistent with that framework — these are not behaviors a person can easily suppress. They are physiological responses the body produces automatically under stress, fear, intoxication, or intent.

What we’re really training for is baseline recognition — understanding what normal looks like in that specific environment, so that anything outside of it immediately triggers your attention.

Every venue, every event type, every crowd has its own baseline. Your job is to know it before the doors open.

That baseline shifts dramatically depending on the event. In nine years of running security at our Florida venue across concerts, comedy acts, graduations, and corporate keynotes, one pattern holds consistently: a late-night rock concert where the venue serves alcohol produces dramatically more behavioral indicator flags at the door than a midday college graduation. That is not an assumption — it is a documented operational reality.

Alcohol accelerates nearly every physiological indicator on this list. It lowers inhibition, elevates aggression, affects coordination, and produces visible physiological changes that trained observers can identify before a patron reaches the checkpoint. Knowing the event type before you arrive is not background information — it calibrates your entire awareness threshold for the night.

We break the indicators down into five categories so they are easy for staff to recall and apply in real time under pressure.

Posture and Stance

Look at how a person is standing. Are they flat-footed and balanced, or back on their heels and swaying? Are they squared up in an offset stance — the kind of weight distribution that looks less like someone waiting in line and more like someone ready to move? The body shifts its weight distribution almost involuntarily when it is preparing for physical action. That shift in stance alone can tell you a great deal before a word is spoken.

The Face

Is the skin flushed or red? Are they sweating in a way that doesn’t match the temperature or the environment? The body’s stress response shows up on the face whether someone wants it to or not — and it shows up before the situation becomes visible to anyone else. The body doesn’t lie even when the person is trying to hold it together.

The Eyes

Are they present and focused, or is there a thousand-yard stare — that vacant, looking-through-you expression that tells you the lights are on, but nobody’s home? Dazed and unfocused is a red flag and often indicates significant intoxication or stress. But so is the opposite — an intensity of focus locked onto a specific point in a way that feels fundamentally wrong for the environment. Someone waiting in line to enter a concert is not staring at the stage door with locked-jaw intensity. When you see that, your orient step begins before they reach the checkpoint.

The Ears

This is one that most people never think about, but once you know it, you can’t unsee it. When adrenaline spikes, blood flow increases, and the tops of the ears flush visibly red. It’s an involuntary response — part of the same stress cascade that produces facial flushing and sweating. In a crowd environment, it’s one of the fastest physical tells you can spot from a distance without any direct interaction. Your officers don’t need to be close to read this indicator. They need to be trained to look for it.

Voice and Speech

Are they loud and escalating when the situation doesn’t call for it? Slurring, talking too fast, or struggling to form words in a way that doesn’t match the conversation? Vocal patterns are one of the quickest reads you can make at a door — and they tell you a great deal about what you’re about to deal with before the person even steps inside. Alcohol affects speech in ways that are difficult to mask. Elevated stress affects speech in different but equally readable ways — racing delivery, unusual pitch, clipped responses. Neither is invisible to a trained observer.

None of these indicators in isolation automatically means something is wrong. But when two or three appear together on the same person— a pattern practitioners call cluster recognition — that is your actionable signal. One indicator warrants continued observation. Two or three together warrant intervention. At the door, before they’re inside. Not after.

Stage security applies the same principles at a different scale and under considerably more pressure. When you’re positioned at the barrier in front of a live performance, you’re not watching the show — you’re watching the crowd watching the show. The post-incident analysis following the 2021 Astroworld tragedy highlighted how observable crowd compression and behavioral escalation indicators can precede catastrophic outcomes when the barrier and floor management systems are not functioning as intended.

Your officers at the barrier are the last line of observation between those early indicators and a serious incident. There’s a body language shift that happens when someone decides they’re going to rush the stage — weight transfers forward, eyes lock, hands come up. You learn to recognize it before the movement starts, not after. By the time someone is already climbing the barrier, you’re reacting. The goal is to be in decision mode before it gets there.

The Advance: Preparation That Happens Before Anyone Arrives

One of the most underutilized tools in event security — and one of the most critical in executive protection — is the advance. Going into a venue one or two days before the event to walk the space, map it, and build your operational plan around what you actually see, not what you assume.

The advance also includes intelligence gathering. Before you set foot in the venue, you should already be reviewing any known threat information — credible concerns flagged by the artist’s team, known stalkers on record, local open-source intelligence, and a pre-event coordination call with your venue PD liaison, if one is available. Awareness doesn’t start at the front door. It starts before you leave the office.

Advanced event security operations are increasingly incorporating elevated observation posts, counter-surveillance protocols, and drone technology to extend the awareness envelope beyond what ground-level teams can see — particularly in outdoor amphitheater and festival environments where the perimeter is harder to control. These are force multipliers worth understanding as the industry evolves, and they represent the next layer of the awareness model this article describes.

For a driver or runner transporting an artist to and from a hotel, the advance means knowing your primary route, your backup route, the location of the nearest hospital, and your egress options if something goes sideways. You don’t figure that out on the night of the show. You know it before you ever pick up the principal.

For the venue itself, the advance means walking every entrance and exit, identifying every blind spot, potential breach point, and area where a crowd could bottleneck in an emergency. You create a floor plan, and you brief your entire team on it before doors open. A team that has walked the space together and talked through the scenarios responds completely differently from one that shows up, gets assigned a post, and is figuring it out as the night unfolds.

Threat Scenarios — Is There an SOP in Place?

Every venue operation needs documented, briefed SOPs for the scenarios that nobody wants to think about but that you absolutely have to be prepared for. These include:

Active shooter — Where does your team go? Where does the artist go? What is the communication chain to law enforcement? Who calls 911, and who moves the principal? These decisions cannot be made in the moment for the first time. The 2016 Pulse nightclub shooting — 49 lives lost — demonstrated in brutal terms what happens when responding personnel, including security, have no pre-established communication and evacuation framework in place. An active shooter SOP is not bureaucratic paperwork. It is the difference between a coordinated response and chaos.

Bomb threat — Who clears the building and how? What is the evacuation route? Where does the assembly point keep people away from the suspected threat area? Who is the liaison with the responding bomb squad? The 2017 Manchester Arena bombing and the subsequent independent Kerslake Report highlighted the consequences of gaps in venue evacuation coordination and communication between security personnel and responding agencies. That report is public record and should be required reading for anyone writing or reviewing a venue bomb threat SOP.

• Severe weather — In Florida, this is not a hypothetical. Thunderstorms, tornadoes, and hurricanes are real operational considerations. What triggers a weather evacuation? Where does everyone go? Is there a shelter-in-place protocol?
• Fire — Evacuation routes, assembly points, who accounts for the principal, and who communicates with the fire department command. Every officer needs to know this before the event, not during.
• Known stalker or credible threat — Has the venue or artist team communicated a specific threat concern? Is there a description? What are the triggers for escalation? Who makes the call to move the principal, and where do they go?
• Medical or mass casualty — This one gets overlooked more than any other. Who on your team renders aid? What are the extraction routes for the principal if there is a medical emergency in the crowd? Is there EMS on site or a medic? If not, where is the closest hospital, what is the estimated response time, and does your driver or runner already know the route? These questions need answers before the doors open, not after someone goes down.

At a minimum, every officer on an event security team should hold current CPR and AED certification. Supervisors, advanced officers, and EP teams should be additionally trained in Tactical Combat Casualty Care (TCCC), and Stop the Bleed certification should be standard across the board. When seconds matter, your team needs to be the first line of response before EMS arrives. Coordinate with the venue in advance. Know what medical resources are on site and where they are positioned. That conversation happens during the advance, not during the emergency. We continue to raise the bar and set the benchmark, but the standard needs to move industry-wide.

If you don’t have an SOP for each of these scenarios, you don’t have a security plan. You have a staffing schedule.

Radio Etiquette: What You Say — and What You Don’t

Radio communication is one of the most overlooked professionalism standards in event security, and one of the most important. What gets said on the radio — and how it gets said — can either keep an operation running smoothly or create panic in a crowd that doesn’t need to be involved in your communication.

The first rule is simple: if you can speak in code, use it. Plain-language descriptions of incidents broadcast over a radio in a crowded venue can be overheard, misinterpreted, and turned into a crowd management problem before your team even has a chance to respond. Saying ‘we have a code red at the north entrance’ communicates urgency to your team without announcing to every patron in earshot exactly what is happening and where. Your team knows what it means. The crowd doesn’t. That separation is intentional, and it matters.

Keep transmissions brief and clear. Identify yourself, state your location, and state your situation. Then release the channel. Long, rambling radio calls create confusion and tie up communication when other posts may need to report in.

Never speculate on the radio. If you don’t know what you’re dealing with, say you have an unknown situation at your post and request a supervisor. Don’t broadcast incomplete information that the rest of your team or nearby patrons can run with.

And if a serious situation is developing — a potential medical emergency, a physical altercation, a credible threat — move to your designated secure channel or use your pre-briefed coded language. Every team should establish its own internal code system before doors open. The goal is to manage the situation, not announce it.

The OODA Loop: From Awareness to Action

Situational awareness without a decision-making framework is just observation. You can have the most alert team in the building, but if they don’t know how to move quickly from what they see to what they do, you’re still behind the curve. That’s where the OODA Loop comes in.

Most practitioners know the three components of situational awareness: perception, comprehension, and projection. The OODA Loop is how you put all three into motion under real pressure. And for what it’s worth, this approach lines up with how modern protective intelligence and layered security doctrine actually work in the field — it’s just rarely explained in plain language that a team can act on.

Developed by military strategist Colonel John Boyd, the OODA Loop — Observe, Orient, Decide, Act — was originally built to describe how fighter pilots make split-second decisions in combat. The framework translates directly to event security because the core principle is the same: the person who moves through that loop fastest controls the outcome.

Let me walk you through each step using the graduation incident I opened this article with. Because that one call, made correctly under pressure, is the clearest example I have of what this framework looks like when it works.

Observe

A volunteer approached one of my staff members with a simple observation — there’s a purse outside in a bush. That’s the entire input. Nothing dramatic, no alarm going off. Just a small piece of information that didn’t immediately fit the environment. We didn’t touch it. We went to look at it ourselves first. Observation is active and constant. It’s not waiting for something obvious to happen — it’s your team staying alert enough to notice the thing that is slightly out of place. If that volunteer wasn’t paying attention, or if my staff member brushed it off, the loop never starts.

Orient

This is the most underrated step and the one most teams skip entirely. My supervisor that night was a former law enforcement officer. When he looked at that bag, his orientation was shaped by years of experience and training that a less seasoned operator simply doesn’t have yet.

Same bag, same bush — but his background framed it as a threat until proven otherwise. Orientation is where experience lives. It’s also why your pre-event briefings, your floor plan walkthroughs, and your scenario training matter so much — they build the orientation framework your team draws from when something real happens.

Decide

Once we were oriented, the decision came fast. We got the venue director, walked him to the location, and all three of us were in agreement — treat this as a potential threat and call local PD. Nobody overrode anyone. Nobody minimized it to avoid disrupting the graduation. The decision was made collectively, clearly, and without hesitation. This is where your pre-event command structure pays off. When your team already knows who makes the call and what the chain of communication looks like, decisions happen faster because the framework is already in place.

Act

We secured the area and made the call. PD responded, deployed a K9 for an initial sweep, and brought in the bomb squad, who cleared the bag. The action was clean from start to finish — no panic, no freelancing, no one trying to be the hero. Just a team that observed something out of place, made sense of it based on context and experience, decided how to respond, and executed. That is the loop working exactly as it should.

Post-Show Operations: The Event Isn’t Over When the Music Stops

One of the most common gaps in event security planning is what happens after the final song. The show is done, the crowd is moving, the energy is still high — and your team’s guard needs to stay up.

Front-of-stage posts need to stay active through the full production breakdown. Once the artist leaves the stage, you will have patrons attempting to reach over the barrier or jump onto the stage to grab set lists, drumsticks, guitar picks — anything left behind. I’ve seen it happen repeatedly. The barrier is still a barrier after the last chord. Your officers need to know that their post is active until they are explicitly released or told the event is done by an Authorized Security Supervisor — and not a moment before.

If there is a visible rear gate where the public can see the tour bus, that area needs dedicated coverage after the show. The moment that the gate opens — even briefly — you will have individuals attempting to run through for a photograph or an autograph. I have watched it happen from fifty feet away. Someone is always waiting, and they are always watching for the gap. Staff who gate with purpose and keep the perimeter clear until the artist and tour buses have fully departed.

Parking lot management during egress is its own operational challenge. High volumes of people leaving at the same time, elevated emotions from the show, potential alcohol involvement — this is when your behavioral indicators training applies just as much as it does at the door. Keep communication channels open, manage vehicle flow actively, and have a clear protocol for any post-show confrontations before they develop into something that requires law enforcement involvement.

And when the last patron is gone, and the lot is clear, the event still isn’t over. Within 24 hours, your supervisor should conduct a formal After Action Report with the team. What did we observe? What worked? What didn’t? What do we fix before the next one? This closes the OODA Loop at the organizational level.

Every vulnerability your team identifies in an After Action Report is a vulnerability that doesn’t show up as a real incident six months from now.

The industry needs to push toward making the AAR a non-negotiable standard after every event — not just after something goes wrong. The best security operations get better every single time. That’s the benchmark we should all be working toward.

The Standard You Set Is the Culture You Build

This article addresses two key audiences.

The first is the veteran operator who may have gotten comfortable. The events run, nothing major has happened, and the operation feels dialed in. I want that person to remember the assessment story. The stranger who walked through the crew entrance, past production staging, and into a restricted backstage area without a single person questioning him.

A credential lanyard sitting on a table — documented, photographed, and brought back to a client who had no idea it was possible. Years of experience at a venue didn’t start with a contract — it started with being willing to walk in and show a client what they couldn’t see. Complacency is the most dangerous condition in this industry because it’s invisible until the moment it isn’t.

The second is the new supervisor stepping into a leadership role for the first time. You are now responsible not just for your own awareness but for building it into every person on your team. That means pre-event briefings where you actually walk the floor plan. It means behavioral indicator training that your officers can recall and apply under pressure. It means establishing non-negotiables before the first patron walks through the door and holding the standard when someone tests it.

Situational awareness at scale is not a concept. It’s a system. It’s the volunteer who speaks up about a purse in a bush. It’s the supervisor whose background tells him something is wrong. It’s the team that doesn’t touch the bag, loops in the right people, and makes the call. It’s the officer at the front of the stage whose eyes never leave the crowd. It’s the driver who knows two routes to the hospital before they ever pick up the principal.

Build the system. Train the team. Hold the standard. That’s how you build and lead an Awareness-Driven Security Team for Large Scale Events.

What follows are the ten non-negotiables that underpin every operation we run.

Awareness-Driven Event Security — Non-Negotiables

About the Author

Nic Moretto, SAS-AP®, is the Founder, CEO, and Director of Operations of Tactful Elite Security Solutions (TESS Global) — https://tess.global/ — a Florida-licensed security agency operating since 2014. With over 20 years of experience across executive protection, armed security, and security instruction, Nic holds the following Florida state licenses: Class B (Security Agency), Class D (Unarmed Security Officer), Class DI (Security Instructor), Class C (Private Investigator), and Class G (Armed Security Officer). He is a certified NRA Firearms Instructor, Defensive Tactics Instructor, Situational Awareness Instructor, and an active Krav Maga Practitioner. He carries the Situational Awareness Advanced Practitioner (SAS-AP®) designation through the Acuri Group. He is a 2008 police academy graduate with criminal justice studies from Eastern Florida State University, and has designed and executed protection details for Fortune 500 companies, including Facebook, Google, and PricewaterhouseCoopers, working alongside firms including AS Solution, Gavin de Becker & Associates, and Pinkerton. He has served as the primary security provider for a Florida venue for 9 consecutive years, overseeing 150+ events annually across concerts, comedy acts, graduations, and keynote speaker engagements.