Organisations considering an investment in security frequently encounter a confusing range of overlapping terminology: security audits, penetration testing, TSCM, electronic surveillance countermeasures, physical security reviews. Each addresses a genuinely distinct risk, uses a different methodology, and is conducted by a different type of specialist, and understanding the difference is essential to commissioning the right service for a specific concern rather than assuming that any one of them substitutes for the others.
Physical Security
A physical security audit assesses the building’s general security posture: access control systems, perimeter security, visitor management, CCTV coverage for general security purposes (as distinct from TSCM-focused detection of covert devices), and the physical controls protecting sensitive areas such as server rooms or document storage. This is typically conducted by a physical security specialist or a corporate security consultancy and addresses the question of who can get into the building and what they can access once there, rather than whether a covert device is already present.
Cyber Security
Cyber security assessments address the organisation’s digital infrastructure: network security, endpoint protection, email and communications security, and the organisation’s resilience to the categories of attack addressed throughout our cyber investigations content. This is a fundamentally different discipline from TSCM, conducted by cyber security specialists, and addresses risks that exist entirely independently of any physical device or covert surveillance equipment.
TSCM
Technical Surveillance Countermeasures, the subject of this entire article series, specifically addresses the detection of covert physical surveillance devices — listening bugs, hidden cameras, GPS trackers — and the broader assessment of a space’s vulnerability to this specific category of compromise. TSCM is a specialist discipline distinct from general physical security and from cyber security, requiring its own equipment, training, and methodology, set out in full in our article on how TSCM works.
Penetration Testing
Penetration testing is a cyber security discipline in which authorised specialists attempt to actively breach an organisation’s digital systems using the same techniques a real attacker would use, to identify exploitable vulnerabilities before a genuine adversary does. It is entirely digital in focus and has no overlap with the physical detection methodology used in TSCM, though the findings of a penetration test may usefully inform the broader security picture that a TSCM engagement also contributes to.
Electronic Surveillance
Electronic surveillance, in this context, refers to the devices and techniques that TSCM is specifically designed to detect: the listening devices, cameras, and tracking equipment addressed throughout this series. It is the threat that TSCM addresses, rather than a distinct countermeasure discipline in its own right, and is sometimes used loosely and interchangeably with TSCM itself in less precise usage.
Choosing the Right Service
An organisation with a general security concern — wanting reassurance about its overall security posture — should consider a physical security audit and a cyber security assessment as the appropriate starting point. An organisation with a specific concern about confidential conversations being compromised, or operating in a sector where the risk of covert surveillance is elevated, needs a TSCM engagement specifically, which a general security audit will not provide. The two are complementary rather than substitutable: a thorough physical security audit will assess who can access a boardroom, but only a TSCM sweep will tell you whether a device is already inside it.
Many of our corporate clients commission TSCM sweeps alongside, rather than instead of, broader security and cyber assessments, recognising that a comprehensive security posture requires each discipline to address the specific risk it is designed for.
Not sure which security service is right for your organisation? Contact ARF Private Detectives for an honest assessment.