Choosing a Security Company in 2027: Essential Criteria for UK Buyers

Choosing a security company in 2027 should begin with evidence, not a headline hourly rate. UK buyers need to confirm that a provider can translate a site-specific risk profile into competent people, reliable supervision, proportionate technology, clear escalation and measurable contract outcomes. Licensing remains essential, but it is only the baseline. The stronger procurement decision is the one that tests how the service will work on an ordinary shift, during an incident and when conditions change.

This guide gives facilities, estates, procurement, operations and risk leaders a practical checklist for selecting a security company in the UK. It also reflects the direction of travel set out in the SIA Strategic Plan 2026 to 2029, which places greater emphasis on the quality of security services, business standards, supervision and informed buyer choice.

Why choosing a security company will require more scrutiny in 2027

The UK private security market is entering a period of significant change. The Security Industry Authority has said that it intends to focus not only on licensing compliance, but also on the quality of service delivered by operatives and security businesses. Its plans include a new business approval scheme, a more informative public register and stronger expectations for supervision, management and professional standards.

For buyers, that means a familiar supplier badge or a compliant tender response may no longer provide enough assurance. Procurement teams will need to understand the operating model behind the proposal. They should be able to see how officers are recruited, trained, briefed, supported and supervised, how incidents are escalated, and how contract performance will be evidenced.

The draft Security Buyer’s Charter also signals a shift towards responsible purchasing. It encourages quality, competence, fair working conditions, workforce wellbeing, sustainability and transparent contract management. This matters because contracts awarded primarily on the lowest cost can transfer hidden risk to the client, the workforce and the public.

Start with the risk, not the service specification

Before asking providers to price a service, define what the service must protect and what failure would look like. A generic request for two guards, CCTV monitoring or mobile patrols describes inputs, but it does not explain the required security outcome.

Build the brief around the site, people and operating context. Useful questions include:

• Which people, assets, information and operations are critical?

• What incidents have occurred, including near misses and suspicious activity?

• Which entrances, boundaries, loading areas or working patterns create vulnerability?

• What changes at night, at weekends, during shutdowns or at peak demand?

• Which third parties, contractors, visitors or tenants need access?

• What response is required if an alarm, welfare concern or security incident occurs?

• Which business continuity, health and safety or protective security plans must the service support?

A capable provider should challenge assumptions and test whether the proposed hours, roles and technology are proportionate. If the recommendation is identical for every site, it is unlikely to be genuinely risk-led. Our guide to common business security mistakes explains why one-off assessments and disconnected controls often leave avoidable gaps.

The 10-point security provider quality checklist

1. Verify licences and the legal operating model

Confirm that every role requiring an SIA licence will be filled by an appropriately licensed person. Ask how the provider checks licences before deployment and throughout employment, and how it responds to expiry, suspension or changes in status.

Clarify whether the company will deliver the contract directly or use labour suppliers and subcontractors. The same standards should apply throughout the supply chain. Buyers should know who employs the officers, who supervises them and who is accountable for performance.

2. Examine business approval, accreditations and insurance

SIA Approved Contractor Scheme status can provide useful assurance, but it should be assessed alongside the service being purchased. Check the approved activities, current status and scope. Ask for relevant certification, insurance and audit evidence, then verify that each item applies to the contracting legal entity rather than a related company.

Accreditations are evidence inputs, not substitutes for due diligence. Ask what changed as a result of the most recent external audit and how corrective actions were closed.

3. Require a site-specific security risk assessment

The provider should assess the real environment before mobilisation. This includes access routes, perimeter condition, lighting, CCTV coverage, key control, lone working, deliveries, high-value areas, emergency arrangements and the interaction between security and normal operations.

Look for recommendations that state the risk, the proposed control, the responsible owner and the intended result. The assessment should distinguish immediate controls from longer-term improvements and should be reviewed after material change.

4. Test recruitment, screening and workforce stability

Ask how candidates are screened, how identity and right-to-work checks are completed and how employment history is verified. Understand the provider’s approach to vetting standards, references and role suitability.

High turnover can undermine local knowledge, consistency and incident response. Request contract-level information on retention, absence, vacancy cover and use of agency labour. A credible provider should be able to explain how it will build a stable team and manage relief coverage without lowering standards.

5. Match training and competence to the assignment

An SIA licence confirms that an operative has met the relevant licensing requirements. It does not prove competence for every site or assignment. Specify the additional knowledge required for the role, such as access control, conflict management, customer service, vulnerable people, first response, fire procedures, radio use, CCTV, incident reporting or sector-specific hazards.

Ask how competence is checked after training. Observation, scenario practice, knowledge checks and supervisor sign-off provide stronger assurance than an attendance record alone. For publicly accessible premises, provider capability should also align with your own protective security responsibilities. Our article on responsibility and preparedness under Martyn’s Law explains why ownership, procedures and staff understanding must work together.

6. Inspect supervision and contract management

Weak supervision is one of the fastest ways for a well-designed service to drift. Establish who will visit the site, how often, what will be checked and how findings will be recorded. Confirm the responsibilities of the site supervisor, contract manager, control room and senior escalation contact.

Ask the bidder to describe what happens when an officer is late, a patrol is missed, a post instruction becomes outdated or an incident report is incomplete. Strong answers will include detection, escalation, recovery and prevention, not only a promise that the issue will be addressed.

7. Assess technology as part of the operating model

CCTV, access control, alarms, body-worn devices, patrol systems and digital occurrence books can improve visibility and accountability. They add value only when people know how to use them and the response process is clear.

Ask who monitors alerts, what information is retained, how faults are reported and how data is protected. Request a demonstration of the management information you will receive. A technology proposal should reduce an identified risk or improve assurance, not simply add equipment to the contract.

8. Challenge incident response and business continuity

Give bidders realistic scenarios and ask them to explain the response. Examples could include a forced entry, aggressive visitor, lost access card, alarm activation, medical emergency, suspicious item, system outage or severe weather event.

The answer should show who takes control, which procedures apply, when emergency services or client leaders are contacted, how information is recorded and how normal operations are restored. Confirm that the provider has its own continuity arrangements for staff shortages, transport disruption, communications failure and control-room outage.

9. Agree meaningful KPIs and quality assurance

Avoid a scorecard based only on hours delivered. Useful measures may include:

• licence and vetting compliance;

• completion and quality of patrols;

• alarm acknowledgement and response times;

• incident report accuracy and submission time;

• training and competence completion;

• absence, retention and vacancy cover;

• supervisory visit completion;

• corrective action closure;

• client, employee and visitor feedback;

• risk reduction and improvement activity.

Define the data source, reporting frequency, tolerance and action required when performance falls below the agreed standard. Include qualitative review as well as numerical reporting. A contract can meet a narrow KPI while still delivering a poor experience or missing emerging risk.

10. Test price realism, employment practice and transparency

Ask bidders to explain the price structure, including pay, statutory employment costs, training, supervision, uniforms, equipment, management overheads and margin. An unrealistically low price may depend on fragile staffing, limited supervision or assumptions that create problems after award.

Where TUPE may apply, obtain specialist advice and provide accurate information through the procurement process. Consider fair pay, working hours, welfare, rest arrangements and career development. These factors influence retention, attentiveness and the quality of service seen by your staff and customers.

Evidence to request during due diligence

A quality-focused tender should ask for evidence that can be checked, not only narrative assurances. Your request may include:

• company registration details and contracting entity;

• SIA approval status and approved activities, where applicable;

• relevant insurance schedules and certification;

• sample assignment instructions and risk assessments;

• screening, vetting and licence-checking procedures;

• training matrix and competence sign-off process;

• supervision plan and contract management structure;

• sample incident, patrol and performance reports;

• business continuity and escalation arrangements;

• subcontractor and labour-supply controls;

• references from comparable contracts;

• mobilisation plan with owners, dates and dependencies.

Request redacted examples where personal or commercially sensitive information is involved. The objective is to confirm that the provider has a functioning system and can apply it to your contract.

Questions to ask shortlisted security companies

1. Which risks in our brief would you prioritise, and why?

2. What would you change in the proposed specification?

3. How will you select and prepare the team for this site?

4. Who will supervise delivery, and what will they inspect?

5. How do you manage subcontractors and temporary cover?

6. What information will we receive each week and each month?

7. How will you identify service drift before it becomes a failure?

8. What will happen during the first hour of a serious incident?

9. How will lessons from incidents and near misses change the service?

10. Which mobilisation risks could prevent a successful start?

Score answers against published criteria and moderate the evaluation across procurement, operations, security, health and safety and the people who will manage the service day to day. Site visits and scenario-based presentations often reveal more than polished written submissions.

Security procurement red flags

• A price that cannot be reconciled with lawful employment costs and the promised management structure.

• Generic risk assessments or method statements that do not reflect the site.

• Heavy reliance on badges and accreditations without contract-level evidence.

• Unclear accountability between the provider, labour supplier and subcontractor.

• No named escalation route outside normal office hours.

• Training lists without a method for checking competence.

• Technology claims without a demonstrated response process.

• High officer turnover presented as normal or unavoidable.

• Reluctance to share sample reports, references or improvement data.

• A mobilisation plan that begins only after contract award.

Build assurance into mobilisation and the first 90 days

Before day one

Confirm the final risk assessment, staffing plan, licences, screening, training, uniforms, equipment, assignment instructions, escalation contacts, systems access and contingency arrangements. Test alarms, radios, reporting tools and out-of-hours contact routes. Inform site stakeholders about the change and how to raise concerns.

During the first 30 days

Increase supervisory presence and review incidents, near misses, access issues and staff feedback frequently. Check that officers understand the purpose of each control rather than simply following a task list. Correct gaps quickly and record the decision.

By 60 and 90 days

Compare actual demand with the assumptions used in the tender. Review post coverage, patrol design, alarm volumes, visitor patterns and response performance. Agree any specification changes through controlled governance. The 90-day review should confirm whether the service is reducing risk, not merely whether contracted hours were supplied.

Choose a provider that can prove quality in practice

The best security company is not necessarily the largest, the cheapest or the one with the longest list of services. It is the provider that understands your risks, deploys competent people, supervises them consistently, uses technology with purpose and gives you evidence that the service is working.

In 2027, buyers should expect more transparency and place greater weight on quality, responsible employment and measurable protection. A disciplined procurement process creates the foundation for that outcome. Define the risk, test the operating model, verify the evidence and manage the contract as a live risk control.

This guide provides general information and is not legal or procurement advice. Organisations should obtain competent advice for their circumstances and verify current regulatory requirements before making decisions.