Museums frequently rely on risk assessments as their primary decision-making tool for security planning. While risk assessments are essential, they only provide part of the picture. They describe the likelihood and impact of identified risks, but they do not explain who may cause harm, why, or how an incident might unfold. This is where threat assessments play a critical role. For cultural institutions, especially those with high-value or symbolically important collections, relying on risk assessments alone leaves important vulnerabilities unaddressed.
What Risk Assessments Provide
A risk assessment helps institutions understand where vulnerabilities may exist. It evaluates environmental factors, operational routines, building design, and object sensitivity. It assigns levels of likelihood and consequence to various scenarios. This process supports planning, budgeting, and prioritisation. However, it is largely internal. It looks at the institution’s own systems and conditions without fully exploring the external actors who may pose a threat.
Where Threat Assessments Differ
A threat assessment examines intent, capability, opportunity, and motivation. It looks outward, beyond the institution, to understand who may target collections and for what reasons. This includes organised criminal groups, opportunistic theft, insider risks, politically motivated actors, vandalism trends, and external conditions that may increase threat levels.
Threat assessments answer questions such as:
• Who might target the institution and why?
• What types of objects or materials could attract attention, including those containing precious metals?
• How do economic pressures, political tensions, or social movements influence threat behaviour?
• What methods or approaches are most likely to be used?
• Are there signs of changing patterns that require pre-emptive adjustments?
Without this analysis, institutions may focus on internal vulnerabilities while overlooking the motivations and capabilities of those who could exploit them.
A Recent Shift in the Museum Sector
Several museums have recently strengthened their protection specifically against vandalism. This response is understandable given high-visibility incidents. However, it highlights a tendency to react to the most recent event instead of adopting a broader, integrated strategy. Focusing on a single threat category creates blind spots. Theft, insider risks, organised groups targeting precious metals, and other evolving threats require equal attention. A threat assessment helps institutions avoid this narrow focus by presenting a more complete picture of the external environment.
Why Both Are Needed
Risk and threat assessments complement each other. One examines internal conditions. The other analyses external actors. Together they provide a foundation for effective planning, resource allocation, and operational decisions. When used separately, gaps appear. For example, an institution may identify a low-likelihood risk for theft based on past internal incidents, while a threat assessment may show increasing interest from external groups in specific materials or objects. This discrepancy can be critical.
Benefits of Integrating Threat Assessments
• More realistic planning based on current patterns rather than past assumptions.
• Improved prioritisation of security investments.
• Better alignment between leadership, conservation, and security teams.
• Clearer understanding of how global or regional developments affect local operations.
• Reduced reliance on short-term, event-driven security upgrades.
For institutions in Southeast Asia, where reporting on security incidents is inconsistent and external conditions change quickly, threat assessments are particularly important.
How STEMA Can Support This Work
STEMA Risk Management works with museums to integrate both approaches into a clear and practical security framework. This includes analysing external threat environments, reviewing internal vulnerabilities, and linking both to actionable measures that strengthen resilience. Our aim is to help institutions move from isolated responses to a more structured and forward-looking approach to heritage protection.
