Displaying valuable assets to the public requires a balance between accessibility and protection. Cultural institutions have long operated in this space, presenting artworks and artifacts in ways that encourage engagement while navigating a wide spectrum of risks. Their experience offers insight not only for museums, but for any organisation that displays high-value items in public spaces.
However, many institutions still rely on security practices that were designed decades ago. These measures often focus on individual components — a guard, a camera, a barrier — rather than the full ecosystem of people, space, behaviour, and procedures. Modern risks require a more holistic and analytical approach, one that treats protection as an integrated system rather than a collection of isolated tasks.
Understanding the Risks
When objects are publicly accessible, they are exposed to a range of risks. Accidental damage is common, especially where visitors are tempted to interact with displays. Intentional damage, though less frequent, remains a concern during high-traffic periods or sensitive exhibitions.
Theft is a low-occurrence but high-impact threat. Recent incidents in Europe and elsewhere demonstrate how quickly small gaps in physical or procedural protection can be exploited. These risks apply to any public-facing environment, regardless of industry.
Insider risk is another important factor. While most employees and contractors act responsibly, individuals with authorised access can inadvertently or deliberately create vulnerabilities through unsafe behaviour, procedural shortcuts, or misuse of access privileges. Insider incidents are often difficult to detect because they occur within normal workflows, making clear roles, training, and oversight essential.
As technology and knowledge advances, so do the criminals. For example, a French museum in 2025 reportedly suffered a ransomware attack that disrupted its alarms and surveillance, followed by a physical intrusion that resulted in the theft of gold specimens worth approximately US$705,000[1] This case highlights how the convergence of digital and physical threats can rapidly create significant vulnerabilities.
The Visitor Experience
Public display is ultimately about experience. Whether the purpose is learning, engagement, inspiration connection, organisations rely on environments that feel open, inviting, and safe.
A positive experience supports several outcomes:
- Visitors connect meaningfully with what they see.
- People feel comfortable returning and recommending the venue.
- The institution builds trust and strengthens its identity.
Protection should rarely come at the cost of access or engagement. Environments that feel restrictive, heavily policed or uncomfortable undermine their own purpose.
Balancing Risk and Accessibility
Protection must support engagement. Measures that are confrontational, intrusive or inconsistent can deter visitors and weaken the experience. Conversely, insufficient protection leaves objects vulnerable and may lead to incidents that disrupt operations, damage reputation, or cause loss of assets.
Achieving the right balance requires a holistic, context-specific approach: one that accounts for the space, the behaviour of visitors, the sensitivity of objects, operational patterns, and the institution’s mission. The objective is not only to prevent incidents, but to design environments where visitors behave naturally without putting objects at risk.
Conclusion
Reducing risk for assets on public display requires holistic thinking. Organisations that invest in thoughtful design, consistent procedures, and trained personnel create environments where valuable items can be enjoyed safely and confidently. The most effective protection is often the least visible, supporting access and engagement while quietly reducing the likelihood and impact of incidents.
If you would like support in assessing display risks, improving visitor flow, or strengthening protection in public-facing environments, STEMA Risk Management is available to assist.
[1] The Register: https://www.theregister.com/2025/09/22/infosec_in_brief/
