Industry Analysis: Security/Investigations

Security/Investigations can be analyzed as a set of linked economic stages rather than as a single market label. The sector coordinates trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses, transforms them through guarding, monitoring, investigation, incident response, evidence handling and reporting and reaches customers through on-site teams, control centers, mobile response and digital security channels. The strategic question is where value becomes scarce, who controls that scarcity and how technology or regulation can change the answer.

Industry at a glance

Definition and scope. This analysis covers private security, investigation, guarding, monitoring, risk services and related protective services; excludes public law enforcement. The boundary matters because adjacent activities can have different regulation, capital intensity, customer economics and profit pools. Keeping the scope narrow makes the competitive diagnosis more useful for executives deciding where to invest, partner, automate, or exit.

Economic role. The sector serves businesses, institutions, property owners, governments and households. It depends on trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and reaches demand through on-site teams, control centers, mobile response and digital security channels. Its output is valuable when it improves customer economics, reduces risk, increases access, or satisfies a requirement that customers cannot easily meet internally.1

Indicative metrics. Common revenue patterns include hourly or contract guarding, recurring monitoring, investigation fees, project work and managed security contracts. Capital intensity is shaped by communications networks, cameras, access systems, licensing, insurance and legal standards, while labor intensity depends on how much guarding, monitoring, investigation, incident response, evidence handling and reporting can be standardized. Regulation intensity is driven by the cost of maintaining compliance, safety, data, licensing, or quality requirements.2

Industry segmentation

The sector separates into distinct operating models because customers buy different forms of value and because the location of scarce resources changes across the value chain. The relevant segments below are useful for comparing economics without treating the whole industry as one market.

1. Manned guarding: The segment emphasizes a different combination of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and customer requirements. Its economics depend on the degree of differentiation, operating scale and customer switching cost.

2. Investigation services: The segment emphasizes a different combination of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and customer requirements. Its economics depend on the degree of differentiation, operating scale and customer switching cost.

3. Electronic security and monitoring: The segment emphasizes a different combination of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and customer requirements. Its economics depend on the degree of differentiation, operating scale and customer switching cost.

4. Armored and secure transport: The segment emphasizes a different combination of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and customer requirements. Its economics depend on the degree of differentiation, operating scale and customer switching cost.

5. Corporate risk services: The segment emphasizes a different combination of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and customer requirements. Its economics depend on the degree of differentiation, operating scale and customer switching cost.

Market structure: Porter's Five Forces

The Five Forces analysis shows how trust, local density, response capability, client integration and technology-enabled monitoring, customer concentration, supplier constraints and substitution interact. The forces are dynamic: technology can lower entry costs, regulation can raise them and consolidation can alter buyer and supplier power simultaneously. The objective is to identify which structural variable is most likely to change the industry's profit pool over the next planning cycle.3

Bargaining power of buyers

Customer power in Security/Investigations depends on concentration, switching cost, procurement sophistication and the consequences of service failure. Buyers include businesses, institutions, property owners, governments and households. Large or professional buyers can pressure price when offers are comparable, but their leverage falls when a provider controls a scarce capability, delivers high reliability, or becomes embedded in account management, incident reporting, risk assessment and service coordination. In this industry, the key variable is not buyer size alone. It is the buyer's credible outside option and the time required to move to it. Management should track renewal behavior, price realization, concentration and the share of revenue exposed to formal procurement.

Bargaining power of suppliers

Supplier power in Security/Investigations comes from the scarcity and substitutability of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses. Critical suppliers may include people, technology vendors, infrastructure owners, raw-material producers, or regulated service providers. Power rises when qualification is slow, switching interrupts operations, or a supplier controls a bottleneck. It falls when the buyer can standardize specifications, dual-source, redesign the process, or build capability internally. The most exposed firms map supplier concentration to the economic cost of disruption rather than relying on a generic procurement score.

Rivalry among existing competitors

Rivalry is shaped by the number and strength of competitors, the degree of product differentiation, fixed costs and the intensity of customer switching. Firms compete across on-site teams, control centers, mobile response and digital security channels and increasingly around trust, local density, response capability, client integration and technology-enabled monitoring. High fixed costs or excess capacity can push competitors toward discounting. Strong differentiation can redirect rivalry toward quality, service, ecosystem access, or brand. Management should distinguish temporary price competition from a structural decline in willingness to pay.

Threat of new entrants

Entry into Security/Investigations requires more than a product. A credible entrant must assemble communications networks, cameras, access systems, licensing, insurance and legal standards and earn trust in a market where customers already have alternatives. Digital tools can reduce launch costs, but regulation, integration, capital requirements, customer acquisition and operating reliability can preserve incumbent advantages. Entry is most plausible when a new model removes a constraint, targets a neglected segment, or uses a lower-cost distribution mechanism. Incumbents should therefore monitor business-model innovation rather than only direct competitors.

Threat of substitutes

Substitution occurs when customers solve the underlying need through another product, workflow, technology, or internal capability. Relevant alternatives to Security/Investigations can emerge from adjacent sectors and from changes in customer behavior. Substitution risk increases when the industry's output becomes standardized and easy to compare. It decreases when the service is embedded in a workflow, carries high failure costs, or depends on trusted infrastructure. Management should track the customer's total process and the economic attractiveness of alternatives, not just conventional competitors.

Value chain and profit pools

The value chain in Security/Investigations can be read through five recurring stages: upstream inputs, production or processing, distribution and logistics, the customer interface and enabling infrastructure. The precise activities differ by segment, but the economic logic is consistent. Profit follows control over scarce resources, customer access, or operating density rather than following the number of activities a firm performs.

Upstream inputs

Trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses. The key question is whether supply is abundant, differentiated, or constrained. Qualification and switching costs can transfer bargaining power upstream. In Security/Investigations, management should map revenue, contribution margin, working capital and capital employed to this stage instead of treating the industry as a single pool.

Production and processing

Guarding, monitoring, investigation, incident response, evidence handling and reporting. Scale matters when it lowers unit cost, improves yield, or increases utilization. Automation matters when it changes the economics of the process rather than merely reducing headcount. In Security/Investigations, management should map revenue, contribution margin, working capital and capital employed to this stage instead of treating the industry as a single pool.

Distribution and logistics

On-site teams, control centers, mobile response and digital security channels. Distribution creates advantage when density, reliability, speed, or access lowers the delivered cost of serving customers. In Security/Investigations, management should map revenue, contribution margin, working capital and capital employed to this stage instead of treating the industry as a single pool.

Customer interface

Account management, incident reporting, risk assessment and service coordination. The interface determines who owns the relationship, data, renewal decision and pricing conversation. This can capture more value than the underlying production step. In Security/Investigations, management should map revenue, contribution margin, working capital and capital employed to this stage instead of treating the industry as a single pool.

Enabling infrastructure

Communications networks, cameras, access systems, licensing, insurance and legal standards. Infrastructure can create barriers through standards, licenses, network access, financing, or compliance systems that competitors cannot reproduce quickly. In Security/Investigations, management should map revenue, contribution margin, working capital and capital employed to this stage instead of treating the industry as a single pool.

Profit pool

Profit in Security/Investigations tends to concentrate where customers face meaningful consequences from failure and where suppliers control scarce capability. That favors businesses with trust, local density, response capability, client integration and technology-enabled monitoring. Standardized work remains necessary, but it is more exposed to procurement and substitution. Profit pools can shift when remote monitoring, AI-assisted video, integrated security, labor shortages and outcome-based contracts alter customer willingness to pay or change which capabilities are scarce.4

A useful management view separates transaction margin, recurring-service margin and the economic value of customer access. This prevents a common error: treating revenue growth as evidence that the firm controls the attractive part of the value chain. The better question is whether incremental revenue improves price realization, utilization, retention, or return on capital.

Industry economics and business models

Money is made in Security/Investigations through a small set of recurring patterns. The sector supports hourly or contract guarding, recurring monitoring, investigation fees, project work and managed security contracts. Each pattern allocates risk differently across demand, capacity, input prices and customer behavior. Fixed-price commitments transfer delivery risk to providers, while usage-based pricing shifts volume risk toward customers; recurring contracts can improve predictability but may constrain upside when market conditions move sharply.

Business model design should match the pricing unit to the economic value created. Customers may be buying capacity, access, certainty, expertise, performance, or an outcome. Pricing the wrong unit can increase revenue while adding service complexity and weakening returns.

Cost drivers & scalability

The main cost base includes labor, recruiting, training, equipment, vehicles, insurance, technology and supervision. Fixed costs matter when facilities, platforms, specialist teams, or infrastructure must remain available regardless of volume. Variable costs rise with units, transactions, usage, or customer activity. The strategic task is to identify where scale lowers unit cost and where scale instead adds coordination cost.

Scale is valuable when it improves procurement, utilization, data density, network coverage, or service quality. Scope is valuable when one capability can support adjacent products without duplicating the cost base. The flywheel is strongest when better delivery improves trust or engagement, which improves retention and utilization, which then funds further process investment.

Unit economics should connect operating drivers to customer economics. Service models should monitor utilization, productive capacity, quality and retention. Digital models should track acquisition cost, infrastructure cost, engagement and lifetime value where applicable. Asset-heavy models should isolate throughput, yield, downtime and return on capital.

Moats, advantages and strategic levers

Defensibility in Security/Investigations can come from cost advantage, differentiation, network effects, switching costs, regulatory access, or data and learning. The strongest sector-specific sources are trust, local density, response capability, client integration and technology-enabled monitoring. A moat is credible only when it changes customer choice or competitor economics.

Cost advantage can arise from scale, location, process design, utilization, or procurement. Differentiation can come from quality, reliability, brand, specialized knowledge, or workflow integration. Network effects matter when additional users improve the value of the system, while switching costs arise when replacing a provider requires migration, retraining, qualification, redesign, or loss of accumulated data.

Regulatory moats are strongest when compliance requires time, evidence, or operating history. Data moats become meaningful when repeated activity improves prediction, quality, or workflow performance. Management should not label ordinary customer relationships as moats unless those relationships survive a credible competing offer.

Strategic levers

An entrant or incumbent can pull several levers, but each should be tied to a clear economic hypothesis. The objective is to improve price realization, lower delivered cost, increase retention, or gain control over a scarce input or customer interface. This section should be read with the firm's specific operating model and customer mix in view. The relevant management test is whether the stated mechanism improves economics under plausible competitive conditions.

Customer segment focus

Prioritize customers for whom trust, local density, response capability, client integration and technology-enabled monitoring has measurable value rather than pursuing the largest theoretical market. The decision should have a measurable leading indicator and an explicit review point. Growth initiatives become expensive when management cannot state which structural variable they are changing.

Product scope

Decide whether to own the full workflow around guarding, monitoring, investigation, incident response, evidence handling and reporting or dominate one high-value step. The decision should have a measurable leading indicator and an explicit review point. Growth initiatives become expensive when management cannot state which structural variable they are changing.

Integration versus partnering

Integrate when control of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses or communications networks, cameras, access systems, licensing, insurance and legal standards changes economics; partner when scale or access is more valuable than ownership. The decision should have a measurable leading indicator and an explicit review point. Growth initiatives become expensive when management cannot state which structural variable they are changing.

Geographic or channel expansion

Expand where customer density and supply conditions improve the economics of on-site teams, control centers, mobile response and digital security channels. The decision should have a measurable leading indicator and an explicit review point. Growth initiatives become expensive when management cannot state which structural variable they are changing.

Ecosystem orchestration

Use standards, platforms, data, or partnerships to become a coordination point for account management, incident reporting, risk assessment and service coordination. The decision should have a measurable leading indicator and an explicit review point. Growth initiatives become expensive when management cannot state which structural variable they are changing.

Structural risks, regulation and trends

Structural risk in Security/Investigations comes from labor turnover, liability, false alarms, regulation, technology failures and commoditization of guarding. Regulatory change can alter who may participate, what evidence is required and which costs are unavoidable. Technology can change the relative economics of labor, capital, distribution, or customer acquisition. Supply shocks can change which side of the market holds bargaining power.5

Demand should be modeled through customer budgets, demographics, technology adoption, replacement cycles and regulatory requirements where relevant. Supply should be modeled through capacity additions, consolidation, labor availability, productivity and investment timing. That approach is more useful than relying on a single market forecast.

Three scenarios are useful. In the base case, remote monitoring, AI-assisted video, integrated security, labor shortages and outcome-based contracts continue at a measured pace and incumbents adapt. In a compression case, price transparency or automation reduces differentiation faster than expected. In a scarcity case, regulation, supply disruption, or concentrated capacity shifts power toward scarce resources. A resilient strategy remains viable across all three.

Strategic playbook

A new entrant should begin with a narrow customer problem where incumbent cost structures or workflows are poorly matched to the need. The wedge should exploit a specific friction in account management, incident reporting, risk assessment and service coordination or a change created by remote monitoring, AI-assisted video, integrated security, labor shortages and outcome-based contracts. Build-versus-buy decisions should follow the source of defensibility. Proprietary process knowledge often favors internal development; broad infrastructure often favors partnerships.

Incumbents should defend the part of the business that owns customer trust and recurring economics, then redesign low-differentiation work. Technology investment should lower cycle time, error rates, or delivered cost without weakening the capability customers still value. Portfolio reviews should ask which products improve bargaining power and which simply add revenue.

Executives should establish leading indicators such as win rate, price realization, retention, supplier concentration, utilization, quality, working capital and return on incremental capital. Those measures reveal structural change earlier than revenue growth alone.

Operating discipline

The economics of security investigations become clearer when management separates structural drivers from temporary operating conditions. A strong year can come from favorable demand, constrained supply, unusual pricing, or a competitor's execution problem. Those conditions can support earnings without strengthening the underlying position. Management should therefore track the variables that remain relevant when the cycle turns: customer retention, price realization, utilization, conversion cost, working capital and the return generated by incremental investment. These measures reveal whether the organization is becoming more efficient or simply benefiting from the market. They also help distinguish a genuine competitive advantage from a temporary scarcity premium. A useful operating review connects commercial outcomes to the process that produces them, so changes in revenue can be traced to volume, mix, price, productivity, or capacity rather than being treated as one aggregate result.

Investment choices

Capital allocation should follow the same logic. Investment in capacity is attractive when the organization has evidence of durable demand and can earn an acceptable return after maintenance, working capital and compliance costs. Technology investment is attractive when it changes throughput, quality, labor productivity, customer acquisition, or switching costs. Partnerships are attractive when another party owns infrastructure or distribution that would take too long to reproduce. Acquisitions can accelerate capability, but they also introduce integration risk and can inflate the price paid for assets whose scarcity is temporary. Management teams should state the economic mechanism before approving major investment. That discipline is especially useful in security investigations, where changes in technology, regulation, or customer behavior can make yesterday's bottleneck less scarce. The best investment is not the one with the largest addressable market; it is the one that strengthens the firm's position under plausible future conditions.

Customer economics

Customer economics provide a second lens on strategy. A provider can appear differentiated internally while customers view the offer as interchangeable. The test is what the customer would lose by switching. Losses can include downtime, retraining, qualification, data migration, relationship capital, service disruption, or the risk of an inferior outcome. When those costs are real, the provider can often defend price more effectively. When they are low, the provider needs a different source of advantage, such as lower cost, better availability, stronger brand, or a more convenient distribution model. Management should interview customers around the decision process rather than asking whether they like the product. The more useful questions concern the alternatives considered, the failure consequences, the approval process and the reason the customer renews. Those answers reveal where value actually sits in security investigations.

Competitive response

Competitor behavior should also be modeled explicitly. A price cut can signal excess capacity, a strategic investment, a customer-acquisition campaign, or a temporary response to weak utilization. An acquisition can signal a desire for scale, technology, geography, or customer access. A new entrant may appear disruptive while still depending on the same infrastructure as incumbents. Management should therefore analyze competitor moves through the resources they commit and the constraints they remove. This prevents overreacting to visible tactics. The relevant question is whether a competitor is changing the economics of security investigations. If it is, the response should target the underlying mechanism rather than copy the surface feature. If it is not, disciplined execution may be more valuable than a costly strategic response.

Scenario planning

Scenario planning should focus on variables that can move the profit pool rather than producing a long list of generic risks. For security investigations, management can construct cases around demand growth, input availability, technology adoption, regulation and competitive concentration. Each case should identify which customers become more valuable, which assets become stranded and which suppliers gain leverage. The organization can then test whether its current portfolio remains viable. This approach also clarifies which options should be preserved. A firm may choose to maintain a partnership, delay capacity, preserve cash, or keep a technical capability alive because the option becomes valuable in a scarcity scenario. The discipline is to make those choices explicit before the market moves. Strategic flexibility has an economic value when the cost of preserving it is lower than the cost of rebuilding the capability after conditions change.

Caselet

Securitas: operating through structural change This section should be read with the firm's specific operating model and customer mix in view. The relevant management test is whether the stated mechanism improves economics under plausible competitive conditions.

History and operating model

Securitas provides a public example of how the economics of Security/Investigations can be managed through changing market conditions. Its operating history can be examined through public filings, institutional disclosures and sector evidence. The case is useful because it connects strategic positioning to the practical constraints of trained personnel, surveillance technology, vehicles, communications, data, insurance and licenses and communications networks, cameras, access systems, licensing, insurance and legal standards. The organization developed an operating model around a specific customer need and then adjusted its capabilities as technology, regulation, competition, or demand changed.

The operating model shows why scale alone does not guarantee attractive returns. Management must decide which activities should remain proprietary, which can be standardized and which are better sourced from partners. In Security/Investigations, those choices determine the balance between fixed cost, flexibility, service quality and customer control. The case also shows the value of sequencing investments:

capabilities that strengthen the customer interface can create the demand visibility needed to justify capacity or technology investments upstream

Industry dynamics

The case reflects the forces shaping Security/Investigations. Customers can compare alternatives more easily when offers become standardized, while suppliers gain leverage when specialized inputs are scarce. Regulation can create both cost and protection, depending on whether compliance raises the cost of entry or simply adds overhead to every participant. Technology can reduce the cost of delivery while also lowering entry barriers. The company therefore has to decide whether technology is primarily a cost lever, a differentiation tool, or a new distribution channel.

Competitive pressure also changes with market maturity. Early growth can reward capacity expansion and customer acquisition, but later stages often reward utilization, retention, procurement discipline and portfolio selection. A company that continues to optimize for volume after the market becomes more competitive can create revenue without creating economic value. The case highlights the need to adjust operating priorities as the profit pool moves.

Value capture

The value-capture question is where Securitas earns returns relative to the broader value chain. The answer depends on control of trust, local density, response capability, client integration and technology-enabled monitoring, not simply on market share. A firm can hold a large volume position while suppliers, platforms, or customer procurement functions capture much of the economics. Conversely, a focused provider can earn stronger returns when its capability is embedded in the customer's workflow or when replacement would impose meaningful operational risk.

Public evidence should therefore be read through unit economics rather than headline growth. Revenue growth matters when it improves utilization, lowers acquisition cost, strengthens purchasing power, or increases the value of a network or installed base. It matters less when growth requires disproportionate capital, discounts, incentives, or working capital. This distinction is central to evaluating strategic quality in Security/Investigations.6

Strategic lesson

For executives in Security/Investigations, the case supports a practical rule: invest around the constraint that competitors cannot remove quickly. That constraint may be access, trust, regulation, operating density, specialized knowledge, infrastructure, or data. Protect that constraint while using technology to reduce the cost of serving customers. Avoid copying the visible features of a successful incumbent without understanding the economic mechanism underneath them.

The case also shows why portfolio discipline matters. Attractive segments can change as technology lowers costs or regulation alters participation. Management should revisit the source of advantage whenever customer switching becomes easier or a supplier bottleneck becomes less scarce. A durable strategy keeps the organization close to the point where customer value and structural scarcity meet.

• 1Bureau of Labor Statistics Protective Services
• 2Bureau of Labor Statistics Security Guards
• 3Bureau of Labor Statistics Industry Employment
• 4U.S. Department of Labor
• 5Federal Trade Commission
• 6Securities and Exchange Commission