Threat & Vulnerability Risk Assessment (TVRA)
Find out which threats could really hurt your organization, how exposed you are to each one, and where to invest first.
A TVRA looks at your whole organization, not just one building. It names the threats that could realistically reach you, evaluates how well your people, sites and procedures would hold up against each one, and scores the results. Leadership gets a clear, ranked picture of risk and a plan to reduce it.
What is a TVRA?
A Threat and Vulnerability Risk Assessment answers three questions for every risk you face, then combines the answers into a score.
What could happen?
The people and events that could cause harm: theft and cargo loss, workplace violence, insider threats, trespass and sabotage, protests, and the security side of storms and outages.
How exposed are we?
The gaps that make a threat more likely to succeed or more damaging: weak access control, untested plans, unclear ownership, habits that drift.
How bad would it be?
What it would cost you in safety, downtime, money, legal exposure and reputation if it happened.
Risk = threat × vulnerability × impact. Scoring each one turns "we feel exposed" into "these five risks make up most of our exposure, and here is what fixes them."
Why it makes your security program stronger
- Money goes where the risk is. Spending follows scored risk, not the last incident or the latest vendor pitch.
- Every site on the same scale. Compare locations side by side and set one standard across the organization.
- It feeds your threat assessment program. Your workplace violence and behavioral threat team gets a clear view of the threats you face, how concerns get reported and where the gaps are.
- It ties security to your other plans. Findings line up with emergency, business continuity and crisis plans so they don't contradict each other.
- A record of reasonable steps. After an incident, courts and insurers ask whether the risk was foreseeable and what you did about it. A documented TVRA, and progress on it, can help show you acted on foreseeable risks. This isn't legal advice, so involve your attorney.
- A baseline to measure progress. Re-score each year and show leadership and the board that risk is going down.
Signs you need a TVRA
- You run more than one site and each one handles security its own way.
- You've had an incident, a threat or a near miss, here or nearby.
- Leadership or the board is asking "how exposed are we?" and nobody has a clear answer.
- You're building a security program, or hiring or replacing a security leader.
- A customer, insurer, owner or regulator is asking for a risk assessment.
- A big change is coming: a new site, a merger, layoffs, a high-profile event or a move into a new region.
- Security budget decisions are being made without data.
TVRA or site assessment?
| TVRA | Site assessment | |
|---|---|---|
| Scope | The whole organization | One facility |
| Question it answers | Which threats could hurt us most, and where should we invest? | How well is this building protected? |
| Looks at | Threats, vulnerabilities and impact across people, sites, procedures and operations | Access, doors, lighting, cameras, layout and daily habits |
| You get | A ranked risk register and a multi-year roadmap | A prioritized fix list for that site |
| Best for | Leadership planning, multi-site companies, building a program | A specific building, a renovation, or after an incident |
Not sure which you need? A common approach is to start with a TVRA, then assess the sites it ranks highest. We'll tell you plainly on the first call.
What you receive
- A threat profile built for your industry, locations and operations
- Vulnerability findings across people, procedures, physical security and operations
- A risk register with every risk scored for threat, vulnerability and impact, then ranked
- A one-page heat map leadership can read at a glance
- Recommendations in priority and cost tiers, many of them low-cost
- A multi-year roadmap tied to your budget cycles
- An executive summary and a briefing for leadership or the board
How it works
- Scoping callSites, people and the decisions the TVRA should support.
- Document reviewIncident history, plans, policies and prior reports.
- Interviews and site visitsLeaders, staff and the places that matter most.
- Scoring and reportThreats and vulnerabilities scored and ranked.
- Leadership briefingWalk through the findings and the roadmap.
Who it's for
Multi-site companies, industrial and energy operators, logistics and distribution networks, critical facilities, and any organization whose leaders need to decide where security money should go.
Questions
How is a TVRA different from a site assessment?
A site assessment looks at how one facility is protected. A TVRA scores the threats themselves across the whole organization, so leaders can decide where to invest.
What threats does a TVRA cover?
Whatever realistically applies to you: theft and cargo loss, workplace violence, insider threats, trespass and sabotage, protests and activism, and the security side of severe weather and outages. We don't do cybersecurity, but we flag where physical and cyber risks meet so your IT team can follow up.
How does a TVRA support our threat assessment program?
It shows your threat assessment team which threats matter most, whether people know how to report a concern, and where follow-up breaks down.
Do you need to visit every site?
No. We visit a representative sample and the sites with the highest consequences, then use interviews and records for the rest.
What do we need to provide?
A point of contact, a list of sites, incident history, and any existing plans, policies or prior reports. We'll send a short request list after the scoping call.
How often should a TVRA be updated?
Re-score the risk register each year, and do a full refresh every three years or after a major change such as a new site, a merger or a serious incident.
Who sees the report?
Only the people you name. We'll sign your confidentiality agreement, and you can also have your attorney engage us directly; ask your attorney whether that keeps the work privileged.